Summary: Fixes T7169. We just weren't doing a policy-aware query. Basic idea here is that if you set an app to be visible only to specific users, those specific users are the only ones who should be able to authorize it. In the Phacility cluster, this allows us to prevent users who haven't been invited from logging in to an instance. Test Plan: - Tried to log into an instance I was not a member of. - Logged into an instance I am a member of. Reviewers: btrahan Reviewed By: btrahan Subscribers: epriestley Maniphest Tasks: T7169 Differential Revision: https://secure.phabricator.com/D11696