Allow per-app allow/deny.

internal/authproxy/config.go

@@ -14,6 +14,11 @@ const (
 	// RoutePrefix is the URL namespace the proxy owns on every protected
 	// host. It must match the locations the plugin writes into nginx.
 	RoutePrefix = "/_google-auth"
+
+	// AppHeader carries the dokku app name a request belongs to. Every nginx
+	// location that reaches this service sets it explicitly, which also
+	// overwrites anything a client tried to send.
+	AppHeader = "X-Google-Auth-App"
 )
 
 // Config holds everything the auth service needs. It is normally populated
@@ -44,6 +49,12 @@ type Config struct {
 	// whole domain it belongs to.
 	DeniedEmails []string
 
+	// AppConfigDir holds one subdirectory per app with that app's own
+	// allow/deny lists, bind-mounted read-only by the plugin. An app's allow
+	// rules replace the global ones; deny lists are combined. Empty disables
+	// per-app config, leaving the global lists in charge.
+	AppConfigDir string
+
 	CookieName string
 	SessionTTL time.Duration
 	ListenAddr string
@@ -68,6 +79,7 @@ func ConfigFromEnv() (Config, error) {
 		AuthHost:      normalizeHost(os.Getenv("GOOGLE_AUTH_AUTH_HOST")),
 		CookieName:    envOr("GOOGLE_AUTH_COOKIE_NAME", "_google_auth"),
 		ListenAddr:    envOr("GOOGLE_AUTH_LISTEN", ":2999"),
+		AppConfigDir:  os.Getenv("GOOGLE_AUTH_APP_CONFIG_DIR"),
 		AuthorizeURL:  envOr("GOOGLE_AUTH_AUTHORIZE_URL", googleAuthorizeURL),
 		TokenURL:      envOr("GOOGLE_AUTH_TOKEN_URL", googleTokenURL),
 		AllowInsecure: os.Getenv("GOOGLE_AUTH_ALLOW_INSECURE") == "true",