Allow per-app allow/deny.

subcommands/undeny

@@ -4,29 +4,41 @@ set -eo pipefail
 source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"
 
 cmd-google-auth-undeny() {
-  declare desc="remove an address from the deny list"
+  declare desc="remove an address from a deny list"
   local cmd="google-auth:undeny"
   [[ "$1" == "$cmd" ]] && shift 1
 
-  [[ $# -gt 0 ]] || dokku_log_fail "usage: dokku google-auth:undeny <address...> (see: dokku google-auth:deny)"
+  fn-ga-resolve-scope "$cmd" "${1:-}"
+  local scope="$GA_SCOPE"
+  shift 1 || true
+
+  [[ $# -gt 0 ]] || dokku_log_fail "usage: dokku $cmd <app>|--global <address...>"
 
   local entry
   for entry in "$@"; do
     entry="${entry,,}"
-    if ! fn-ga-global-list-contains denied-emails "$entry"; then
-      dokku_log_warn "$entry was not on the deny list"
+    if ! fn-ga-list-contains "$scope" denied-emails "$entry"; then
+      dokku_log_warn "$entry was not on the deny list $(fn-ga-scope-label "$scope")"
+      # A global denial cannot be lifted per app; say so rather than let the
+      # operator think the address is unblocked now.
+      if [[ "$scope" != "global" ]] && fn-ga-list-contains global denied-emails "$entry"; then
+        dokku_log_warn "$entry is denied globally, which no app can override — run: dokku google-auth:undeny --global $entry"
+      fi
       continue
     fi
-    fn-ga-global-list-remove denied-emails "$entry"
-    dokku_log_info1 "removed from deny list: $entry"
-    # Undenying only stops the explicit block; the allow list still decides.
-    if ! fn-ga-global-list-contains allowed-emails "$entry" &&
-      ! fn-ga-global-list-contains allowed-domains "${entry#*@}"; then
-      dokku_log_warn "$entry still cannot sign in — nothing on the allow list covers it (see: dokku google-auth:allow)"
+    fn-ga-list-remove "$scope" denied-emails "$entry"
+    dokku_log_info1 "removed from the deny list $(fn-ga-scope-label "$scope"): $entry"
+    if [[ "$scope" != "global" ]] && fn-ga-list-contains global denied-emails "$entry"; then
+      dokku_log_warn "$entry is still denied globally — run: dokku google-auth:undeny --global $entry"
+      continue
+    fi
+    # Undenying only lifts the block; the allow lists still decide.
+    if ! fn-ga-email-effectively-allowed "$scope" "$entry"; then
+      dokku_log_warn "$entry still cannot sign in — nothing on the allow list covers it (see: dokku google-auth:allow $(fn-ga-scope-arg "$scope"))"
     fi
   done
 
-  fn-ga-reload-service-config
+  fn-ga-apply-list-change "$scope"
 }
 
 cmd-google-auth-undeny "$@"