Add explict allow deny commands.

README.md

@@ -132,7 +132,10 @@ Docker (always present on a dokku host), and nginx built with
 
 5. Note the client ID and client secret.
 
-### 2. Configure the plugin (one time)
+### 2. Configure the plugin
+
+`configure` is re-runnable: every flag it takes is persisted and can be
+changed later by passing it again.
 
 ```bash
 dokku google-auth:configure \
@@ -151,12 +154,60 @@ Other flags (all optional, all persisted):
 |---|---|---|
 | `--allow-domain <d>` | allow any verified `*@d` account (repeatable; replaces the stored list) | — |
 | `--allow-email <e>` | allow a specific address, e.g. an outside collaborator (repeatable) | — |
+| `--deny-email <e>` | block a specific address even if the allow lists cover it (repeatable; replaces the stored list) | — |
+| `--clear-deny-emails` | empty the deny list | — |
 | `--session-ttl <dur>` | how long a sign-in lasts (`24h`, `72h`, `30m`, …) | `24h` |
 | `--cookie-name <n>` | session cookie name | `_google_auth` |
 | `--port <p>` | host port (127.0.0.1 only) for the auth service | `2999` |
 | `--regenerate-cookie-secret` | rotate the session encryption key (signs everyone out) | — |
 
-### 3. Protect apps
+These flags **replace** the list they name, which suits initial setup. For
+one-at-a-time changes afterwards, see the next section.
+
+### 3. Decide who is allowed in
+
+`--allow-domain` and `--allow-email` together form the **allowlist**, and at
+least one entry is required. Any account matching neither is rejected — there
+is no "allow everyone" mode. So to limit access to a specific list of people,
+use only addresses and no domain:
+
+```bash
+dokku google-auth:allow greyson@signal.org alice@signal.org
+```
+
+The **deny list** is checked first and wins over both allow rules, which is
+how you cut off one person without narrowing the whole domain:
+
+```bash
+dokku google-auth:allow signal.org           # everyone at signal.org…
+dokku google-auth:deny former@signal.org     # …except this account
+```
+
+These four commands each change one entry at a time and restart the auth
+service for you:
+
+```bash
+dokku google-auth:allow                      # show the allow list
+dokku google-auth:allow signal.org           # a domain (any verified account there)
+dokku google-auth:allow guest@partner.com    # one address
+dokku google-auth:unallow guest@partner.com  # remove either kind
+
+dokku google-auth:deny                       # show the deny list
+dokku google-auth:deny former@signal.org
+dokku google-auth:undeny former@signal.org
+```
+
+Changes take effect on the affected user's **next request**: session cookies
+are re-checked against the current lists rather than trusted until they
+expire, so denying (or unallowing) someone with a live session ends it. To
+sign out everyone at once instead, use
+`configure --regenerate-cookie-secret`.
+
+`unallow` refuses to remove the last allow entry, since an empty allowlist
+locks everyone out of every enabled app. `dokku google-auth:report` shows
+both lists as they currently stand.
+
+### 4. Protect apps
 
 ```bash
 dokku google-auth:enable my-app
@@ -167,7 +218,7 @@ dokku google-auth:enable other-app
 That's it. Visit the app in a browser — you'll be bounced through Google and
 back.
 
-### 4. Exclude paths (optional, per app)
+### 5. Exclude paths (optional, per app)
 
 ```bash
 # Path prefix — everything under it is open:
@@ -187,8 +238,10 @@ protect them yourself (API key, HMAC signature, etc.).
 ### Day-to-day commands
 
 ```bash
-dokku google-auth:report            # global + per-app status
+dokku google-auth:report            # global + per-app status, incl. both access lists
 dokku google-auth:report my-app     # one app
+dokku google-auth:allow alice@signal.org   # let someone in
+dokku google-auth:deny former@signal.org   # cut someone off
 dokku google-auth:disable my-app    # turn SSO off for an app
 dokku google-auth:logs -t           # follow auth service logs (sign-ins, denials)
 dokku google-auth:restart           # restart the auth service