Add explict allow deny commands.

functions

@@ -73,6 +73,65 @@ fn-ga-global-set-list() {
   chmod 600 "$file"
 }
 
+# Additive counterparts to fn-ga-global-set-list, for the allow/deny commands.
+fn-ga-global-list-add() {
+  declare KEY="$1" VALUE="$2"
+  mkdir -p "$GOOGLE_AUTH_DATA_ROOT/global"
+  local file="$GOOGLE_AUTH_DATA_ROOT/global/$KEY"
+  touch "$file"
+  chmod 600 "$file"
+  grep -qxF "$VALUE" "$file" || printf '%s\n' "$VALUE" >>"$file"
+}
+
+fn-ga-global-list-remove() {
+  declare KEY="$1" VALUE="$2"
+  local file="$GOOGLE_AUTH_DATA_ROOT/global/$KEY" tmp
+  [[ -f "$file" ]] || return 0
+  tmp="$(mktemp)"
+  grep -vxF "$VALUE" "$file" >"$tmp" || true
+  cat "$tmp" >"$file"
+  rm -f "$tmp"
+}
+
+fn-ga-global-list-contains() {
+  declare KEY="$1" VALUE="$2"
+  grep -qxF "$VALUE" "$GOOGLE_AUTH_DATA_ROOT/global/$KEY" 2>/dev/null
+}
+
+fn-ga-global-list-count() {
+  declare KEY="$1"
+  fn-ga-global-get-list "$KEY" | grep -c . || true
+}
+
+# Entries end up in a comma/space separated env var, so they may contain
+# neither.
+fn-ga-validate-list-entry() {
+  declare ENTRY="$1"
+  [[ -n "$ENTRY" ]] || return 1
+  ! printf '%s' "$ENTRY" | grep -qE '[,[:space:]]'
+}
+
+# "signal.org" and "@signal.org" name a domain; "guest@partner.com" names one
+# address. Callers strip any leading "@" themselves.
+fn-ga-allow-entry-kind() {
+  declare ENTRY="$1"
+  if [[ "$ENTRY" == @* || "$ENTRY" != *@* ]]; then
+    echo domain
+  else
+    echo email
+  fi
+}
+
+# The service reads the allow/deny lists from its env file at startup, so
+# changing them means recreating the container.
+fn-ga-reload-service-config() {
+  if fn-ga-service-running; then
+    fn-ga-service-start
+  else
+    dokku_log_verbose "auth service is not running; changes apply when it starts"
+  fi
+}
+
 fn-ga-app-dir() {
   declare APP="$1"
   echo "$GOOGLE_AUTH_DATA_ROOT/apps/$APP"
@@ -422,9 +481,10 @@ fn-ga-service-running() {
 
 fn-ga-write-env-file() {
   local envfile="$GOOGLE_AUTH_DATA_ROOT/service.env"
-  local domains emails
+  local domains emails denied
   domains="$(fn-ga-global-get-list allowed-domains | paste -sd, -)"
   emails="$(fn-ga-global-get-list allowed-emails | paste -sd, -)"
+  denied="$(fn-ga-global-get-list denied-emails | paste -sd, -)"
   mkdir -p "$GOOGLE_AUTH_DATA_ROOT"
   umask 077
   cat >"$envfile" <<EOF
@@ -434,6 +494,7 @@ GOOGLE_AUTH_COOKIE_SECRET=$(fn-ga-global-get cookie-secret)
 GOOGLE_AUTH_AUTH_HOST=$(fn-ga-global-get auth-host)
 GOOGLE_AUTH_ALLOWED_DOMAINS=$domains
 GOOGLE_AUTH_ALLOWED_EMAILS=$emails
+GOOGLE_AUTH_DENIED_EMAILS=$denied
 GOOGLE_AUTH_COOKIE_NAME=$(fn-ga-global-get cookie-name _google_auth)
 GOOGLE_AUTH_SESSION_TTL=$(fn-ga-global-get session-ttl 24h)
 GOOGLE_AUTH_ALLOW_INSECURE=$(fn-ga-global-get allow-insecure false)