Add explict allow deny commands.

internal/authproxy/config.go

@@ -33,12 +33,17 @@ type Config struct {
 	// has google-auth enabled).
 	AuthHost string
 
-	// AllowedDomains / AllowedEmails control who may sign in. An email is
-	// accepted if its domain is in AllowedDomains or the full address is in
-	// AllowedEmails.
+	// AllowedDomains / AllowedEmails are the allowlist: an email is accepted
+	// if its domain is in AllowedDomains or the full address is in
+	// AllowedEmails. Anything else is rejected.
 	AllowedDomains []string
 	AllowedEmails  []string
 
+	// DeniedEmails is the denylist. It is checked before the allowlist and
+	// always wins, so a single address can be revoked without dropping the
+	// whole domain it belongs to.
+	DeniedEmails []string
+
 	CookieName string
 	SessionTTL time.Duration
 	ListenAddr string
@@ -79,6 +84,7 @@ func ConfigFromEnv() (Config, error) {
 		cfg.AllowedDomains = append(cfg.AllowedDomains, strings.TrimPrefix(d, "@"))
 	}
 	cfg.AllowedEmails = splitList(os.Getenv("GOOGLE_AUTH_ALLOWED_EMAILS"))
+	cfg.DeniedEmails = splitList(os.Getenv("GOOGLE_AUTH_DENIED_EMAILS"))
 
 	return cfg, cfg.validate()
 }