Add explict allow deny commands.

internal/authproxy/flow_test.go

@@ -360,6 +360,68 @@ func TestEmailAllowed(t *testing.T) {
 	}
 }
 
+// The denylist outranks both an allowed domain and an explicitly allowed
+// address.
+func TestEmailDenied(t *testing.T) {
+	s := newTestServer(t, "http://unused.invalid")
+	s.cfg.AllowedEmails = []string{"guest@partner.com"}
+	s.cfg.DeniedEmails = []string{"former@signal.org", "guest@partner.com"}
+	cases := map[string]bool{
+		"greyson@signal.org": true,
+		"former@signal.org":  false,
+		"FORMER@SIGNAL.ORG":  false,
+		"guest@partner.com":  false,
+	}
+	for email, want := range cases {
+		if got := s.emailAllowed(email); got != want {
+			t.Errorf("emailAllowed(%q) = %v, want %v", email, got, want)
+		}
+	}
+}
+
+func TestCallbackRejectsDeniedEmail(t *testing.T) {
+	google := fakeGoogle(t, goodClaims())
+	defer google.Close()
+	s := newTestServer(t, google.URL)
+	s.cfg.DeniedEmails = []string{"greyson@signal.org"}
+
+	state := mustState(t, s, appHost, "/")
+	r := httptest.NewRequest("GET",
+		"http://"+authHost+RoutePrefix+"/callback?code=good-code&state="+url.QueryEscape(state), nil)
+	w := do(s.Routes(), r)
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("got %d, want 403", w.Code)
+	}
+	if !strings.Contains(w.Body.String(), "not allowed") {
+		t.Fatalf("body should explain denial: %s", w.Body.String())
+	}
+}
+
+// Denying an address invalidates the sessions it already holds, rather than
+// waiting for them to expire.
+func TestDenylistInvalidatesExistingSession(t *testing.T) {
+	s := newTestServer(t, "http://unused.invalid")
+	sess := sessionClaims{Email: "greyson@signal.org", User: "1", Host: appHost,
+		Exp: time.Now().Add(time.Hour).Unix()}
+	val, err := s.box.seal("session", sess)
+	if err != nil {
+		t.Fatal(err)
+	}
+	newVerify := func() *http.Request {
+		r := httptest.NewRequest("GET", "http://"+appHost+RoutePrefix+"/verify", nil)
+		r.AddCookie(&http.Cookie{Name: "_google_auth", Value: val})
+		return r
+	}
+
+	if w := do(s.Routes(), newVerify()); w.Code != http.StatusOK {
+		t.Fatalf("before denial: got %d, want 200", w.Code)
+	}
+	s.cfg.DeniedEmails = []string{"greyson@signal.org"}
+	if w := do(s.Routes(), newVerify()); w.Code != http.StatusUnauthorized {
+		t.Fatalf("after denial: got %d, want 401", w.Code)
+	}
+}
+
 func TestFlexClaims(t *testing.T) {
 	var tok idToken
 	payload := `{"aud":["a","b"],"email_verified":"true","iss":"accounts.google.com","exp":99}`