Add explict allow deny commands.

internal/authproxy/server.go

@@ -286,11 +286,22 @@ func (s *Server) sessionFromRequest(r *http.Request) (*sessionClaims, bool) {
 	if sess.Host != requestHost(r) {
 		return nil, false
 	}
+	// Re-check authorization on every request so allow/deny list changes take
+	// effect immediately instead of whenever existing sessions happen to
+	// expire.
+	if !s.emailAllowed(sess.Email) {
+		return nil, false
+	}
 	return &sess, true
 }
 
+// emailAllowed applies the denylist first (it always wins), then the
+// allowlist: an address must match an allowed email or an allowed domain.
 func (s *Server) emailAllowed(email string) bool {
 	email = strings.ToLower(email)
+	if slices.Contains(s.cfg.DeniedEmails, email) {
+		return false
+	}
 	if slices.Contains(s.cfg.AllowedEmails, email) {
 		return true
 	}