Add explict allow deny commands.

subcommands/configure

@@ -8,7 +8,8 @@ cmd-google-auth-configure() {
   local cmd="google-auth:configure"
   [[ "$1" == "$cmd" ]] && shift 1
 
-  local domains=() emails=() domains_given=false emails_given=false
+  local domains=() emails=() denied=()
+  local domains_given=false emails_given=false denied_given=false
   local old_port
   old_port="$(fn-ga-global-get port "$GOOGLE_AUTH_DEFAULT_PORT")"
 
@@ -44,6 +45,17 @@ cmd-google-auth-configure() {
         emails+=("${2,,}")
         shift 2
         ;;
+      --deny-email)
+        [[ -n "${2:-}" ]] || dokku_log_fail "--deny-email requires a value"
+        [[ "$2" == *@* ]] || dokku_log_fail "--deny-email takes a full address (got '$2'); denying a whole domain means removing its --allow-domain"
+        denied_given=true
+        denied+=("${2,,}")
+        shift 2
+        ;;
+      --clear-deny-emails)
+        denied_given=true
+        shift 1
+        ;;
       --session-ttl)
         [[ "${2:-}" =~ ^[0-9]+(h|m|s)$ ]] || dokku_log_fail "--session-ttl must look like 24h, 30m, or 3600s"
         fn-ga-global-set session-ttl "$2"
@@ -75,9 +87,20 @@ cmd-google-auth-configure() {
     esac
   done
 
-  # Replace the allow lists only when new values were passed.
+  # Replace the allow/deny lists only when new values were passed.
   [[ "$domains_given" == "true" ]] && fn-ga-global-set-list allowed-domains "${domains[@]}"
   [[ "$emails_given" == "true" ]] && fn-ga-global-set-list allowed-emails "${emails[@]}"
+  [[ "$denied_given" == "true" ]] && fn-ga-global-set-list denied-emails "${denied[@]}"
+
+  # Deny wins over allow; surface the contradiction instead of silently
+  # ignoring the allow entry.
+  local addr
+  while IFS= read -r addr; do
+    [[ -z "$addr" ]] && continue
+    if fn-ga-global-get-list allowed-emails | grep -qxF "$addr"; then
+      dokku_log_warn "$addr is in both the allow and deny lists; it will be denied"
+    fi
+  done < <(fn-ga-global-get-list denied-emails)
 
   # First run: generate the cookie secret automatically.
   if [[ -z "$(fn-ga-global-get cookie-secret)" ]]; then