#!/usr/bin/env bash
set -eo pipefail
[[ $DOKKU_TRACE ]] && set -x
source "$(dirname "$(dirname "${BASH_SOURCE[0]}")")/functions"

cmd-google-auth-undeny() {
  declare desc="remove an address from the deny list"
  local cmd="google-auth:undeny"
  [[ "$1" == "$cmd" ]] && shift 1

  [[ $# -gt 0 ]] || dokku_log_fail "usage: dokku google-auth:undeny <address...> (see: dokku google-auth:deny)"

  local entry
  for entry in "$@"; do
    entry="${entry,,}"
    if ! fn-ga-global-list-contains denied-emails "$entry"; then
      dokku_log_warn "$entry was not on the deny list"
      continue
    fi
    fn-ga-global-list-remove denied-emails "$entry"
    dokku_log_info1 "removed from deny list: $entry"
    # Undenying only stops the explicit block; the allow list still decides.
    if ! fn-ga-global-list-contains allowed-emails "$entry" &&
      ! fn-ga-global-list-contains allowed-domains "${entry#*@}"; then
      dokku_log_warn "$entry still cannot sign in — nothing on the allow list covers it (see: dokku google-auth:allow)"
    fi
  done

  fn-ga-reload-service-config
}

cmd-google-auth-undeny "$@"