Add recursive deny to allowlists.

Also change behavior of the recursive check - the more specific
directory will be chosen now, for competing recursives.

This is part of an effort to enable mixed_libc and mixed_droid on
internal master - many denies are required and this would simplify the
effort.
Test: m nothing

Change-Id: I7de05337644d8e1804078c66669dd0b2d65f3e71
diff --git a/android/allowlists/allowlists.go b/android/allowlists/allowlists.go
index a9c766b..31368b2 100644
--- a/android/allowlists/allowlists.go
+++ b/android/allowlists/allowlists.go
@@ -33,6 +33,10 @@
 	// all modules in this package (not recursively) default to bp2build_available: false.
 	// allows modules to opt-in.
 	Bp2BuildDefaultFalse
+
+	// all modules in this package and subpackages default to bp2build_available: false.
+	// allows modules to opt-in.
+	Bp2BuildDefaultFalseRecursively
 )
 
 var (
diff --git a/android/bazel.go b/android/bazel.go
index 7b227bd..d30cb80 100644
--- a/android/bazel.go
+++ b/android/bazel.go
@@ -489,21 +489,27 @@
 	// Check if the package path has an exact match in the config.
 	if config[packagePath] == allowlists.Bp2BuildDefaultTrue || config[packagePath] == allowlists.Bp2BuildDefaultTrueRecursively {
 		return true, packagePath
-	} else if config[packagePath] == allowlists.Bp2BuildDefaultFalse {
+	} else if config[packagePath] == allowlists.Bp2BuildDefaultFalse || config[packagePath] == allowlists.Bp2BuildDefaultFalseRecursively {
 		return false, packagePath
 	}
 
 	// If not, check for the config recursively.
-	packagePrefix := ""
-	// e.g. for x/y/z, iterate over x, x/y, then x/y/z, taking the final value from the allowlist.
-	for _, part := range strings.Split(packagePath, "/") {
-		packagePrefix += part
-		if config[packagePrefix] == allowlists.Bp2BuildDefaultTrueRecursively {
+	packagePrefix := packagePath
+
+	// e.g. for x/y/z, iterate over x/y, then x, taking the most-specific value from the allowlist.
+	for strings.Contains(packagePrefix, "/") {
+		dirIndex := strings.LastIndex(packagePrefix, "/")
+		packagePrefix = packagePrefix[:dirIndex]
+		switch value := config[packagePrefix]; value {
+		case allowlists.Bp2BuildDefaultTrueRecursively:
 			// package contains this prefix and this prefix should convert all modules
 			return true, packagePrefix
+		case allowlists.Bp2BuildDefaultFalseRecursively:
+			//package contains this prefix and this prefix should NOT convert any modules
+			return false, packagePrefix
 		}
 		// Continue to the next part of the package dir.
-		packagePrefix += "/"
+
 	}
 
 	return false, packagePath
diff --git a/android/bazel_test.go b/android/bazel_test.go
index dbe6067..3164b23 100644
--- a/android/bazel_test.go
+++ b/android/bazel_test.go
@@ -71,6 +71,20 @@
 			},
 			packageDir: "a",
 		},
+		{
+			prefixes: allowlists.Bp2BuildConfig{
+				"a":   allowlists.Bp2BuildDefaultFalseRecursively,
+				"a/b": allowlists.Bp2BuildDefaultTrue,
+			},
+			packageDir: "a/b",
+		},
+		{
+			prefixes: allowlists.Bp2BuildConfig{
+				"a":   allowlists.Bp2BuildDefaultFalseRecursively,
+				"a/b": allowlists.Bp2BuildDefaultTrueRecursively,
+			},
+			packageDir: "a/b/c",
+		},
 	}
 
 	for _, test := range testCases {
@@ -133,6 +147,20 @@
 			},
 			packageDir: "a",
 		},
+		{
+			prefixes: allowlists.Bp2BuildConfig{
+				"a":   allowlists.Bp2BuildDefaultFalseRecursively,
+				"a/b": allowlists.Bp2BuildDefaultTrue,
+			},
+			packageDir: "a/b/c",
+		},
+		{
+			prefixes: allowlists.Bp2BuildConfig{
+				"a":   allowlists.Bp2BuildDefaultTrueRecursively,
+				"a/b": allowlists.Bp2BuildDefaultFalseRecursively,
+			},
+			packageDir: "a/b/c",
+		},
 	}
 
 	for _, test := range testCases {