from playwright.sync_api import sync_playwright
import json

def extract_dom_features(url: str) -> str:
    if not url.startswith("http"):
        return json.dumps({"error": "No valid URL provided."})
        
    try:
        with sync_playwright() as p:
            browser = p.chromium.launch(headless=True)
            page = browser.new_page()
            # 10-second timeout to prevent stalling on dead phishing links
            page.goto(url, timeout=10000) 
            
            # Extract where login forms actually send data
            forms = page.locator("form").evaluate_all(
                "elements => elements.map(e => ({ action: e.action, method: e.method }))"
            )
            
            # Extract invisible tracking/token fields
            hidden_inputs = page.locator("input[type='hidden']").evaluate_all(
                "elements => elements.map(e => ({ name: e.name, value: e.value }))"
            )
            
            browser.close()
            return json.dumps({"forms": forms, "hidden_inputs": hidden_inputs})
    except Exception as e:
        return json.dumps({"scraper_error": str(e)})