import unittest

from app.validator.mx_intel import mx_is_trusted


class TrustedMxProviderTests(unittest.TestCase):
    """Direct coverage of the trusted-MX gate.

    The gate decides whether the ML advisory may speak at all: a trusted host
    means "paid business mail platform, disposable domains are implausible
    here". Missing a real provider therefore re-introduces the exact false
    positive the gate exists to prevent (a legitimate SMB flagged disposable).

    Providers below were observed in the user's real 800-row export.
    """

    TRUSTED = [
        # enterprise platforms
        "aspmx.l.google.com", "alt3.aspmx.l.google.com", "smtp.google.com",
        "aspmx2.googlemail.com",
        "contoso-com.mail.protection.outlook.com",
        # email-security gateways in front of corporate mail
        "mx1-us1.ppe-hosted.com", "mx2-usg2.ppe-hosted.com",
        "mx1.mailchannels.net", "mx1-us.emailsecurity.app",
        # business hosting / mailbox providers (paid custom domains)
        "mx00.ionos.com", "mx01.ionos.com",
        "eforward1.registrar-servers.com", "eforward2.registrar-servers.com",
        "west.smtp.mx.exch122.serverdata.net",
        "mx.zoho.com", "mx1.fastmail.com", "mail.protonmail.ch",
        "mx01.mail.icloud.com",
    ]

    UNTRUSTED = [
        # self-hosted / unknown MX: nowhere near enough signal to skip the model
        "mail.abcoimport.com", "mx.sketchy-host.test", "mx.example.com",
        "tempmail.example.net",
        # spoof-adjacent hostnames must NOT match a trusted suffix
        "google.com.evil.test", "notgoogle.com", "xn--google.com",
        "protection.outlook.com.evil.test", "fake-ppe-hosted.com",
    ]

    def test_real_business_providers_are_trusted(self):
        untrusted = [h for h in self.TRUSTED if not mx_is_trusted(h)]
        self.assertEqual(untrusted, [], f"legit providers not trusted: {untrusted}")

    def test_unknown_and_spoofed_hosts_are_not_trusted(self):
        trusted = [h for h in self.UNTRUSTED if mx_is_trusted(h)]
        self.assertEqual(trusted, [], f"untrustworthy hosts trusted: {trusted}")

    def test_matching_is_case_and_trailing_dot_insensitive(self):
        for host in ("ASPmx.L.Google.COM", "aspmx.l.google.com.", "  aspmx.l.google.com  "):
            self.assertTrue(mx_is_trusted(host), host)

    def test_empty_and_none_are_not_trusted(self):
        self.assertFalse(mx_is_trusted(""))
        self.assertFalse(mx_is_trusted(None))


if __name__ == "__main__":
    unittest.main()