from __future__ import annotations

from cti import mitre

from cti.feeds.base import Feed, load_json

from cti.models import Indicator

class LeakFeed(Feed):

    name = "leaks"

    url = ""

    def fetch_raw(self) -> str:

        endpoint = self.settings.get("endpoint")

        if not endpoint:

            return "[]"

        self.url = endpoint

        return super().fetch_raw()

    def headers(self) -> dict:

        token = self.settings.get("token")

        return {"Authorization": f"Bearer {token}"} if token else {}

    def parse(self, raw: str) -> list[Indicator]:

        entries = load_json(raw)

        techniques = sorted(set(mitre.techniques_for_threat_type("leaked_credentials")))

        watched = {d.lower() for d in self.settings.get("watch_domains", [])}

        indicators: list[Indicator] = []

        for entry in entries:

            email = (entry.get("email") or "").strip().lower()

            if not email or "@" not in email:

                continue

            domain = email.split("@", 1)[1]

            if watched and domain not in watched:

                continue

            indicators.append(

                Indicator(

                    type="email",

                    value=email,

                    source=self.name,

                    threat_type="leaked_credentials",

                    confidence=70,

                    techniques=techniques,

                    tags=[entry.get("breach", "unknown_breach")],

                    first_seen=entry.get("breach_date"),

                )

            )

        return indicators