from __future__ import annotations

from urllib.parse import urlparse

from cti import mitre

from cti.feeds.base import Feed

from cti.models import Indicator

class OpenPhish(Feed):

    name = "openphish"

    url = "https://openphish.com/feed.txt"

    def fixture_name(self) -> str:

        return "openphish.txt"

    def parse(self, raw: str) -> list[Indicator]:

        techniques = sorted(set(mitre.techniques_for_threat_type("phishing")))

        indicators: list[Indicator] = []

        for line in raw.splitlines():

            url = line.strip()

            if not url or not url.lower().startswith("http"):

                continue

            indicators.append(

                Indicator(

                    type="url",

                    value=url,

                    source=self.name,

                    threat_type="phishing",

                    confidence=80,

                    techniques=techniques,

                    tags=["phishing"],

                )

            )

            host = urlparse(url).hostname

            if host:

                indicators.append(

                    Indicator(

                        type="domain",

                        value=host,

                        source=self.name,

                        threat_type="phishing",

                        confidence=75,

                        techniques=techniques,

                        tags=["phishing"],

                    )

                )

        return indicators