"""Concrete OSINT enrichers. All passive, public-source lookups. Network calls are guarded

so a missing dependency or offline environment degrades to a clean error envelope rather than

raising. These enrich an investigation that has crossed into the digital domain; they are

deliberately secondary to the ALPR core."""

from __future__ import annotations

import socket

import ssl

from datetime import datetime, timezone

from app.services.enrichment.base import (

    BaseEnricher, EnrichEntity, EnrichRelationship, EnrichResult,

)

try:

    import httpx

except Exception:

    httpx = None

def _http_get(url: str, timeout: float = 8.0, headers: dict | None = None):

    if httpx is None:

        return None, "httpx not installed"

    try:

        r = httpx.get(url, timeout=timeout, headers=headers or {}, follow_redirects=True)

        return r, None

    except Exception as e:

        return None, str(e)

class DnsEnricher(BaseEnricher):

    name, kind, requires_network = "dns", "domain", True

    def run(self, target: str) -> EnrichResult:

        res = EnrichResult(enricher=self.name, target=target, confidence=0.6)

        try:

            infos = socket.getaddrinfo(target, None)

            ips = sorted({i[4][0] for i in infos})

        except OSError as e:

            return self._empty(target, f"dns resolution failed: {e}")

        res.entities.append(EnrichEntity("domain", target))

        for ip in ips:

            res.entities.append(EnrichEntity("ip", ip))

            res.relationships.append(EnrichRelationship("domain", target, "ip", ip, "resolves_to", 0.9))

        res.evidence.append({"type": "dns_a", "records": ips})

        return res

class RdapEnricher(BaseEnricher):

    name, kind, requires_network = "rdap", "domain", True

    def run(self, target: str) -> EnrichResult:

        r, err = _http_get(f"https://rdap.org/domain/{target}")

        if err or r is None:

            return self._empty(target, f"rdap lookup failed: {err}")

        if r.status_code != 200:

            return self._empty(target, f"rdap status {r.status_code}")

        data = r.json()

        attrs = {

            "handle": data.get("handle"),

            "status": data.get("status"),

            "events": [e.get("eventAction") for e in data.get("events", [])],

        }

        res = EnrichResult(enricher=self.name, target=target, confidence=0.8,

                           raw_response=data, source_metadata={"endpoint": "rdap.org"})

        res.entities.append(EnrichEntity("domain", target, attrs))

        res.evidence.append({"type": "rdap", "handle": attrs["handle"], "status": attrs["status"]})

        return res

class CrtShEnricher(BaseEnricher):

    name, kind, requires_network = "crtsh", "domain", True

    def run(self, target: str) -> EnrichResult:

        r, err = _http_get(f"https://crt.sh/?q=%25.{target}&output=json")

        if err or r is None:

            return self._empty(target, f"crt.sh failed: {err}")

        try:

            rows = r.json()

        except Exception:

            return self._empty(target, "crt.sh returned non-json")

        names = sorted({n.strip().lower() for row in rows

                        for n in str(row.get("name_value", "")).splitlines() if n.strip()})

        res = EnrichResult(enricher=self.name, target=target, confidence=0.75,

                           source_metadata={"endpoint": "crt.sh", "cert_count": len(rows)})

        res.entities.append(EnrichEntity("domain", target))

        for n in names[:200]:

            res.entities.append(EnrichEntity("domain", n, {"discovered_via": "cert_transparency"}))

            res.relationships.append(EnrichRelationship("domain", target, "domain", n, "shares_cert_san", 0.7))

        res.evidence.append({"type": "cert_transparency", "subdomains": names[:200]})

        return res

class IpAsnEnricher(BaseEnricher):

    name, kind, requires_network = "ipasn", "ip", True

    def run(self, target: str) -> EnrichResult:

        r, err = _http_get(f"https://ipapi.co/{target}/json/")

        if err or r is None:

            return self._empty(target, f"ip lookup failed: {err}")

        if r.status_code != 200:

            return self._empty(target, f"ip lookup status {r.status_code}")

        data = r.json()

        attrs = {k: data.get(k) for k in ("asn", "org", "city", "region", "country_name", "latitude", "longitude")}

        res = EnrichResult(enricher=self.name, target=target, confidence=0.7,

                           raw_response=data, source_metadata={"endpoint": "ipapi.co"})

        res.entities.append(EnrichEntity("ip", target, attrs))

        if attrs.get("asn"):

            res.entities.append(EnrichEntity("asn", str(attrs["asn"]), {"org": attrs.get("org")}))

            res.relationships.append(EnrichRelationship("ip", target, "asn", str(attrs["asn"]), "announced_by", 0.85))

        res.evidence.append({"type": "ip_geo_asn", **attrs})

        return res

class SecurityTxtEnricher(BaseEnricher):

    name, kind, requires_network = "securitytxt", "domain", True

    def run(self, target: str) -> EnrichResult:

        for path in (f"https://{target}/.well-known/security.txt", f"https://{target}/security.txt"):

            r, err = _http_get(path)

            if r is not None and r.status_code == 200 and "text" in r.headers.get("content-type", ""):

                res = EnrichResult(enricher=self.name, target=target, confidence=0.6,

                                   source_metadata={"path": path})

                res.entities.append(EnrichEntity("domain", target, {"has_security_txt": True}))

                res.evidence.append({"type": "security_txt", "path": path, "body": r.text[:2000]})

                return res

        return self._empty(target, "no security.txt found")

class RobotsEnricher(BaseEnricher):

    name, kind, requires_network = "robots", "domain", True

    def run(self, target: str) -> EnrichResult:

        r, err = _http_get(f"https://{target}/robots.txt")

        if r is None or r.status_code != 200:

            return self._empty(target, f"robots.txt unavailable: {err or r.status_code}")

        disallows = [ln.split(":", 1)[1].strip() for ln in r.text.splitlines()

                     if ln.lower().startswith("disallow:")]

        res = EnrichResult(enricher=self.name, target=target, confidence=0.5,

                           source_metadata={"path": "/robots.txt"})

        res.entities.append(EnrichEntity("domain", target, {"robots_disallow_count": len(disallows)}))

        res.evidence.append({"type": "robots", "disallow": disallows[:100]})

        return res

class GithubEnricher(BaseEnricher):

    name, kind, requires_network = "github", "company", True

    def run(self, target: str) -> EnrichResult:

        r, err = _http_get(f"https://api.github.com/users/{target}",

                           headers={"Accept": "application/vnd.github+json"})

        if r is None or r.status_code != 200:

            return self._empty(target, f"github lookup failed: {err or r.status_code}")

        data = r.json()

        attrs = {k: data.get(k) for k in ("type", "name", "company", "blog", "location",

                                          "public_repos", "followers", "created_at")}

        res = EnrichResult(enricher=self.name, target=target, confidence=0.7,

                           raw_response=data, source_metadata={"endpoint": "api.github.com"})

        res.entities.append(EnrichEntity("company", target, attrs))

        if attrs.get("blog"):

            res.relationships.append(EnrichRelationship("company", target, "domain",

                                                        str(attrs["blog"]), "owns_site", 0.6))

        res.evidence.append({"type": "github_profile", **attrs})

        return res

class TlsCertEnricher(BaseEnricher):

    name, kind, requires_network = "tlscert", "domain", True

    def run(self, target: str) -> EnrichResult:

        try:

            ctx = ssl.create_default_context()

            with socket.create_connection((target, 443), timeout=8) as sock:

                with ctx.wrap_socket(sock, server_hostname=target) as ssock:

                    cert = ssock.getpeercert()

        except Exception as e:

            return self._empty(target, f"tls handshake failed: {e}")

        subject = dict(x[0] for x in cert.get("subject", []))

        issuer = dict(x[0] for x in cert.get("issuer", []))

        res = EnrichResult(enricher=self.name, target=target, confidence=0.7,

                           source_metadata={"port": 443})

        res.entities.append(EnrichEntity("domain", target, {

            "tls_subject_cn": subject.get("commonName"),

            "tls_issuer": issuer.get("organizationName"),

            "tls_not_after": cert.get("notAfter"),

        }))

        res.evidence.append({"type": "tls_cert", "subject": subject, "issuer": issuer,

                             "not_after": cert.get("notAfter")})

        return res