import type { FraudAdapter, SignupCtx, FraudSignal, AdapterConfig } from '../types.js'

// Well-known provider domains that legitimately accept all addresses — never flag these
const KNOWN_PROVIDERS = new Set([
  'gmail.com',
  'googlemail.com',
  'yahoo.com',
  'yahoo.co.il',
  'outlook.com',
  'hotmail.com',
  'live.com',
  'icloud.com',
  'me.com',
  'mac.com',
  'protonmail.com',
  'proton.me',
  'walla.co.il',
  'bezeqint.net',
])

/**
 * Flag when:
 *   1. Domain is NOT a known major provider.
 *   2. Domain appears for the Nth new user in a rolling window (cfg.params.clusterThreshold).
 * Relies on a simple DB count; no external DNS call (avoids latency in hot path).
 */
export const emailCatchallDomainAdapter: FraudAdapter<SignupCtx> = {
  key: 'email-catchall-domain',
  points: ['SIGNUP'],
  async evaluate(ctx: SignupCtx, cfg: AdapterConfig): Promise<FraudSignal | null> {
    if (!ctx.refereeEmail) return null
    const domain = ctx.refereeEmail.toLowerCase().split('@')[1] ?? ''
    if (KNOWN_PROVIDERS.has(domain)) return null

    const threshold = (cfg.params?.['clusterThreshold'] as number | undefined) ?? 3
    const windowHours = Number(cfg.params?.['windowHours'] ?? 24)
    if (!Number.isInteger(windowHours) || windowHours <= 0 || windowHours > 8760) return null

    const cnt = await ctx.host.countSignupsByEmailDomainInWindow(domain, windowHours)

    if (cnt < threshold) return null

    return {
      adapter: 'email-catchall-domain',
      action: 'flag',
      codes: ['CATCHALL_DOMAIN_CLUSTER'],
      detail: { domain, signupsInWindow: cnt, threshold, windowHours },
    }
  },
}