/** Inbound authentication verdict evaluation shared by SMTP acceptance and ops reporting. */
export interface IInboundAcceptanceEvaluation {
  status: 'accepted' | 'flagged';
  doubts: string[];
  dmarcReject: boolean;
  dmarcDomain?: string;
}

export function evaluateInboundAcceptance(securityResults: any): IInboundAcceptanceEvaluation {
  const doubts: string[] = [];
  let dmarcReject = false;
  let dmarcDomain: string | undefined;

  // Infrastructure failures are our problem, not evidence against the sender.
  const spfResult = String(securityResults?.spf?.result || '').toLowerCase();
  if (spfResult === 'fail' || spfResult === 'softfail') {
    doubts.push(`SPF ${spfResult} for ${securityResults?.spf?.domain || 'sender domain'}`);
  }

  // Ignore the placeholder emitted when no DKIM signature exists.
  const dkimSignatures = (Array.isArray(securityResults?.dkim) ? securityResults.dkim : [])
    .filter((signature: any) => String(signature?.status || '').toLowerCase() !== 'none');
  if (dkimSignatures.length > 0 && !dkimSignatures.some((signature: any) => signature?.is_valid)) {
    doubts.push('DKIM signature(s) present but none verified');
  }

  // A failed DMARC alignment is a security finding even when the sender
  // publishes p=none. Policy controls enforcement, not the authentication result.
  const dmarc = securityResults?.dmarc;
  if (dmarc && dmarc.passed === false) {
    const policy = String(dmarc.policy || '').toLowerCase();
    const action = String(dmarc.action || '').toLowerCase();
    dmarcDomain = dmarc.domain || undefined;
    if (action === 'reject' || policy === 'reject') {
      dmarcReject = true;
    }
    doubts.push(`DMARC failed for ${dmarc.domain || 'sender domain'} (policy ${dmarc.policy || 'unknown'})`);
  }
  return {
    status: doubts.length > 0 ? 'flagged' : 'accepted',
    doubts,
    dmarcReject,
    dmarcDomain,
  };
}