窓口をパンクさせる「DDoS攻撃」と、
会社の看板を守る「なりすましメール（DMARC）対策」。

#![forbid(unsafe_code)]

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum AlignmentMode {
    Relaxed,
    Strict,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum DmarcDisposition {
    Pass,
    Quarantine,
    Reject,
}

/// Extracts the organizational domain (approximated for standard 2-level/ccTLD registrable labels).
#[inline]
pub fn org_domain(domain: &str) -> &str {
    let d = domain.trim().trim_end_matches('.');
    let parts: usize = d.bytes().filter(|&b| b == b'.').count() + 1;
    let keep_labels = if d.ends_with(".co.jp") || d.ends_with(".or.jp") || d.ends_with(".ne.jp") {
        3
    } else {
        2
    };
    if parts <= keep_labels {
        return d;
    }
    let mut seen_dots = 0;
    for (idx, b) in d.bytes().enumerate().rev() {
        if b == b'.' {
            seen_dots += 1;
            if seen_dots == keep_labels {
                return &d[idx + 1..];
            }
        }
    }
    d
}

#[inline]
pub fn identifiers_align(auth_dom: &str, header_from_dom: &str, mode: AlignmentMode) -> bool {
    match mode {
        AlignmentMode::Strict => auth_dom.eq_ignore_ascii_case(header_from_dom),
        AlignmentMode::Relaxed => org_domain(auth_dom).eq_ignore_ascii_case(org_domain(header_from_dom)),
    }
}

/// Evaluates RFC 7489 Section 6.6.2 DMARC verification and returns policy disposition.
pub fn evaluate_dmarc(
    rfc5322_from_dom: &str,
    spf_passed: bool,
    rfc5321_mail_from_dom: &str,
    aspf: AlignmentMode,
    dkim_passed: bool,
    dkim_d_tag_dom: &str,
    adkim: AlignmentMode,
) -> DmarcDisposition {
    let spf_aligned = spf_passed && identifiers_align(rfc5321_mail_from_dom, rfc5322_from_dom, aspf);
    let dkim_aligned = dkim_passed && identifiers_align(dkim_d_tag_dom, rfc5322_from_dom, adkim);

    if spf_aligned || dkim_aligned {
        DmarcDisposition::Pass
    } else {
        DmarcDisposition::Reject
    }
}