app.py

from pathlib import Path
from datetime import datetime
import json

import streamlit as st

from modules.url_parser import extract_registered_domain, sanitize_filename
from modules.http_collector import collect_http_evidence
from modules.page_analysis import analyze_page
from modules.dns_checks import collect_dns_evidence
from modules.whois_checks import collect_whois_evidence
from modules.ssl_checks import collect_ssl_evidence
from modules.screenshot import capture_screenshot
from modules.favicon_hash import collect_favicon_evidence
from modules.risk_score import score_case
from modules.report_builder import write_evidence_report
from modules.draft_builder import write_generic_takedown_report_draft, write_cert_report_usom_tr, write_registrar_abuse_email_draft, write_hosting_abuse_email_draft


APP_TITLE = "Takedown Evidence Kit"
CASES_DIR = Path("cases")


def create_case_folder(case_id: str, suspicious_url: str) -> Path:
    domain = extract_registered_domain(suspicious_url)

    safe_case_id = sanitize_filename(case_id or "case")
    safe_domain = sanitize_filename(domain)

    folder_name = f"{safe_case_id}_{safe_domain}"
    case_path = CASES_DIR / folder_name
    case_path.mkdir(parents=True, exist_ok=True)

    return case_path



def build_case_json(
    case_id: str,
    suspicious_url: str,
    brand_name: str,
    legitimate_domain: str,
    customer_name: str,
    analyst_notes: str,
    case_path: Path,
    http_evidence: dict,
    page_analysis: dict,
    dns_evidence: dict,
    whois_evidence: dict,
    ssl_evidence: dict,
    screenshot_evidence: dict,
    favicon_evidence: dict,
    evidence_items: list,
    risk: dict,
) -> dict:
    domain = extract_registered_domain(suspicious_url)

    errors = []

    for source_name, evidence in [
        ("http_collector", http_evidence),
        ("page_analysis", page_analysis),
        ("dns_checks", dns_evidence),
        ("whois_checks", whois_evidence),
        ("ssl_checks", ssl_evidence),
        ("screenshot", screenshot_evidence),
        ("favicon_hash", favicon_evidence),
    ]:
        if evidence.get("error"):
            errors.append(
                {
                    "source": source_name,
                    "message": evidence.get("error"),
                }
            )

    return {
        "tool": APP_TITLE,
        "generated_at": datetime.utcnow().isoformat() + "Z",
        "case": {
            "case_id": case_id,
            "customer_or_organization": customer_name,
            "brand_name": brand_name,
            "suspicious_url": suspicious_url,
            "suspicious_domain": domain,
            "legitimate_domain": legitimate_domain,
            "analyst_notes": analyst_notes,
        },
        "outputs": {
            "case_folder": str(case_path),
            "technical_evidence_json": str(case_path / "technical_evidence.json"),
            "headers_txt": str(case_path / "headers.txt"),
            "page_html": str(case_path / "page.html"),
            "screenshot_png": str(case_path / "screenshot.png"),
            "favicon_ico": str(case_path / "favicon.ico"),
            "evidence_report_md": str(case_path / "evidence_report.md"),
            "generic_takedown_report_md": str(case_path / "generic_takedown_report.md"),
            "cert_report_usom_tr_md": str(case_path / "cert_report_usom_tr.md"),
            "registrar_abuse_email_md": str(case_path / "registrar_abuse_email.md"),
            "hosting_abuse_email_md": str(case_path / "hosting_abuse_email.md"),
        },
        "status": "http_page_dns_whois_ssl_screenshot_collected",
        "risk": risk,
        "http": http_evidence,
        "page_analysis": page_analysis,
        "dns": dns_evidence,
        "whois": whois_evidence,
        "ssl": ssl_evidence,
        "screenshot": screenshot_evidence,
        "favicon": favicon_evidence,
        "evidence": evidence_items,
        "errors": errors,
    }


def save_json(data: dict, output_path: Path) -> None:
    output_path.write_text(
        json.dumps(data, indent=2, ensure_ascii=False),
        encoding="utf-8",
    )


def render_download_button(label: str, file_path: Path, mime: str) -> None:
    if not file_path.exists():
        st.caption(f"{label}: file not generated")
        return

    st.download_button(
        label=label,
        data=file_path.read_bytes(),
        file_name=file_path.name,
        mime=mime,
    )


st.set_page_config(
    page_title=APP_TITLE,
    page_icon="🧾",
    layout="wide",
)

st.title("🧾 Takedown Evidence Kit")
st.caption("Local evidence collection assistant for phishing, fraud domain and brand impersonation cases.")

st.warning(
    "This tool does not send emails, submit USOM reports, perform brute force, "
    "or run exploit attempts. Analyst review is always required."
)

with st.sidebar:
    st.header("Case Input")

    suspicious_url = st.text_input(
        "Suspicious URL",
        placeholder="https://fake-brand-login.example.com",
    )

    brand_name = st.text_input(
        "Brand name",
        placeholder="Example Bank",
    )

    legitimate_domain = st.text_input(
        "Legitimate domain",
        placeholder="examplebank.com",
    )

    customer_name = st.text_input(
        "Customer / Organization name",
        placeholder="Example Customer",
    )

    case_id = st.text_input(
        "Case ID",
        placeholder="CASE-001",
    )

    analyst_notes = st.text_area(
        "Analyst notes",
        placeholder="Initial notes about the suspicious website...",
        height=120,
    )

    start_button = st.button("Start Evidence Collection", type="primary")


st.subheader("Evidence Summary")

if start_button:
    if not suspicious_url.strip():
        st.error("Suspicious URL is required.")
        st.stop()

    try:
        case_path = create_case_folder(case_id, suspicious_url)

        http_evidence = collect_http_evidence(suspicious_url, case_path)

        html_file = case_path / "page.html"
        page_analysis = analyze_page(
            html_file=html_file,
            suspicious_url=suspicious_url,
            brand_name=brand_name,
            legitimate_domain=legitimate_domain,
        )

        dns_evidence = collect_dns_evidence(suspicious_url)
        whois_evidence = collect_whois_evidence(suspicious_url)
        ssl_evidence = collect_ssl_evidence(suspicious_url)
        screenshot_evidence = capture_screenshot(suspicious_url, case_path)

        favicon_evidence = collect_favicon_evidence(
            suspicious_url=suspicious_url,
            legitimate_domain=legitimate_domain,
            case_path=case_path,
            html_file=html_file,
            final_url=http_evidence.get("final_url"),
        )

        scoring_result = score_case(
            suspicious_url=suspicious_url,
            legitimate_domain=legitimate_domain,
            http_evidence=http_evidence,
            page_analysis=page_analysis,
            dns_evidence=dns_evidence,
            whois_evidence=whois_evidence,
            ssl_evidence=ssl_evidence,
            screenshot_evidence=screenshot_evidence,
            favicon_evidence=favicon_evidence,
        )

        evidence_items = scoring_result["evidence"]
        risk = scoring_result["risk"]

        case_json = build_case_json(
            case_id=case_id,
            suspicious_url=suspicious_url,
            brand_name=brand_name,
            legitimate_domain=legitimate_domain,
            customer_name=customer_name,
            analyst_notes=analyst_notes,
            case_path=case_path,
            http_evidence=http_evidence,
            page_analysis=page_analysis,
            dns_evidence=dns_evidence,
            whois_evidence=whois_evidence,
            ssl_evidence=ssl_evidence,
            screenshot_evidence=screenshot_evidence,
            favicon_evidence=favicon_evidence,
            evidence_items=evidence_items,
            risk=risk,
        )

        output_file = case_path / "technical_evidence.json"
        save_json(case_json, output_file)
        write_evidence_report(case_json, case_path / "evidence_report.md")
        write_generic_takedown_report_draft(case_json, case_path / "generic_takedown_report.md")
        write_cert_report_usom_tr(case_json, case_path / "cert_report_usom_tr.md")
        write_registrar_abuse_email_draft(case_json, case_path / "registrar_abuse_email.md")
        write_hosting_abuse_email_draft(case_json, case_path / "hosting_abuse_email.md")

        st.success("Evidence collection completed.")

        col1, col2, col3, col4, col5, col6 = st.columns(6)

        with col1:
            st.metric("HTTP Response", "Yes" if http_evidence.get("http_response_received") else "No")

        with col2:
            st.metric("Initial Status", str(http_evidence.get("initial_http_status") or "N/A"))

        with col3:
            st.metric(
                "Final Status",
                str(http_evidence.get("final_http_status") or http_evidence.get("http_status") or "N/A"),
            )

        with col4:
            st.metric("Redirects", str(http_evidence.get("redirect_count", 0)))

        with col5:
            st.metric("Triage Score", risk["triage_score"])

        with col6:
            st.metric("Triage Label", risk["triage_label"])

        if http_evidence.get("cloudflare_challenge_detected"):
            st.warning(
                "Cloudflare challenge detected at the automated HTTP final URL. "
                "Browser-based screenshot evidence may follow a different path."
            )

        http_final_url = http_evidence.get("final_url")
        browser_final_url = screenshot_evidence.get("browser_final_url")

        if http_final_url and browser_final_url and http_final_url != browser_final_url:
            st.info(
                "Browser final URL differs from automated HTTP final URL. "
                f"HTTP final URL: {http_final_url} | Browser final URL: {browser_final_url}"
            )

        if http_evidence.get("redirect_chain"):
            with st.expander("Redirect Chain"):
                st.json(http_evidence.get("redirect_chain"))

        st.subheader("Created Case Folder")
        st.code(str(case_path), language="text")

        st.subheader("Technical Evidence Table")
        st.dataframe(evidence_items, use_container_width=True)

        st.subheader("Exports")

        c1, c2, c3 = st.columns(3)

        with c1:
            render_download_button(
                "Download technical_evidence.json",
                case_path / "technical_evidence.json",
                "application/json",
            )
            render_download_button(
                "Download evidence_report.md",
                case_path / "evidence_report.md",
                "text/markdown",
            )
            render_download_button(
                "Download generic_takedown_report.md",
                case_path / "generic_takedown_report.md",
                "text/markdown",
            )

        with c2:
            render_download_button(
                "Download cert_report_usom_tr.md",
                case_path / "cert_report_usom_tr.md",
                "text/markdown",
            )
            render_download_button(
                "Download registrar_abuse_email.md",
                case_path / "registrar_abuse_email.md",
                "text/markdown",
            )
            render_download_button(
                "Download hosting_abuse_email.md",
                case_path / "hosting_abuse_email.md",
                "text/markdown",
            )

        with c3:
            render_download_button(
                "Download headers.txt",
                case_path / "headers.txt",
                "text/plain",
            )
            render_download_button(
                "Download page.html",
                case_path / "page.html",
                "text/html",
            )
            render_download_button(
                "Download screenshot.png",
                case_path / "screenshot.png",
                "image/png",
            )
            render_download_button(
                "Download favicon.ico",
                case_path / "favicon.ico",
                "image/x-icon",
            )

        if screenshot_evidence.get("screenshot_taken"):
            st.subheader("Screenshot")
            st.image(screenshot_evidence.get("screenshot_file"))

        st.subheader("HTTP Evidence")
        st.json(http_evidence)

        st.subheader("Page Analysis")
        st.json(page_analysis)

        st.subheader("DNS Evidence")
        st.json(dns_evidence)

        st.subheader("WHOIS Evidence")
        st.json(whois_evidence)

        st.subheader("SSL Evidence")
        st.json(ssl_evidence)

        st.subheader("Screenshot Evidence")
        st.json(screenshot_evidence)

        st.subheader("Favicon Evidence")
        st.json(favicon_evidence)

        st.subheader("Full JSON Output")
        st.json(case_json)

    except Exception as exc:
        st.error(f"Evidence collection failed: {exc}")

else:
    col1, col2, col3, col4 = st.columns(4)

    with col1:
        st.metric("Initial Status", "Not collected")

    with col2:
        st.metric("Final Status", "Not collected")

    with col3:
        st.metric("Triage Score", "Not scored")

    with col4:
        st.metric("Triage Label", "Not scored")

    st.subheader("Technical Evidence Table")

    st.dataframe(
        [
            {
                "Check": "Case initialization",
                "Result": "Waiting for input",
                "Evidence": "No case started yet",
                "Severity": "Info",
                "Score impact": 0,
            }
        ],
        use_container_width=True,
    )