"""Company domain registration policy."""

from __future__ import annotations

from app.services.domain_provisioning import normalize_domain, validate_domain

# Well-known domains that must never be used for company onboarding.
BLOCKED_COMPANY_DOMAINS = frozenset(
    {
        "google.com",
        "gmail.com",
        "yahoo.com",
        "outlook.com",
        "hotmail.com",
        "live.com",
        "icloud.com",
        "apple.com",
        "microsoft.com",
        "amazon.com",
        "facebook.com",
        "meta.com",
        "linkedin.com",
        "proton.me",
        "protonmail.com",
        "aol.com",
        "zoho.com",
        "fastmail.com",
        "yandex.com",
        "mail.ru",
        "cloudflare.com",
        "github.com",
    }
)


def assert_company_domain_allowed(domain: str, platform_domain: str) -> str:
    """Validate format and reject reserved or platform domains."""
    normalized = validate_domain(domain)
    if normalized == normalize_domain(platform_domain):
        raise ValueError(
            f"You cannot register {platform_domain} as a company domain. "
            "Use a domain your organization controls."
        )
    if normalized in BLOCKED_COMPANY_DOMAINS:
        raise ValueError(
            "That domain cannot be used for company signup. "
            "Enter a domain you control and can edit in DNS."
        )
    return normalized