"""Security regressions for untrusted bounty report parsing."""

from app.domains.bounty.ai import _PROMPT_CHARS, _fallback_email


def test_fallback_email_scans_only_a_bounded_prefix_without_regex_backtracking():
    adversarial = "%" * (_PROMPT_CHARS * 4)
    assert _fallback_email(adversarial) is None
    assert _fallback_email(f"From: Researcher <whitehat@example.org>\n{adversarial}") == (
        "whitehat@example.org"
    )
    assert _fallback_email(f"{adversarial} late@example.org") is None


def test_fallback_email_skips_internal_and_no_reply_senders():
    body = (
        "From: noreply@example.org, staff@pingcap.com, invalid@domain.1, "
        "person@example.net"
    )
    assert _fallback_email(body) == "person@example.net"