Update analyze_email_main.py

analyze_email_main.py

@@ -3,13 +3,27 @@ from parse_email import parse_email
 from header_analyzer import analyze_headers
 from body_analyzer import analyze_body
 from url_analyzer import analyze_urls
+import re
+
+def parse_auth_results(auth_results: str):
+    """Extract SPF, DKIM, and DMARC values from Authentication-Results header."""
+    results = {"spf": "unknown", "dkim": "unknown", "dmarc": "unknown"}
+    if not auth_results:
+        return results
+    auth_results = auth_results.lower()
+    for key in results.keys():
+        m = re.search(rf"{key}=([\w-]+)", auth_results)
+        if m:
+            results[key] = m.group(1)
+    return results
+
 
 def analyze(file_path):
     # parse
     headers, subject, body, urls, images = parse_email(file_path)
 
     # header analysis
-    header_findings, header_score = analyze_headers(headers or {})
+    header_findings, header_score, auth_summary = analyze_headers(headers or {})
 
     # url analysis (keeps previous checks like Safe Browsing / URLHaus)
     url_findings, url_score = analyze_urls(urls or [])
@@ -20,10 +34,8 @@ def analyze(file_path):
     # combine scores
     total_score = 0
     total_score += (header_score or 0)
-    # weight body more
-    total_score += (body_score or 0) * 1.0
-    # weight urls also (url analyzer already returns a score)
-    total_score += (url_score or 0) * 1.2
+    total_score += (body_score or 0) * 1.0  # weight body normally
+    total_score += (url_score or 0) * 1.2   # URLs a bit heavier
 
     # clamp
     try:
@@ -33,7 +45,7 @@ def analyze(file_path):
     total_score = max(0.0, min(total_score, 100.0))
     total_score_rounded = round(total_score)
 
-    # final verdict (majority-driven — body_verdict also considered)
+    # final verdict
     if total_score >= 70:
         verdict = "🚨 Malicious"
     elif 50 <= total_score < 70:
@@ -43,7 +55,7 @@ def analyze(file_path):
     else:
         verdict = "✅ Safe"
 
-    # attack type heuristics (enriched by behavior inference when present in body_findings)
+    # attack type heuristics
     attack_type = "General Phishing"
     combined_text_lower = ((subject or "") + "\n" + (body or "")).lower()
     if any(k in combined_text_lower for k in ["invoice", "payment", "wire transfer", "bank details"]):
@@ -86,13 +98,13 @@ def analyze(file_path):
         "Body Findings": body_findings or [],
         "URL Findings": url_findings or [],
         "Highlighted Body": highlighted_body or "",
+        "Auth Results": auth_summary or {},   # <-- NEW: show SPF, DKIM, DMARC results
     }
 
     return summary, details
 
 
 if __name__ == "__main__":
-    # quick local test (if you want)
     fp = "sample.eml"
     s, d = analyze(fp)
     print("SUMMARY:", s)