backlot 0.0.0__py3-none-any.whl

backlot/__init__.py

@@ -0,0 +1,5 @@
+"""Backlot — enterprise SaaS read APIs over your own corpus, with per-document ACLs."""
+
+from backlot.testing import MockServer, mock_server, serve_or_connect, url_from_argv
+
+__all__ = ["MockServer", "mock_server", "serve_or_connect", "url_from_argv"]

backlot/__main__.py

@@ -0,0 +1,10 @@
+"""``python -m backlot`` — the same CLI as the ``backlot`` console script.
+
+Worth having for the case where the script is not on PATH: a venv that has not been activated, or
+`pipx run`. It is also the spelling `python -m backlot.main` looked like it should be but never
+was — that module only defines the ASGI app, so running it imported everything and exited.
+"""
+
+from backlot.cli import main
+
+raise SystemExit(main())

backlot/acl.py

@@ -0,0 +1,89 @@
+"""Runtime ACL: resolve a caller token to an identity and compute what it may see.
+
+Principal ids are globally unique across types (org name, group slugs, user emails),
+so a document is visible to a caller iff any of the doc's ACL ``principal_id`` values
+is in the caller's principal set: ``{org} ∪ {their groups} ∪ {their own email}``.
+An admin/service token bypasses filtering entirely (``visible_ids`` -> ``None``).
+"""
+
+from __future__ import annotations
+
+import sqlite3
+from dataclasses import dataclass
+from pathlib import Path
+
+import yaml
+
+from backlot import store, synth
+
+
+@dataclass(frozen=True)
+class Caller:
+    email: str | None  # None for admin/service account
+    is_admin: bool
+
+
+class Acl:
+    def __init__(self, token_to_email: dict[str, str], admin_token: str, org_name: str):
+        self._tokens = token_to_email
+        self._admin_token = admin_token
+        self.org_name = org_name
+
+        # Derived S3 (SigV4) credentials: access-key-id -> (Caller, secret-access-key). Every
+        # bearer token (users + the admin/service token) gets a deterministic keypair via synth,
+        # so a signed S3 request resolves to the same identity a bearer token would.
+        self._access_keys: dict[str, tuple[Caller, str]] = {}
+        self._access_keys[synth.s3_access_key_id(admin_token)] = (
+            Caller(email=None, is_admin=True),
+            synth.s3_secret_access_key(admin_token),
+        )
+        for token, email in token_to_email.items():
+            self._access_keys[synth.s3_access_key_id(token)] = (
+                Caller(email=email, is_admin=False),
+                synth.s3_secret_access_key(token),
+            )
+
+    @property
+    def admin_token(self) -> str:
+        return self._admin_token
+
+    def email_to_token(self) -> dict[str, str]:
+        """Inverse of the token map (each user has exactly one token)."""
+        return {email: token for token, email in self._tokens.items()}
+
+    @classmethod
+    def load(cls, tokens_path: Path, admin_token: str, org_name: str) -> "Acl":
+        token_to_email: dict[str, str] = {}
+        if tokens_path.exists():
+            data = yaml.safe_load(tokens_path.read_text()) or {}
+            for entry in data.get("users", []):
+                if entry.get("token") and entry.get("email"):
+                    token_to_email[entry["token"]] = entry["email"]
+            # tokens.yaml may override the admin token and the org (BYO derives it from the corpus)
+            admin_token = data.get("admin_token", admin_token)
+            org_name = data.get("org", org_name)
+        return cls(token_to_email, admin_token, org_name)
+
+    def resolve(self, token: str | None) -> Caller | None:
+        """Return the Caller for a raw token, or None if the token is unknown."""
+        if not token:
+            return None
+        if token == self._admin_token:
+            return Caller(email=None, is_admin=True)
+        email = self._tokens.get(token)
+        if email is None:
+            return None
+        return Caller(email=email, is_admin=False)
+
+    def resolve_access_key(self, access_key: str | None) -> tuple[Caller, str] | None:
+        """Resolve a SigV4 access-key-id to ``(Caller, secret_access_key)``, or None if unknown."""
+        if not access_key:
+            return None
+        return self._access_keys.get(access_key)
+
+    def visible_ids(self, conn: sqlite3.Connection, caller: Caller) -> set[str] | None:
+        if caller.is_admin:
+            return None
+        ids = {self.org_name, caller.email}
+        ids.update(store.user_group_ids(conn, caller.email))
+        return ids

backlot/auth.py

@@ -0,0 +1,209 @@
+"""Auth helpers shared by the vendor routers.
+
+Each vendor carries credentials differently (Slack bearer/query token, Google/GitHub
+bearer, Atlassian Basic email:api_token, Linear a scheme-less API key). These helpers
+extract the raw token, resolve it to a :class:`~backlot.acl.Caller` via the app's ACL, and
+compute the caller's visible principal set. Error *shaping* (Slack's ``ok:false`` vs a
+real 401) stays in the routers.
+"""
+
+from __future__ import annotations
+
+import base64
+import hmac
+import sqlite3
+from datetime import datetime, timezone
+
+from fastapi import HTTPException, Request
+
+from backlot import sigv4
+from backlot.acl import Acl, Caller
+
+
+def conn(request: Request) -> sqlite3.Connection:
+    return request.app.state.conn
+
+
+def acl(request: Request) -> Acl:
+    return request.app.state.acl
+
+
+def _authorization(request: Request) -> str | None:
+    return request.headers.get("authorization")
+
+
+def bearer_token(request: Request) -> str | None:
+    """Parse ``Authorization: Bearer <t>`` or GitHub's legacy ``token <t>``."""
+    hdr = _authorization(request)
+    if not hdr:
+        return None
+    parts = hdr.split(None, 1)
+    if len(parts) == 2 and parts[0].lower() in ("bearer", "token"):
+        return parts[1].strip()
+    return None
+
+
+def api_key_token(request: Request) -> str | None:
+    """Parse ``Authorization: <key>`` — with or without a ``Bearer`` prefix.
+
+    Linear's GraphQL API carries a personal API key as the bare header value
+    (``Authorization: lin_api_...``, no scheme) and an OAuth access token as
+    ``Bearer <token>``, accepting both on the same header, so this accepts both too.
+    Anything that is not a ``Bearer`` prefix is returned verbatim rather than having its
+    first word stripped: to the real API the whole header value *is* the key, so a stray
+    scheme fails to resolve instead of being quietly discarded.
+    """
+    hdr = (_authorization(request) or "").strip()
+    if not hdr:
+        return None
+    parts = hdr.split(None, 1)
+    if parts[0].lower() == "bearer":
+        return parts[1].strip() or None if len(parts) == 2 else None
+    return hdr
+
+
+def basic_password(request: Request) -> tuple[str | None, str | None]:
+    """Parse ``Authorization: Basic base64(user:pass)`` -> (user, pass)."""
+    hdr = _authorization(request)
+    if not hdr:
+        return None, None
+    parts = hdr.split(None, 1)
+    if len(parts) == 2 and parts[0].lower() == "basic":
+        try:
+            decoded = base64.b64decode(parts[1]).decode("utf-8", "replace")
+            user, _, pw = decoded.partition(":")
+            return user, pw
+        except (ValueError, UnicodeDecodeError):
+            return None, None
+    return None, None
+
+
+def slack_token(request: Request) -> str | None:
+    """Slack accepts the token as a bearer header, query param, or form field. The official
+    slack-go SDK (and Slack's own clients) post it as the ``token`` form field, so fall back to
+    the form stashed on ``request.state._form`` by the slack-form middleware."""
+    form = getattr(request.state, "_form", None)
+    form_field = form.get("token") if form else None
+    return bearer_token(request) or request.query_params.get("token") or form_field
+
+
+def resolve_bearer(request: Request) -> Caller | None:
+    return acl(request).resolve(bearer_token(request))
+
+
+def require_bearer(request: Request, detail: str) -> Caller:
+    """Resolve a bearer token or raise 401 with the VENDOR's own message.
+
+    ``detail`` is a parameter rather than something this function picks, because the message is
+    part of the emulated surface: GitHub says "Bad credentials", Google "Invalid Credentials",
+    Atlassian "Unauthorized", and a client that string-matches its vendor's error has to keep
+    matching. Each router states its own once (see ``tests/test_endpoints.py``).
+    """
+    caller = resolve_bearer(request)
+    if caller is None:
+        raise HTTPException(status_code=401, detail=detail)
+    return caller
+
+
+def require_basic_or_bearer(request: Request, detail: str) -> Caller:
+    """Same, for Atlassian: it carries Basic ``email:api_token`` and also accepts a bearer OAuth
+    token, so both are tried before refusing."""
+    caller = resolve_basic(request) or resolve_bearer(request)
+    if caller is None:
+        raise HTTPException(status_code=401, detail=detail)
+    return caller
+
+
+def resolve_api_key(request: Request) -> Caller | None:
+    return acl(request).resolve(api_key_token(request))
+
+
+def resolve_basic(request: Request) -> Caller | None:
+    """Atlassian: resolve by the api_token (password); fall back to the username email."""
+    a = acl(request)
+    user, pw = basic_password(request)
+    caller = a.resolve(pw)
+    if caller is not None:
+        return caller
+    # allow username=email as an identity shortcut (mock convenience)
+    if user and "@" in user:
+        from backlot import store
+
+        if store.get_user(conn(request), user):
+            return Caller(email=user, is_admin=False)
+    return None
+
+
+def visible_ids(request: Request, caller: Caller) -> set[str] | None:
+    return acl(request).visible_ids(conn(request), caller)
+
+
+def resolve_sigv4(request: Request) -> tuple[Caller | None, str | None]:
+    """Verify an S3 SigV4 request (header or presigned-query auth).
+
+    Returns ``(caller, None)`` on a valid signature, else ``(None, <S3 error code>)`` — one of
+    ``MissingSecurityHeader`` / ``AuthorizationHeaderMalformed`` / ``InvalidAccessKeyId`` /
+    ``RequestTimeTooSkewed`` / ``AccessDenied`` / ``SignatureDoesNotMatch``. Real S3's check
+    order is parse -> resolve access key -> time validity -> signature match, so a bogus access
+    key is reported before any time error, and a stale-but-correctly-signed request is reported
+    as a time error rather than a signature mismatch. The region is taken from the client's own
+    credential scope, so any region validates. The canonical URI is the raw wire path (S3 signs
+    it verbatim)."""
+    hdrs = {k.lower(): v for k, v in request.headers.items()}
+    qs = request.query_params
+    authz = hdrs.get("authorization", "")
+    presigned = False
+    if authz.startswith(sigv4.ALGORITHM):
+        parsed = sigv4.parse_authorization(authz)
+        if not parsed:
+            return None, "AuthorizationHeaderMalformed"
+        cred = sigv4.split_credential(parsed["credential"])
+        signed_headers, signature = parsed["signed_headers"], parsed["signature"]
+        amz_date = hdrs.get("x-amz-date", "")
+        payload_hash = hdrs.get("x-amz-content-sha256", "UNSIGNED-PAYLOAD")
+    elif qs.get("X-Amz-Signature"):
+        presigned = True
+        cred = sigv4.split_credential(qs.get("X-Amz-Credential", ""))
+        signed_headers = qs.get("X-Amz-SignedHeaders", "host")
+        signature = qs["X-Amz-Signature"]
+        amz_date = qs.get("X-Amz-Date", "")
+        payload_hash = "UNSIGNED-PAYLOAD"
+    else:
+        return None, "MissingSecurityHeader"
+    if not cred:
+        return None, "AuthorizationHeaderMalformed"
+    access_key, date_stamp, region = cred
+    resolved = acl(request).resolve_access_key(access_key)
+    if resolved is None:
+        return None, "InvalidAccessKeyId"
+    caller, secret = resolved
+    request_time = sigv4.parse_amz_date(amz_date)
+    if request_time is None:
+        return None, "AuthorizationHeaderMalformed"
+    now = datetime.now(timezone.utc)
+    if presigned:
+        try:
+            expires_in = int(qs.get("X-Amz-Expires", ""))
+        except ValueError:
+            return None, "AuthorizationHeaderMalformed"
+        if (now - request_time).total_seconds() > expires_in:
+            return None, "AccessDenied"
+    elif sigv4.is_skewed(request_time, now):
+        return None, "RequestTimeTooSkewed"
+    raw = request.scope.get("raw_path")
+    path = raw.decode("ascii") if raw else request.url.path
+    expected = sigv4.expected_signature(
+        secret,
+        request.method,
+        path,
+        request.url.query,
+        hdrs,
+        signed_headers,
+        payload_hash,
+        amz_date,
+        date_stamp,
+        region,
+    )
+    if not hmac.compare_digest(expected, signature):
+        return None, "SignatureDoesNotMatch"
+    return caller, None

backlot/cli.py

@@ -0,0 +1,164 @@
+"""The ``backlot`` console script — one entry point for serving and for building ``data/``.
+
+Two commands, each a thin front end over code that already existed:
+
+    backlot serve                       # uvicorn backlot.main:app, with uvicorn's own defaults
+    backlot import <corpus.jsonl>       # backlot.importer.byo   (--type byo, the default)
+    backlot import --type erb           # backlot.importer.erb
+
+``import`` dispatches on ``--type`` and then hands the REMAINING argv to that importer's own
+``main``, so every flag, default and message stays defined in exactly one place — the importer.
+Nothing is re-declared here, which is why ``backlot import --dry-run`` and
+``python -m backlot.importer.byo --dry-run`` cannot drift apart.
+
+``python -m backlot.importer.{byo,erb}`` still work unchanged; this is a shorter spelling of them,
+not a replacement.
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from importlib.metadata import PackageNotFoundError, version
+
+# Imported lazily inside each command, not here: `serve` must not pay for the importers' module
+# import (backlot.importer.erb alone is 2,400 lines), and `import` must not pull in uvicorn.
+
+# --type value -> the module implementing it. `erb` is accepted beside the full bench name because
+# that is what the module, the tests and every existing doc call it.
+IMPORTER_TYPES = ("byo", "enterpriserag-bench", "erb")
+
+
+def _version() -> str:
+    try:
+        return version("backlot")
+    except PackageNotFoundError:  # a source tree that was never installed
+        return "unknown"
+
+
+def _type_arg(ap: argparse.ArgumentParser) -> None:
+    """Declare ``--type`` on ``ap``. Called for the dispatch parser and again for the parser that
+    renders ``--help``, so the flag is defined once and both spellings cannot disagree."""
+    ap.add_argument(
+        "--type",
+        "-t",
+        dest="corpus_type",
+        default="byo",
+        choices=IMPORTER_TYPES,
+        metavar="{byo,enterpriserag-bench}",
+        help="what kind of corpus to import: `byo` (default) reads a BYO-JSONL corpus, a "
+        "`.jsonl.gz`, or a sharded artifact directory; `enterpriserag-bench` (alias `erb`) "
+        "downloads and imports EnterpriseRAG-Bench. The remaining options are that "
+        "importer's own — see `backlot import --type <t> --help`",
+    )
+
+
+def _serve(argv: list[str]) -> int:
+    """Run the ASGI app under uvicorn.
+
+    Every default here is uvicorn's own (127.0.0.1:8000, proxy headers on), so this is a shorter
+    spelling of `python -m uvicorn backlot.main:app` and not a second set of behaviour to keep in
+    step with it. The app is passed as an import STRING because that is what `--reload` requires.
+    """
+    ap = argparse.ArgumentParser(
+        prog="backlot serve",
+        description="Serve the mock APIs over the corpus in the data dir (BACKLOT_DATA_DIR). "
+        "The corpus has to exist — build one with `backlot import` first.",
+    )
+    ap.add_argument("--host", default="127.0.0.1", help="bind address (default: 127.0.0.1)")
+    ap.add_argument("--port", type=int, default=8000, help="bind port (default: 8000)")
+    ap.add_argument("--reload", action="store_true", help="restart on source changes (development)")
+    ap.add_argument(
+        "--log-level",
+        default=None,
+        choices=("critical", "error", "warning", "info", "debug", "trace"),
+        help="uvicorn log level (default: info)",
+    )
+    # Behind a TLS-terminating proxy/ALB these two make the app honour X-Forwarded-Proto/Host and
+    # emit https self-URLs, which clients that follow returned URLs (PyGithub) need. On by default
+    # in uvicorn, so the flag that carries weight is the negative one.
+    ap.add_argument(
+        "--no-proxy-headers",
+        dest="proxy_headers",
+        action="store_false",
+        help="ignore X-Forwarded-* headers (uvicorn honours them by default)",
+    )
+    ap.add_argument(
+        "--forwarded-allow-ips",
+        default=None,
+        metavar="IPS",
+        help="comma-separated proxy IPs to trust X-Forwarded-* from, or * for any "
+        "(default: 127.0.0.1)",
+    )
+    args = ap.parse_args(argv)
+
+    import uvicorn
+
+    uvicorn.run(
+        "backlot.main:app",
+        host=args.host,
+        port=args.port,
+        reload=args.reload,
+        log_level=args.log_level,
+        proxy_headers=args.proxy_headers,
+        forwarded_allow_ips=args.forwarded_allow_ips,
+    )
+    return 0
+
+
+def _import(argv: list[str]) -> int:
+    """Dispatch to one importer's ``main`` with the rest of the argv untouched."""
+    # add_help=False and parse_known_args: everything that is not --type belongs to the importer,
+    # including -h, which is answered below against the CHOSEN importer's parser so one help
+    # screen shows both --type and that importer's own flags.
+    pre = argparse.ArgumentParser(prog="backlot import", add_help=False)
+    _type_arg(pre)
+    args, rest = pre.parse_known_args(argv)
+
+    if args.corpus_type == "byo":
+        from backlot.importer import byo as importer
+    else:
+        from backlot.importer import erb as importer
+
+    if any(a in ("-h", "--help") for a in rest):
+        ap = importer.build_parser(prog="backlot import")
+        _type_arg(ap)
+        ap.print_help()
+        return 0
+    return importer.main(rest, prog="backlot import")
+
+
+COMMANDS = {"serve": _serve, "import": _import}
+
+
+def _top_parser() -> argparse.ArgumentParser:
+    """The parser for ``backlot`` itself — help, --version, and the command list.
+
+    The subcommands are declared for the help listing only; `main` dispatches on argv before this
+    parser ever runs, so a command's own flags (`backlot serve --reload`) are never parsed here.
+    """
+    ap = argparse.ArgumentParser(
+        prog="backlot",
+        description="Enterprise SaaS read APIs (Slack, Gmail, Drive, GitHub, Jira, Confluence, "
+        "Notion, S3, HubSpot, Linear, Fireflies) over your own corpus, with per-document ACLs.",
+        epilog="Run `backlot <command> --help` for a command's own options.",
+    )
+    ap.add_argument("--version", action="version", version=f"backlot {_version()}")
+    sub = ap.add_subparsers(dest="command", required=True, metavar="<command>")
+    sub.add_parser("serve", help="run the mock API server")
+    sub.add_parser("import", help="build the data dir from a corpus (--type byo | erb)")
+    return ap
+
+
+def main(argv: list[str] | None = None) -> int:
+    argv = list(sys.argv[1:] if argv is None else argv)
+    if argv and argv[0] in COMMANDS:
+        return COMMANDS[argv[0]](argv[1:])
+    # No command, an unknown one, or a global flag: let argparse answer it. `--help`/`--version`
+    # exit 0 from inside parse_args; anything else is a usage error, which exits 2.
+    _top_parser().parse_args(argv)
+    return 2  # unreachable: parse_args above always exits when no command was dispatched
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

backlot/config.py

@@ -0,0 +1,130 @@
+"""Runtime configuration for the mock server.
+
+All settings are overridable via environment variables (prefix ``BACKLOT_``) so the
+server and the offline build scripts read the same values.
+
+Corpus-specific knobs do NOT belong here — this is what every layer reads, and a setting only one
+importer uses would put that importer's dataset in front of everyone. A downloading importer keeps
+its own settings beside itself (see ``backlot.importer.erb.BenchSettings``), on the same env prefix.
+"""
+
+from __future__ import annotations
+
+from functools import lru_cache
+from pathlib import Path
+
+from pydantic import model_validator
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(env_prefix="BACKLOT_", env_file=".env", extra="ignore")
+
+    @model_validator(mode="before")
+    @classmethod
+    def _resolve_path_defaults(cls, values):
+        """Fill the path defaults from the CURRENT working directory.
+
+        Not plain field defaults: those are evaluated at class-definition time, so the path would
+        be frozen to the cwd at import. Not `Path(__file__).parent.parent` either — installed from
+        a wheel that is `site-packages`, and a default of `site-packages/data` is never what
+        anyone means. `BACKLOT_DATA_DIR` and an explicit kwarg are already present here, so
+        `setdefault` leaves them alone.
+        """
+        if isinstance(values, dict):
+            values.setdefault("data_dir", Path("data").resolve())
+        return values
+
+    # --- paths --- (default supplied by _resolve_path_defaults above)
+    data_dir: Path = Path("data")
+
+    # --- identity / org ---
+    # The org name/domain are derived at import time from the dominant email domain in whatever
+    # was loaded, via infer_org() below. These are only the last-resort fallback for data that
+    # carries no emails; BACKLOT_ORG_NAME / BACKLOT_ORG_DOMAIN override the derivation entirely.
+    org_name: str = "example"
+    org_domain: str = "example.com"
+    # No `atlassian_site` here on purpose: the host in a Jira/Confluence `self` URL comes from the
+    # REQUEST's own Host header, falling back to `<org_name>.atlassian.net`. Both rungs are already
+    # customizable — per call by the header every SDK sends, and globally by BACKLOT_ORG_NAME — so a
+    # third setting could only disagree with the caller about where the caller just reached us.
+    # See backlot.routers.atlassian._site.
+
+    # --- auth ---
+    # A caller presenting this token bypasses ACL filtering (full crawl / service account).
+    admin_token: str = "admin-service-token"
+    # If false, any well-formed token is accepted as admin (ACL still exposed, not enforced).
+    enforce_acl: bool = True
+    # Expose the /_mock/users directory (per-user tokens) so callers can test per-user ACL.
+    # It hands out tokens in the clear — fine for a local test mock; set false to disable.
+    expose_tokens: bool = True
+
+    # --- pagination defaults ---
+    default_page_size: int = 100
+    max_page_size: int = 1000
+
+    # --- sqlite read tuning (serving connection; see store.connect_ro) ---
+    # Sized for the corpus most people serve — their own, or the bundled one, which is under a
+    # megabyte. A multi-GB corpus wants all three raised, and a deployment that serves one says so
+    # explicitly (see the `environment:` block in docker-compose.yml) rather than every laptop
+    # inheriting numbers picked for the biggest DB anyone has run here.
+    #
+    # Memory-map the DB so reads come from the OS page cache instead of a syscall each — the main
+    # lever against the "slow first request after idle" cold-read hit. SQLite maps
+    # min(this, db size), so a small DB costs only its own size in address space; raise it to at
+    # or above the DB size to map a big one fully.
+    sqlite_mmap_mb: int = 256
+    # SQLite's own page cache, per connection. 64 MiB is a real improvement on SQLite's ~2 MiB
+    # default without reserving a quarter gigabyte on a machine serving a 700 KB corpus.
+    sqlite_cache_mb: int = 64
+    # Wait (ms) for a lock instead of erroring, so a read rides through an out-of-band writer's
+    # commit (an in-place `build_fts`) rather than 500ing. Long enough to cover a commit, short
+    # enough that a genuinely stuck writer surfaces instead of hanging the client.
+    sqlite_busy_ms: int = 5000
+
+    @property
+    def db_path(self) -> Path:
+        return self.data_dir / "mock.sqlite"
+
+    @property
+    def tokens_path(self) -> Path:
+        return self.data_dir / "tokens.yaml"
+
+    @property
+    def credentials_path(self) -> Path:
+        return self.data_dir / "credentials.yaml"
+
+
+@lru_cache
+def get_settings() -> Settings:
+    return Settings()
+
+
+def infer_org(emails, settings: Settings) -> tuple[str, str]:
+    """Derive ``(org_name, org_domain)`` from the dominant email domain in ``emails`` — so a
+    ``@acme.com`` dataset serves as org ``acme`` rather than a hardcoded brand. An explicit
+    ``BACKLOT_ORG_NAME`` / ``BACKLOT_ORG_DOMAIN`` env var wins; data with no emails keeps the
+    settings fallback. ``org_name`` is the domain's first label (``acme.com`` -> ``acme``)."""
+    import os
+    from collections import Counter
+
+    name_set = "BACKLOT_ORG_NAME" in os.environ
+    domain_set = "BACKLOT_ORG_DOMAIN" in os.environ
+    counts: Counter = Counter()
+    for e in emails:
+        if isinstance(e, str) and "@" in e:
+            counts[e.split("@", 1)[1].lower()] += 1
+
+    if domain_set:
+        domain = settings.org_domain
+    elif counts:
+        domain = counts.most_common(1)[0][0]
+    else:
+        domain = settings.org_domain
+    if name_set:
+        name = settings.org_name
+    elif domain_set or counts:
+        name = domain.split(".")[0]
+    else:
+        name = settings.org_name
+    return name, domain