#!/usr/bin/env python3
"""Passive subdomain enumeration for authorized domains.

The script uses DNS resolution against a provided wordlist and does not crawl,
brute-force web apps, or bypass access controls.
"""

from __future__ import annotations

import argparse
import socket
from pathlib import Path


def resolve(name: str) -> list[str]:
    try:
        return sorted({info[4][0] for info in socket.getaddrinfo(name, None)})
    except socket.gaierror:
        return []


def main() -> int:
    parser = argparse.ArgumentParser(description="Resolve likely subdomains for an authorized domain.")
    parser.add_argument("domain")
    parser.add_argument("--wordlist", type=Path, required=True)
    args = parser.parse_args()
    for word in args.wordlist.read_text(encoding="utf-8").splitlines():
        label = word.strip().lower()
        if not label or label.startswith("#"):
            continue
        fqdn = f"{label}.{args.domain}".strip(".")
        addresses = resolve(fqdn)
        if addresses:
            print(f"{fqdn},{'|'.join(addresses)}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())