# Line 134 in parse_grants_in_headers()
else:
    # TODO: check validation here
    grantee = Grantee(
        Type=GranteeType.AmazonCustomerByEmail,
        EmailAddress=grantee_id,
    )

# Line 185 in validate_acl_acp()
elif grant_type == GranteeType.AmazonCustomerByEmail:
    # TODO: add validation here
    continue

import re
from typing import Optional
from localstack.aws.api.s3 import InvalidArgument

# RFC 5322 Official Standard Email Regex (simplified for performance)
EMAIL_REGEX = re.compile(
    r'^[a-zA-Z0-9.!#$%&\'*+\/=?^_`{|}~-]+@'
    r'[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?'
    r'(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$'
)

# AWS Email Length Limits
MIN_EMAIL_LENGTH = 3  # a@b
MAX_EMAIL_LENGTH = 254  # RFC 5321

def validate_email_address(email: str, argument_name: str = "emailAddress") -> None:
    """
    Validate email address for S3 ACL AmazonCustomerByEmail grantee.
    
    Follows AWS S3 validation rules and RFC 5322 standards.
    
    :param email: Email address to validate
    :param argument_name: Name of the argument (for error messages)
    :raises InvalidArgument: If email address is invalid
    """
    if not email:
        raise InvalidArgument(
            "Email address cannot be empty",
            ArgumentName=argument_name,
            ArgumentValue=email or "",
        )
    
    # Check length constraints
    if len(email) < MIN_EMAIL_LENGTH:
        raise InvalidArgument(
            f"Email address too short (minimum {MIN_EMAIL_LENGTH} characters)",
            ArgumentName=argument_name,
            ArgumentValue=email,
        )
    
    if len(email) > MAX_EMAIL_LENGTH:
        raise InvalidArgument(
            f"Email address too long (maximum {MAX_EMAIL_LENGTH} characters)",
            ArgumentName=argument_name,
            ArgumentValue=email[:50] + "...",  # Truncate for error message
        )
    
    # Validate email format
    if not EMAIL_REGEX.match(email):
        raise InvalidArgument(
            "Invalid email address format",
            ArgumentName=argument_name,
            ArgumentValue=email,
        )
    
    # Additional AWS-specific validation
    local_part, domain = email.rsplit('@', 1)
    
    # Local part (before @) validation
    if len(local_part) > 64:  # RFC 5321
        raise InvalidArgument(
            "Email local part too long (maximum 64 characters)",
            ArgumentName=argument_name,
            ArgumentValue=email,
        )
    
    # Domain validation
    if len(domain) > 253:  # RFC 1035
        raise InvalidArgument(
            "Email domain too long (maximum 253 characters)",
            ArgumentName=argument_name,
            ArgumentValue=email,
        )
    
    # Check for consecutive dots
    if '..' in email:
        raise InvalidArgument(
            "Invalid email address format (consecutive dots)",
            ArgumentName=argument_name,
            ArgumentValue=email,
        )

# Around line 133-139 in validation.py
else:  # emailAddress type
    validate_email_address(grantee_id, get_permission_header_name(permission))
    grantee = Grantee(
        Type=GranteeType.AmazonCustomerByEmail,
        EmailAddress=grantee_id,
    )

# Around line 184-186 in validation.py
elif grant_type == GranteeType.AmazonCustomerByEmail:
    email = grantee.get("EmailAddress", "")
    validate_email_address(email, "AmazonCustomerByEmail/EmailAddress")
    continue

# tests/aws/services/s3/test_s3_acl_email_validation.py

import pytest
from localstack.aws.api.s3 import InvalidArgument

class TestS3AclEmailValidation:
    
    def test_valid_email_formats(self, s3_client, s3_bucket):
        """Test that valid email formats are accepted."""
        valid_emails = [
            "[email protected]",
            "[email protected]",
            "[email protected]",
            "[email protected]",
            "[email protected]",
        ]
        
        for email in valid_emails:
            response = s3_client.put_bucket_acl(
                Bucket=s3_bucket,
                GrantRead=f'emailAddress="{email}"'
            )
            assert response["ResponseMetadata"]["HTTPStatusCode"] == 200
    
    def test_invalid_email_missing_at_symbol(self, s3_client, s3_bucket):
        """Test that email without @ symbol is rejected."""
        with pytest.raises(InvalidArgument) as exc:
            s3_client.put_bucket_acl(
                Bucket=s3_bucket,
                GrantRead='emailAddress="userexample.com"'
            )
        assert "Invalid email address" in str(exc.value)
    
    def test_invalid_email_too_long(self, s3_client, s3_bucket):
        """Test that email exceeding 254 characters is rejected."""
        long_email = "a" * 250 + "@example.com"
        with pytest.raises(InvalidArgument) as exc:
            s3_client.put_bucket_acl(
                Bucket=s3_bucket,
                GrantRead=f'emailAddress="{long_email}"'
            )
        assert "too long" in str(exc.value).lower()
    
    def test_invalid_email_special_characters(self, s3_client, s3_bucket):
        """Test that email with invalid special characters is rejected."""
        invalid_emails = [
            "user<>@example.com",
            "user[]@example.com",
            "user()@example.com",
            "user,@example.com",
        ]
        
        for email in invalid_emails:
            with pytest.raises(InvalidArgument):
                s3_client.put_bucket_acl(
                    Bucket=s3_bucket,
                    GrantRead=f'emailAddress="{email}"'
                )
    
    def test_invalid_email_consecutive_dots(self, s3_client, s3_bucket):
        """Test that email with consecutive dots is rejected."""
        with pytest.raises(InvalidArgument):
            s3_client.put_bucket_acl(
                Bucket=s3_bucket,
                GrantRead='emailAddress="[email protected]"'
            )
    
    def test_acl_policy_with_invalid_email(self, s3_client, s3_bucket, s3_put_object):
        """Test ACL policy in request body with invalid email."""
        with pytest.raises(InvalidArgument):
            s3_client.put_object_acl(
                Bucket=s3_bucket,
                Key="test-object",
                AccessControlPolicy={
                    "Owner": {
                        "ID": "75aa57f09aa0c8caeab4f8c24e99d10f8e7faeebf76c078efc7c6caea54ba06a"
                    },
                    "Grants": [
                        {
                            "Grantee": {
                                "Type": "AmazonCustomerByEmail",
                                "EmailAddress": "invalid-email"
                            },
                            "Permission": "READ"
                        }
                    ]
                }
            )
    
    @pytest.mark.aws_validated
    def test_parity_with_aws(self, s3_client, s3_bucket):
        """Test that error messages match AWS S3 exactly."""
        with pytest.raises(InvalidArgument) as exc:
            s3_client.put_bucket_acl(
                Bucket=s3_bucket,
                GrantRead='emailAddress="invalid"'
            )
        
        # Verify error structure matches AWS
        error = exc.value
        assert error.Code == "InvalidArgument"
        assert "emailAddress" in error.ArgumentName or "email" in error.ArgumentName.lower()