import pathlib


def get_domain(prog, fpath):
    """Return the domain from the input path.

    Will extract a domain from the full path input (of a X.509 cert file)
    as the Let's Encrypt directory the certificate is in, rather than, say,
    the domain(s) defined in the certificate itself. Anything other than a
    strict path format will cause a 'failure' to recognize a domain.

    For example,
        /etc/le/live/a.com/x.pem      -> 'a.com'  (success)
        /etc/le/archive/a.com/x.pem   -> 'a.com'  (success)
        /etc/le/live/x.pem            -> '-'      (failure)
        /etc/le/live/a.com/dir/x.pem  -> '-'      (failure)
        /etc/le/xyz/a.com/x.pem       -> '-'      (failure)
        /etc/x.pem                    -> '-'      (failure)

    Args:
        prog (State): program state.
        fpath (pathlib.Path): certificate path to process.

    Returns:
        str: either the domain in fpath or else '-'.
    """
    try:
        if str(fpath).startswith(str(prog.letsencrypt_directory)):
            parts = pathlib.Path(fpath).parts
            le = len(prog.letsencrypt_directory.parts)
            if len(parts) != le + 3:
                return '-'
            if parts[le] not in [ 'live', 'archive' ]:
                return '-'
            return parts[le+1]
    except IndexError:
        pass
    return '-'