Check links in reported emails for phishing

GRAPH = "https://graph.microsoft.com/v1.0"
import re
from clickruntime import on_trigger, credentials, http, state, notify, report_fetched

@on_trigger
def run(event):
    h = {"Authorization": f"Bearer {credentials.connection('microsoft', 'work')}"}
    seen = state.get("seen") or []
    msgs = http.get(f"{GRAPH}/me/mailFolders/Phishing/messages", headers=h,
                    params={"$select": "id,subject,from,body", "$top": 25}).json()["value"]
    new = [m for m in msgs if m["id"] not in seen]
    report_fetched(len(new))
    if not new:
        return {"summary": "Nothing new"}
    key = credentials.secret("SAFE_BROWSING_KEY")
    for m in new:
        urls = sorted(set(re.findall(r"https?://[^\s\"'<>]+", m["body"]["content"])))[:20]
        body = {"threatInfo": {"threatTypes": ["MALWARE", "SOCIAL_ENGINEERING"], "platformTypes": ["ANY_PLATFORM"],
                "threatEntryTypes": ["URL"], "threatEntries": [{"url": u} for u in urls]}}
        hits = http.post(f"https://safebrowsing.googleapis.com/v4/threatMatches:find?key={key}", json=body).json().get("matches", [])
        if hits:
            bad = ", ".join(sorted({x["threat"]["url"] for x in hits}))
            notify.slack(f":warning: {m['subject']} from {m['from']['emailAddress']['address']}: {bad}", channel="#security")
    state.set("seen", (seen + [m["id"] for m in new])[-500:])
    return {"checked": len(new)}