Sublime MQL rules: sharepoint

type.inbound
and strings.ilike(subject.subject, "*shared*", "*invit*")
and strings.ilike(body.current_thread.text,
                  "*shared a file with you*",
                  "*shared with you*",
                  "*invited you to access a file*"
)
and not strings.ilike(body.current_thread.text, "invited you to edit")
and (
  any(filter(body.current_thread.links,
             .href_url.domain.domain not in $tenant_domains
             and (
               .href_url.domain.root_domain == "sharepoint.com"
               or .href_url.domain.root_domain == "1drv.ms"
               or (
                 .href_url.domain.root_domain == 'mimecastprotect.com'
                 and strings.icontains(.href_url.query_params,
                                       '.sharepoint.com'
                 )
               )
             )
             and .display_text != "Open"
      ),
      // check if the display_text exactly matches the sender's display name
      .display_text == sender.display_name
  )
)

type.inbound
// Microsoft sender
and sender.email.domain.root_domain == "microsoft.com"
// message ID contains the proper format for OTP messeges
and (
  (
    strings.istarts_with(headers.message_id, '<OneTimePasscode-')
    and strings.iends_with(headers.message_id, '@odspnotify>')
  )
  // deal with Google thinking the message ID is "broke"
  or (
    strings.icontains(headers.message_id, 'SMTPIN_ADDED_BROKEN')
    and any(headers.hops,
            any(.fields,
                .name == "X-Google-Original-Message-ID"
                and strings.istarts_with(.value, '<OneTimePasscode-')
                and strings.iends_with(.value, '@odspnotify>')
            )
    )
  )
)
// make sure the body has the phrase we need to get the document name
and strings.icontains(body.current_thread.text,
                      'For security purposes, you must enter the code below to verify your account to access'
)
// extract the filename and org name from the body and see if they are equal
and any(regex.iextract(body.current_thread.text,
                       'For security purposes, you must enter the code below to verify your account to access (?P<doc_name>.*)\. The code will only work for.*This email is generated through (?P<org_name>.*)''s use of Microsoft 365\.'
        ),
        .named_groups["doc_name"] =~ .named_groups["org_name"]
)