{
    "definition": {
        "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
        "contentVersion": "1.0.0.0",
        "triggers": {
            "HTTP_Request": {
                "type": "Request",
                "kind": "Http",
                "inputs": {
                    "schema": {
                        "type": "object",
                        "properties": {
                            "ips": {
                                "type": "array"
                            }
                        }
                    }
                }
            }
        },
        "actions": {
            "Initialize_AbuseIPResults": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "AbuseIPResults",
                            "type": "array",
                            "value": []
                        }
                    ]
                }
            },
            "Initialize_AbuseIPTableHTML": {
                "runAfter": {},
                "type": "InitializeVariable",
                "inputs": {
                    "variables": [
                        {
                            "name": "AbuseIPTableHTML",
                            "type": "string",
                            "value": ""
                        }
                    ]
                }
            },
            "Condition_ValidateKey": {
                "actions": {
                    "For_each_IP_AbuseIPDB": {
                        "foreach": "@triggerBody()?['ips']",
                        "actions": {
                            "Get_AbuseIP_Report": {
                                "type": "Http",
                                "inputs": {
                                    "uri": "@concat('https://api.abuseipdb.com/api/v2/check?ipAddress=', encodeUriComponent(item()?['Address']), '&maxAgeInDays=90&verbose')",
                                    "method": "GET",
                                    "headers": {
                                        "Key": "@parameters('AbuseIPDBApiKey')",
                                        "Accept": "application/json"
                                    }
                                },
                                "runtimeConfiguration": {
                                    "contentTransfer": {
                                        "transferMode": "Chunked"
                                    }
                                }
                            },
                            "Append_AbuseIP_Result": {
                                "runAfter": {
                                    "Get_AbuseIP_Report": [
                                        "Succeeded",
                                        "Failed",
                                        "TimedOut"
                                    ]
                                },
                                "type": "AppendToArrayVariable",
                                "inputs": {
                                    "name": "AbuseIPResults",
                                    "value": {
                                        "ipAddress": "@item()?['Address']",
                                        "abuseConfidenceScore": "@coalesce(body('Get_AbuseIP_Report')?['data']?['abuseConfidenceScore'], 0)",
                                        "totalReports": "@coalesce(body('Get_AbuseIP_Report')?['data']?['totalReports'], 0)",
                                        "numDistinctUsers": "@coalesce(body('Get_AbuseIP_Report')?['data']?['numDistinctUsers'], 0)",
                                        "countryCode": "@coalesce(body('Get_AbuseIP_Report')?['data']?['countryCode'], 'Unknown')",
                                        "usageType": "@coalesce(body('Get_AbuseIP_Report')?['data']?['usageType'], 'Unknown')",
                                        "isp": "@coalesce(body('Get_AbuseIP_Report')?['data']?['isp'], 'Unknown')",
                                        "domain": "@coalesce(body('Get_AbuseIP_Report')?['data']?['domain'], 'Unknown')",
                                        "isWhitelisted": "@string(coalesce(body('Get_AbuseIP_Report')?['data']?['isWhitelisted'], false))",
                                        "isPublic": "@string(coalesce(body('Get_AbuseIP_Report')?['data']?['isPublic'], true))",
                                        "lastReportedAt": "@coalesce(body('Get_AbuseIP_Report')?['data']?['lastReportedAt'], 'Never')",
                                        "abuseLink": "@concat('https://www.abuseipdb.com/check/', item()?['Address'])"
                                    }
                                }
                            },
                            "Append_AbuseIP_HTML_Row": {
                                "runAfter": {
                                    "Append_AbuseIP_Result": [
                                        "Succeeded"
                                    ]
                                },
                                "type": "AppendToStringVariable",
                                "inputs": {
                                    "name": "AbuseIPTableHTML",
                                    "value": "@concat('<tr style=\"background:#f9f9f9\"><td style=\"padding:6px 10px;border:1px solid #ddd;font-family:monospace\">', item()?['Address'], '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center;font-weight:bold;font-size:14px;color:', if(greaterOrEquals(coalesce(body('Get_AbuseIP_Report')?['data']?['abuseConfidenceScore'], 0), 75), '#c0392b', if(greaterOrEquals(coalesce(body('Get_AbuseIP_Report')?['data']?['abuseConfidenceScore'], 0), 25), '#e67e22', '#27ae60')), '\">', string(coalesce(body('Get_AbuseIP_Report')?['data']?['abuseConfidenceScore'], 0)), '%</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', string(coalesce(body('Get_AbuseIP_Report')?['data']?['totalReports'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', string(coalesce(body('Get_AbuseIP_Report')?['data']?['numDistinctUsers'], 0)), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\">', coalesce(body('Get_AbuseIP_Report')?['data']?['countryCode'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd\">', coalesce(body('Get_AbuseIP_Report')?['data']?['isp'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px\">', coalesce(body('Get_AbuseIP_Report')?['data']?['usageType'], 'Unknown'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px;color:', if(equals(string(coalesce(body('Get_AbuseIP_Report')?['data']?['isWhitelisted'], false)), 'true'), '#27ae60', '#888'), '\">', if(equals(string(coalesce(body('Get_AbuseIP_Report')?['data']?['isWhitelisted'], false)), 'true'), '✔ Yes', '✘ No'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;font-size:11px;color:#666\">', coalesce(body('Get_AbuseIP_Report')?['data']?['lastReportedAt'], 'Never'), '</td><td style=\"padding:6px 10px;border:1px solid #ddd;text-align:center\"><a href=\"', concat('https://www.abuseipdb.com/check/', item()?['Address']), '\" target=\"_blank\">View</a></td></tr>')"
                                }
                            }
                        },
                        "type": "Foreach",
                        "operationOptions": "Sequential"
                    },
                    "Response_Success": {
                        "runAfter": {
                            "For_each_IP_AbuseIPDB": [
                                "Succeeded",
                                "Failed",
                                "Skipped",
                                "TimedOut"
                            ]
                        },
                        "type": "Response",
                        "kind": "Http",
                        "inputs": {
                            "statusCode": 200,
                            "headers": {
                                "Content-Type": "application/json"
                            },
                            "body": {
                                "abuseIPTableHTML": "@variables('AbuseIPTableHTML')",
                                "results": "@variables('AbuseIPResults')"
                            }
                        }
                    }
                },
                "runAfter": {
                    "Initialize_AbuseIPResults": [
                        "Succeeded"
                    ],
                    "Initialize_AbuseIPTableHTML": [
                        "Succeeded"
                    ]
                },
                "else": {
                    "actions": {
                        "Response_Unauthorized": {
                            "type": "Response",
                            "kind": "Http",
                            "inputs": {
                                "statusCode": 401,
                                "body": {
                                    "error": "Unauthorized - invalid worker key"
                                }
                            }
                        }
                    }
                },
                "expression": {
                    "and": [
                        {
                            "equals": [
                                "@triggerOutputs()?['headers']?['x-worker-key']",
                                "@parameters('WorkerSharedKey')"
                            ]
                        }
                    ]
                },
                "type": "If"
            }
        },
        "outputs": {},
        "parameters": {
            "AbuseIPDBApiKey": {
                "defaultValue": "<ABUSEIPDB-API-KEY>",
                "type": "String"
            },
            "WorkerSharedKey": {
                "defaultValue": "<WORKER-SHARED-KEY>",
                "type": "String"
            },
            "$connections": {
                "type": "Object",
                "defaultValue": {}
            }
        }
    },
    "parameters": {
        "$connections": {
            "type": "Object",
            "value": {}
        }
    }
}