Get a weekly email of Drive files shared too widely

from datetime import datetime, timedelta, timezone
from google.oauth2.credentials import Credentials
from googleapiclient.discovery import build
from clickruntime import on_trigger, credentials, notify

DOMAIN = "northwind.example"

@on_trigger
def run(event):
    drive = build("drive", "v3", credentials=Credentials(credentials.connection("google", "work")), cache_discovery=False)
    since = (datetime.now(timezone.utc) - timedelta(days=7)).strftime("%Y-%m-%dT%H:%M:%S")
    files = drive.files().list(q=f"modifiedTime > '{since}' and trashed = false", pageSize=500,
                               fields="files(id,name,webViewLink)").execute().get("files", [])
    flagged = []
    for f in files:
        perms = drive.permissions().list(fileId=f["id"], fields="permissions(type,emailAddress)").execute().get("permissions", [])
        wide = [p["type"] if p["type"] == "anyone" else p.get("emailAddress", "") for p in perms
                if p["type"] == "anyone" or (p.get("emailAddress") and not p["emailAddress"].endswith("@" + DOMAIN))]
        if wide:
            flagged.append(f"{f['name']} - {', '.join(wide)}\n  {f['webViewLink']}")
    if flagged:
        notify.email_me(f"Drive sharing audit: {len(flagged)} files to review", "\n\n".join(flagged))
    return {"checked": len(files), "flagged": len(flagged)}