Require two approvals for Airtable change requests

from google.oauth2.credentials import Credentials
from googleapiclient.discovery import build
import base64, hashlib, hmac
from email.mime.text import MIMEText
from clickruntime import on_trigger, on_event, credentials, http, report_fetched

BASE = "https://api.airtable.com/v0/your-base-id"
APPROVERS = ["finance.lead@example.com", "ops.lead@example.com"]
LINK = "https://your-trigger-link"

def send(gmail, to, subject, text, thread=None):
    msg = MIMEText(text)
    msg["to"], msg["subject"] = to, subject
    body = {"raw": base64.urlsafe_b64encode(msg.as_bytes()).decode()}
    if thread:
        body["threadId"] = thread
    gmail.users().messages().send(userId="me", body=body).execute()

def sig(rid, who, vote):
    return hmac.new(credentials.secret("APPROVAL_SIGNING_KEY").encode(), f"{rid}|{who}|{vote}".encode(), hashlib.sha256).hexdigest()

@on_trigger
def run(event):
    h = {"Authorization": f"Bearer {credentials.secret('AIRTABLE_API_KEY')}"}
    reqs = http.get(f"{BASE}/Requests", headers=h, params={"filterByFormula": "{Status}='New'"}).json()["records"]
    report_fetched(len(reqs))
    if not reqs:
        return {"new": 0}
    gmail = build("gmail", "v1", credentials=Credentials(credentials.connection("google", "work")), cache_discovery=False)
    for r in reqs:
        for who in APPROVERS:
            links = "\n".join(f"{v}: {LINK}?id={r['id']}&who={who}&vote={v}&sig={sig(r['id'], who, v)}" for v in ("approve", "reject"))
            send(gmail, who, f"Approve change: {r['fields']['Summary']}", links)
        http.patch(f"{BASE}/Requests/{r['id']}", headers=h, json={"fields": {"Status": "Pending"}})
    return {"sent": len(reqs)}