Change History Sentinel: know within hours who changed what in the account

/**
 * Change History Sentinel
 * The SEM Dispatch Vault, semdispatch.com/vault
 *
 * Reads the change_event log, groups edits by user within a rolling window,
 * and alerts on a burst of activity or a campaign/budget removal.
 * Read-only: this script never reverts or modifies any change.
 */

var CONFIG = {
  // How many hours back to group and count edits.
  LOOKBACK_HOURS: 6,

  // Alert when one user makes more edits than this inside the window.
  BULK_THRESHOLD: 20,

  // Optional. An email address for alerts, e.g. "you@example.com".
  // Leave empty to log only.
  EMAIL: "",

  // Optional. A Google Sheet URL for a running log of flagged activity.
  SHEET_URL: ""
};

function main() {
  var account = AdsApp.currentAccount();
  var tz = account.getTimeZone();
  var now = new Date();
  var cutoff = new Date(now.getTime() - CONFIG.LOOKBACK_HOURS * 60 * 60 * 1000);
  var cutoffStr = Utilities.formatDate(cutoff, tz, "yyyy-MM-dd HH:mm:ss");

  var query =
    "SELECT change_event.change_date_time, " +
    "change_event.user_email, " +
    "change_event.client_type, " +
    "change_event.change_resource_type, " +
    "change_event.resource_change_operation, " +
    "change_event.changed_fields, " +
    "change_event.campaign, " +
    "change_event.ad_group " +
    "FROM change_event " +
    "WHERE change_event.change_date_time DURING LAST_14_DAYS " +
    "ORDER BY change_event.change_date_time DESC " +
    "LIMIT 10000";

  var rows = AdsApp.report(query).rows();

  var byUser = {};
  var removalHits = [];
  var watchedResourceTypes = { CAMPAIGN: true, CAMPAIGN_BUDGET: true };

  while (rows.hasNext()) {
    var row = rows.next();
    var changedAt = row["change_event.change_date_time"];

    // Only the query's own 14-day pull is fixed; the alert window is this
    // in-script filter, so LOOKBACK_HOURS is the number that actually
    // controls sensitivity.
    if (changedAt < cutoffStr) continue;

    var user = row["change_event.user_email"] || "unknown";
    var resourceType = row["change_event.change_resource_type"];
    var operation = row["change_event.resource_change_operation"];

    if (!byUser[user]) {
      byUser[user] = { user: user, count: 0, removals: [] };
    }
    byUser[user].count += 1;

    if (operation === "REMOVE" && watchedResourceTypes[resourceType]) {
      var hit = {
        user: user,
        resourceType: resourceType,
        campaign: row["change_event.campaign"],
        changedAt: changedAt
      };
      byUser[user].removals.push(hit);
      removalHits.push(hit);
    }
  }

  var flaggedUsers = [];
  for (var u in byUser) {
    var record = byUser[u];
    if (record.count > CONFIG.BULK_THRESHOLD || record.removals.length > 0) {
      flaggedUsers.push(record);
    }
  }
  flaggedUsers.sort(function (a, b) { return b.count - a.count; });

  Logger.log("Change History Sentinel, " + account.getName());
  Logger.log("Window: last " + CONFIG.LOOKBACK_HOURS + " hours, cutoff " + cutoffStr);
  flaggedUsers.forEach(function (record) {
    Logger.log(
      record.user + ": " + record.count + " edits, " + record.removals.length +
      " campaign/budget removal(s)"
    );
  });

  if (CONFIG.SHEET_URL && CONFIG.SHEET_URL.indexOf("http") === 0) {
    var sheet = SpreadsheetApp.openByUrl(CONFIG.SHEET_URL).getSheets()[0];
    sheet.appendRow([Utilities.formatDate(now, tz, "yyyy-MM-dd HH:mm")]);
    flaggedUsers.forEach(function (record) {
      sheet.appendRow(["", record.user, record.count, record.removals.length]);
    });
  }

  if (CONFIG.EMAIL !== "" && flaggedUsers.length > 0) {
    var lines = [
      "Change History Sentinel, " + account.getName(),
      "Window: last " + CONFIG.LOOKBACK_HOURS + " hours",
      ""
    ];
    flaggedUsers.forEach(function (record) {
      lines.push(record.user + ": " + record.count + " edits");
      record.removals.forEach(function (hit) {
        lines.push("  removed " + hit.resourceType + " on campaign " + hit.campaign + " at " + hit.changedAt);
      });
    });
    MailApp.sendEmail(
      CONFIG.EMAIL,
      "[Change alert] " + account.getName() + ": " + flaggedUsers.length + " user(s) flagged",
      lines.join("\n")
    );
  }
}