fhirsmith 0.17.0 → 0.18.0

package/server.js

@@ -18,6 +18,8 @@ const escape = require('escape-html');
 const { resolveWithin } = require('./library/path-safety');
 const { readCgroupMemoryLimit } = require('./library/cgroup-memory');
 const { NpmAudit } = require('./library/npm-audit');
+const Mailer = require('./library/mailer');
+const DailyReport = require('./library/daily-report');
 
 // Load configuration BEFORE logger
 let config;
@@ -51,7 +53,7 @@ serverLog.info(`Data directory: ${folders.dataDir()}`);
 serverLog.info(`========================================`);
 
 const activeModules = config.modules ? Object.keys(config.modules)
-    .filter(mod => config.modules[mod].enabled)
+    .filter(mod => config.modules[mod]?.enabled)
     .join(', ') : [];
 serverLog.info(`Loaded Configuration. Active modules = ${activeModules}`);
 
@@ -66,6 +68,7 @@ const TokenModule = require('./token/token.js');
 const NpmProjectorModule = require('./npmprojector/npmprojector.js');
 const TXModule = require('./tx/tx.js');
 const TestingModule = require('./testing/testing.js');
+const IpsModule = require('./ips/ips.js');
 
 const htmlServer = require('./library/html-server');
 const ServerStats = require("./stats");
@@ -90,9 +93,15 @@ app.set('trust proxy', config.server.trustProxy ?? DEFAULT_TRUST_PROXY);
 const PORT = process.env.PORT || config.server.port || 3000;
 
 // Middleware
-app.use(express.raw({ type: 'application/fhir+json', limit: '50mb' }));
-app.use(express.raw({ type: 'application/fhir+xml', limit: '50mb' }));
-app.use(express.json({ limit: '50mb' }));
+// The body parsers, for every module but those that read their own bodies with their own
+// limits and checks (the ips module: a document is read only once its submitter's token has
+// been checked, and no bigger than the module's maxSize)
+const OWN_BODIES = ['/ips'];
+const ownsBody = (req) => OWN_BODIES.some(p => req.path === p || req.path.startsWith(p + '/'));
+const unlessOwnBody = (parser) => (req, res, next) => (ownsBody(req) ? next() : parser(req, res, next));
+app.use(unlessOwnBody(express.raw({ type: 'application/fhir+json', limit: '50mb' })));
+app.use(unlessOwnBody(express.raw({ type: 'application/fhir+xml', limit: '50mb' })));
+app.use(unlessOwnBody(express.json({ limit: '50mb' })));
 app.use((req, res, next) => {
   const requestId = req.headers['x-request-id'];
   if (requestId) {
@@ -113,6 +122,8 @@ const modules = {};
 let stats = null;
 // periodic npm advisory check of the installed packages - see library/npm-audit.js
 let npmAudit = null;
+// the daily report, emailed at midnight when "email" and "dailyReport.to" are configured - see library/daily-report.js
+let dailyReport = null;
 
 // Initialize modules based on configuration
 async function initializeModules() {
@@ -247,6 +258,22 @@ async function initializeModules() {
       throw error;
     }
   }
+  if (config.modules?.ips?.enabled) {
+    try {
+      serverLog.info('Initializing module: ips...');
+      // sharing through this server's own shl module: its password, unless the ips
+      // configuration names an SHL server of its own
+      if (config.modules.ips.shl && !config.modules.ips.shl.password && config.modules.shl?.password) {
+        config.modules.ips.shl = { server: '/shl', ...config.modules.ips.shl, password: config.modules.shl.password };
+      }
+      modules.ips = new IpsModule(stats.forModule('ips'));
+      await modules.ips.initialize(config.modules.ips, app);
+      app.use('/ips', modules.ips.router);
+    } catch (error) {
+      serverLog.error('Failed to initialize ips module:', error);
+      throw error;
+    }
+  }
 
   // Initialize TX module
   // Note: TX module registers its own endpoints directly on the app
@@ -255,7 +282,7 @@ async function initializeModules() {
     try {
       serverLog.info('Initializing module: tx...');
       modules.tx = new TXModule(stats.forModule('tx'));
-      await modules.tx.initialize(config.modules.tx, app);
+      await modules.tx.initialize(config.modules.tx, app, { hostName: config.hostName });
     } catch (error) {
       serverLog.error('Failed to initialize TX module:', error);
       throw error;
@@ -317,52 +344,52 @@ async function buildRootPageContent() {
   content += '<ul class="list-group">';
 
   // Check which modules are enabled and add them to the list
-  if (config.modules.packages.enabled) {
+  if (config.modules?.packages?.enabled) {
     content += '<li class="list-group-item">';
     content += '<a href="/packages" class="text-decoration-none">Package Server</a>: Browse and download FHIR Implementation Guide packages (<a href="/packages/openapi">API</a>)';
     content += '</li>';
   }
 
-  if (config.modules.xig.enabled) {
+  if (config.modules?.xig?.enabled) {
     content += '<li class="list-group-item">';
     content += '<a href="/xig" class="text-decoration-none">FHIR IG Statistics</a>: Statistics and analysis of FHIR Implementation Guides';
     content += '</li>';
   }
 
-  if (config.modules.shl.enabled) {
+  if (config.modules?.shl?.enabled) {
     content += '<li class="list-group-item">';
     content += '<a href="/shl" class="text-decoration-none">SHL Server</a>: SMART Health Links management and validation';
     content += '</li>';
   }
 
-  if (config.modules.vcl.enabled) {
+  if (config.modules?.vcl?.enabled) {
     content += '<li class="list-group-item">';
     content += '<a href="/VCL" class="text-decoration-none">VCL Server</a>: ValueSet Compose Language expression parsing';
     content += '</li>';
   }
 
-  if (config.modules.registry && config.modules.registry.enabled) {
+  if (config.modules?.registry?.enabled) {
     content += '<li class="list-group-item">';
     content += '<a href="/tx-reg" class="text-decoration-none">Terminology Server Registry</a>: ';
     content += 'Discover and query FHIR terminology servers for code system and value set support (<a href="/tx-reg/openapi">API</a>)';
     content += '</li>';
   }
 
-  if (config.modules.publisher && config.modules.publisher.enabled) {
+  if (config.modules?.publisher?.enabled) {
     content += '<li class="list-group-item">';
     content += '<a href="/publisher" class="text-decoration-none">FHIR Publisher</a>: ';
     content += 'Manage FHIR Implementation Guide publication tasks and approvals';
     content += '</li>';
   }
 
-  if (config.modules.token && config.modules.token.enabled) {
+  if (config.modules?.token?.enabled) {
     content += '<li class="list-group-item">';
     content += '<a href="/token" class="text-decoration-none">Token Server</a>: ';
     content += 'OAuth authentication and API key management for FHIR services';
     content += '</li>';
   }
 
-  if (config.modules.npmprojector && config.modules.npmprojector.enabled) {
+  if (config.modules?.npmprojector?.enabled) {
     content += '<li class="list-group-item">';
     content += '<a href="/npmprojector" class="text-decoration-none">NpmProjector</a>: ';
     content += 'Hot-reloading FHIR server with FHIRPath-based search indexes';
@@ -383,7 +410,14 @@ async function buildRootPageContent() {
     content += '</li>';
   }
 
-  if (config.modules.folder && config.modules.folder.enabled) {
+  if (config.modules?.ips?.enabled) {
+    content += '<li class="list-group-item">';
+    content += '<a href="/ips" class="text-decoration-none">IPS</a>: ';
+    content += 'Collections of International Patient Summary documents, each with its own FHIR endpoint';
+    content += '</li>';
+  }
+
+  if (config.modules?.folder?.enabled) {
     content += '<li class="list-group-item">';
     content += '<strong>Cache Folder</strong>: ';
     content += 'Cache Folder for Kindling';
@@ -400,7 +434,7 @@ async function buildRootPageContent() {
   }
 
 
-  if (config.modules.tx && config.modules.tx.enabled) {
+  if (config.modules?.tx?.enabled) {
     content += '<li class="list-group-item">';
     content += '<strong>TX Terminology Server</strong>: ';
     content += 'FHIR terminology services (CodeSystem, ValueSet, ConceptMap)';
@@ -422,16 +456,7 @@ async function buildRootPageContent() {
 
   // Calculate uptime
   const uptimeMs = Date.now() - stats.startTime;
-  const uptimeSeconds = Math.floor(uptimeMs / 1000);
-  const uptimeDays = Math.floor(uptimeSeconds / 86400);
-  const uptimeHours = Math.floor((uptimeSeconds % 86400) / 3600);
-  const uptimeMinutes = Math.floor((uptimeSeconds % 3600) / 60);
-  const uptimeSecs = uptimeSeconds % 60;
-  let uptimeStr = '';
-  if (uptimeDays > 0) uptimeStr += `${uptimeDays}d `;
-  if (uptimeHours > 0 || uptimeDays > 0) uptimeStr += `${uptimeHours}h `;
-  if (uptimeMinutes > 0 || uptimeHours > 0 || uptimeDays > 0) uptimeStr += `${uptimeMinutes}m `;
-  uptimeStr += `${uptimeSecs}s`;
+  const uptimeStr = uptimeText(uptimeMs);
 
   // Memory usage
   const memUsage = process.memoryUsage();
@@ -550,7 +575,7 @@ app.get('/', async (req, res) => {
       // Build basic stats for root page
       const stats = {
         version: packageJson.version,
-        enabledModules: Object.keys(config.modules).filter(m => config.modules[m].enabled).length,
+        enabledModules: Object.keys(config.modules).filter(m => config.modules[m]?.enabled).length,
         processingTime: Date.now() - startTime,
         about
       };
@@ -616,16 +641,7 @@ app.get('/dashboard', async (req, res) => {
     const startTime = Date.now();
     // Calculate uptime
     const uptimeMs = Date.now() - stats.startTime;
-    const uptimeSeconds = Math.floor(uptimeMs / 1000);
-    const uptimeDays = Math.floor(uptimeSeconds / 86400);
-    const uptimeHours = Math.floor((uptimeSeconds % 86400) / 3600);
-    const uptimeMinutes = Math.floor((uptimeSeconds % 3600) / 60);
-    const uptimeSecs = uptimeSeconds % 60;
-    let uptimeStr = '';
-    if (uptimeDays > 0) uptimeStr += `${uptimeDays}d `;
-    if (uptimeHours > 0 || uptimeDays > 0) uptimeStr += `${uptimeHours}h `;
-    if (uptimeMinutes > 0 || uptimeHours > 0 || uptimeDays > 0) uptimeStr += `${uptimeMinutes}m `;
-    uptimeStr += `${uptimeSecs}s`;
+    const uptimeStr = uptimeText(uptimeMs);
 
     // Memory usage
     const memUsage = process.memoryUsage();
@@ -674,7 +690,7 @@ app.get('/dashboard', async (req, res) => {
 
     const pageStats = {
       version: packageJson.version,
-      enabledModules: Object.keys(config.modules).filter(m => config.modules[m].enabled).length,
+      enabledModules: Object.keys(config.modules).filter(m => config.modules[m]?.enabled).length,
       processingTime: Date.now() - startTime
     };
 
@@ -701,6 +717,30 @@ function formatBytes(bytes) {
   return `${(bytes / 1024 / 1024 / 1024).toFixed(2)} GB`;
 }
 
+/**
+ * "3d 4h 5m 6s" for this run, followed by the proportion of time the server has
+ * been up over all its recorded runs, when the statistics database is keeping that.
+ */
+function uptimeText(uptimeMs) {
+  const uptimeSeconds = Math.floor(uptimeMs / 1000);
+  const uptimeDays = Math.floor(uptimeSeconds / 86400);
+  const uptimeHours = Math.floor((uptimeSeconds % 86400) / 3600);
+  const uptimeMinutes = Math.floor((uptimeSeconds % 3600) / 60);
+  const uptimeSecs = uptimeSeconds % 60;
+  let uptimeStr = '';
+  if (uptimeDays > 0) uptimeStr += `${uptimeDays}d `;
+  if (uptimeHours > 0 || uptimeDays > 0) uptimeStr += `${uptimeHours}h `;
+  if (uptimeMinutes > 0 || uptimeHours > 0 || uptimeDays > 0) uptimeStr += `${uptimeMinutes}m `;
+  uptimeStr += `${uptimeSecs}s`;
+  const overall = stats.overallUptime();
+  if (overall) {
+    // floor rather than round, so 99.96% doesn't claim to be 100%
+    const pct = overall.percent >= 100 ? '100' : (Math.floor(overall.percent * 10) / 10).toFixed(1);
+    uptimeStr += ` (${pct}% overall)`;
+  }
+  return uptimeStr;
+}
+
 function pctColor(pct) {
   // Gradient from green (#deffe0) at 0% to red (#ffd3d1) at 100%
   const t = Math.max(0, Math.min(100, pct)) / 100;
@@ -797,11 +837,21 @@ async function startServer() {
 
     // Start server
     app.listen(PORT, () => {
-      stats.markStarted();
+      stats.markStarted(packageJson.version);
       serverLog.info(`=== Server running on http://localhost:${PORT} ===`);
     });
     npmAudit.start();
-    if (modules.packages && config.modules.packages.enabled) {
+    dailyReport = new DailyReport(config.dailyReport, {
+      log: Logger.getInstance().child({ module: 'daily-report' }),
+      stats: stats,
+      modules: modules,
+      mailer: new Mailer(config.email, Logger.getInstance().child({ module: 'email' })),
+      npmAudit: npmAudit,
+      version: packageJson.version,
+      serverId: config.hostName
+    });
+    dailyReport.start();
+    if (modules.packages && config.modules?.packages?.enabled) {
       modules.packages.startInitialCrawler();
     }
     // Run usage tracker in background after startup
@@ -825,12 +875,21 @@ async function startServer() {
   }
 }
 
-// Graceful shutdown
-process.on('SIGINT', async () => {
+// Graceful shutdown: on Ctrl-C (SIGINT), and on SIGTERM - what systemd, docker stop and
+// kill send - so the modules can save what they hold (usage counts, crawl data) either way
+let shuttingDown = false;
+async function shutdown() {
+  if (shuttingDown) {
+    return;
+  }
+  shuttingDown = true;
   serverLog.info('\nShutting down server...');
   if (npmAudit) {
     npmAudit.stop();
   }
+  if (dailyReport) {
+    dailyReport.stop();
+  }
 
   // Shutdown all modules
   for (const [moduleName, moduleInstance] of Object.entries(modules)) {
@@ -847,7 +906,9 @@ process.on('SIGINT', async () => {
   stats.finishStats();
   serverLog.info('Server shutdown complete');
   process.exit(0);
-});
+}
+process.on('SIGINT', () => void shutdown());
+process.on('SIGTERM', () => void shutdown());
 
 async function serveFhirsmithHome(req, res) {
   // Check if client wants HTML response
@@ -868,7 +929,7 @@ async function serveFhirsmithHome(req, res) {
       // Build basic stats for root page
       const stats = {
         version: packageJson.version,
-        enabledModules: Object.keys(config.modules).filter(m => config.modules[m].enabled).length,
+        enabledModules: Object.keys(config.modules).filter(m => config.modules[m]?.enabled).length,
         processingTime: Date.now() - startTime
       };
 
@@ -885,7 +946,7 @@ async function serveFhirsmithHome(req, res) {
     // Return JSON response for API clients
     const enabledModules = {};
     Object.keys(config.modules).forEach(moduleName => {
-      if (config.modules[moduleName].enabled) {
+      if (config.modules[moduleName]?.enabled) {
         if (moduleName === 'tx') {
           // TX module has multiple endpoints
           enabledModules[moduleName] = {

package/shl/shl.js

@@ -808,16 +808,26 @@ class SHLModule {
       }
     });
 
-    // Helper function for the shared access logic
+    // Helper function for the shared access logic.
+    //
+    // POST is the manifest request. GET is only defined by the SHL spec for the
+    // U flag (direct file access): the client does GET {url}?recipient=... and
+    // expects the single encrypted file (JWE) back, not a manifest. The flag is
+    // not sent to or stored on the server, so a GET is taken to mean U. If the
+    // SHL has more than one file (U isn't valid for it), or it's a VHL, GET
+    // keeps returning the manifest / VHL bundle as before.
     const handleSHLAccess = (req, res) => {
       const start = Date.now();
       try {
         const {uuid} = req.params;
+        const isGet = req.method === 'GET';
 
         let recipient, embeddedLengthMax;
 
-        if (req.method === 'GET') {
-          recipient = 'anonymous';
+        if (isGet) {
+          recipient = typeof req.query.recipient === 'string' && req.query.recipient.length > 0
+            ? req.query.recipient.substring(0, 255)
+            : 'anonymous';
           embeddedLengthMax = undefined;
         } else {
           ({recipient, embeddedLengthMax} = req.body);
@@ -846,7 +856,7 @@ class SHLModule {
 
           const logAccessSql = 'INSERT INTO SHLViews (shl_uuid, recipient, ip_address) VALUES (?, ?, ?)';
 
-          this.db.run(logAccessSql, [uuid, recipient, clientIP], function (logErr) {
+          this.db.run(logAccessSql, [uuid, recipient, clientIP], (logErr) => {
             if (logErr) {
               shlLog.error('Failed to log SHL access:', logErr.message);
             }
@@ -858,24 +868,37 @@ class SHLModule {
                 return res.status(500).json({error: 'Failed to retrieve files'});
               }
 
+              // U flag: return the one file directly
+              if (isGet && !shlRow.vhl && fileRows.length === 1) {
+                try {
+                  res.set('Content-Type', 'application/jose');
+                  return res.send(Buffer.from(fileRows[0].cnt, 'base64'));
+                } catch (decodeErr) {
+                  return res.status(500).json({error: 'Failed to decode file content'});
+                }
+              }
+
+              // SHL links are always https; the server always sits behind an https proxy
               const host = req.get('host') || 'localhost:3000';
-              const protocol = req.secure ? 'https' : 'http';
               const maxLength = embeddedLengthMax ? parseInt(embeddedLengthMax) : undefined;
 
               const files = fileRows.map(file => {
                 const fileResponse = {
                   contentType: file.type,
-                  location: `${protocol}://${host}/shl/file/${file.id}`
+                  location: `https://${host}/shl/file/${file.id}`
                 };
 
-                if (maxLength === undefined || file.cnt.length <= maxLength) {
-                  fileResponse.embedded = file.cnt;
+                // cnt is stored base64-encoded; embedded must be the JWE compact serialization itself
+                const jwe = Buffer.from(file.cnt, 'base64').toString('utf8');
+                if (maxLength === undefined || jwe.length <= maxLength) {
+                  fileResponse.embedded = jwe;
                 }
 
                 return fileResponse;
               });
 
-              const standardResponse = {files};
+              // finalized: content is fixed for the life of the link (expired links 404 above)
+              const standardResponse = {status: 'finalized', files};
 
               if (shlRow.vhl && vhlProcessor) {
                 try {
@@ -1059,6 +1082,38 @@ class SHLModule {
     });
   }
 
+  /**
+   * The paragraph for the server's daily report: links (QR codes) created in
+   * the period, in either form, how often links were accessed, and the
+   * documents stored behind them.
+   */
+  async dailyReport({since, now}) {
+    const {plural} = require('../library/daily-report');
+    if (!this.db) {
+      return 'The database is not open.';
+    }
+    const get = (sql, params) => new Promise((resolve, reject) =>
+      this.db.get(sql, params, (err, row) => err ? reject(err) : resolve(row)));
+    // created_at is CURRENT_TIMESTAMP: UTC, 'YYYY-MM-DD HH:MM:SS'
+    const utc = ms => new Date(ms).toISOString().replace('T', ' ').substring(0, 19);
+    try {
+      const created = await get(
+        'SELECT SUM(CASE WHEN vhl THEN 0 ELSE 1 END) AS shl, SUM(CASE WHEN vhl THEN 1 ELSE 0 END) AS vhl FROM SHL WHERE created_at > ? AND created_at <= ?',
+        [utc(since), utc(now)]);
+      const views = await get('SELECT COUNT(*) AS n FROM SHLViews WHERE created_at > ? AND created_at <= ?', [utc(since), utc(now)]);
+      const files = await get('SELECT COUNT(*) AS n, COUNT(DISTINCT shl_uuid) AS links FROM SHLFiles', []);
+      const shl = created.shl || 0;
+      const vhl = created.vhl || 0;
+      const total = shl + vhl;
+      const sentences = [];
+      sentences.push(`${plural(total, 'QR code')} ${total === 1 ? 'was' : 'were'} served (${shl} SMART Health ${shl === 1 ? 'Link' : 'Links'}, ${plural(vhl, 'Verifiable Health Link')}), and links were accessed ${plural(views.n, 'time')}.`);
+      sentences.push(`${plural(files.n, 'document')} ${files.n === 1 ? 'is' : 'are'} stored to serve ${plural(files.links, 'QR code')}.`);
+      return sentences.join(' ');
+    } catch (e) {
+      return `The database could not be read: ${e.message}.`;
+    }
+  }
+
   async shutdown() {
     shlLog.info('Shutting down SHL module...');
 

package/stats-db.js

@@ -77,6 +77,22 @@ class StatsDatabase {
     this.db.exec(`CREATE INDEX IF NOT EXISTS idx_request_counts_time ON request_counts(time)`);
     this.db.exec(`CREATE INDEX IF NOT EXISTS idx_request_counts_key ON request_counts(module, endpoint, operation, id)`);
 
+    // One row per run of the server: when it started serving, and the last
+    // time it was known to be alive. See ServerStats.overallUptime().
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS server_runs (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        started INTEGER NOT NULL,
+        last_seen INTEGER NOT NULL,
+        version TEXT
+      )
+    `);
+    // version was added after the table first shipped
+    if (!this.db.prepare(`PRAGMA table_info(server_runs)`).all().some(c => c.name === 'version')) {
+      this.db.exec(`ALTER TABLE server_runs ADD COLUMN version TEXT`);
+    }
+    this.touchRunStatement = this.db.prepare(`UPDATE server_runs SET last_seen = ? WHERE id = ?`);
+
     this.insertStatement = this.db.prepare(`
       INSERT INTO request_counts
         (time, interval_ms, module, endpoint, operation, count_delta, count_total, time_delta, time_total)
@@ -106,6 +122,83 @@ class StatsDatabase {
     `).all();
   }
 
+  /**
+   * Record that a new run of the server has started serving, and return its
+   * row id for touchRun().
+   */
+  startRun(now, version = null) {
+    if (!this.db) {
+      return null;
+    }
+    return this.db.prepare(`INSERT INTO server_runs (started, last_seen, version) VALUES (?, ?, ?)`).run(now, now, version).lastInsertRowid;
+  }
+
+  /**
+   * The runs that were alive at any point since `since`, oldest first, plus
+   * the last run that ended before then (so a caller can tell whether the
+   * first run in the period was an upgrade). Each is {id, started, lastSeen,
+   * version}.
+   */
+  loadRuns(since) {
+    if (!this.db) {
+      return [];
+    }
+    const before = this.db.prepare(`
+      SELECT id, started, last_seen AS lastSeen, version FROM server_runs
+      WHERE last_seen < ? ORDER BY last_seen DESC LIMIT 1
+    `).get(since);
+    const during = this.db.prepare(`
+      SELECT id, started, last_seen AS lastSeen, version FROM server_runs
+      WHERE last_seen >= ? ORDER BY started
+    `).all(since);
+    return before ? [before, ...during] : during;
+  }
+
+  /**
+   * The server is still alive: move the run's last_seen forward.
+   */
+  touchRun(runId, now) {
+    if (this.db && runId != null) {
+      this.touchRunStatement.run(now, runId);
+    }
+  }
+
+  /**
+   * How long the server has been running over all the runs recorded before
+   * this one: the earliest start, and the total time between each run's start
+   * and the last time it was seen alive. {firstStart: null, runningMs: 0} if
+   * there are no earlier runs.
+   */
+  loadRunHistory(excludeRunId) {
+    if (!this.db) {
+      return {firstStart: null, runningMs: 0};
+    }
+    const row = this.db.prepare(`
+      SELECT MIN(started) AS firstStart, COALESCE(SUM(last_seen - started), 0) AS runningMs
+      FROM server_runs
+      WHERE id IS NOT ?
+    `).get(excludeRunId == null ? -1 : excludeRunId);
+    return {firstStart: row.firstStart, runningMs: row.runningMs};
+  }
+
+  /**
+   * The requests counted against a module in (since, now], by endpoint and
+   * operation: [{endpoint, operation, count}]. A row is attributed to the
+   * time it was written, so the edges of the period are as fine as the
+   * collection interval (and ServerStats.flushNow() sharpens the near edge).
+   */
+  countsSince(since, now, module) {
+    if (!this.db) {
+      return [];
+    }
+    return this.db.prepare(`
+      SELECT endpoint, operation, SUM(count_delta) AS count
+      FROM request_counts
+      WHERE module = ? AND time > ? AND time <= ?
+      GROUP BY endpoint, operation
+    `).all(module, since, now);
+  }
+
   /**
    * Write one interval's worth of rows. All or nothing - if the transaction
    * fails the caller keeps its deltas and tries again next interval.