analytics-platform 0.2.1__py3-none-any.whl

analytics_platform/firewall.py

@@ -0,0 +1,315 @@
+"""Firewall module: rules from the collector (GET /events/firewall/rules,
+protocol in sdk/protocols/firewall.md) every minute or so; every request is
+checked against them in memory, so the app never waits on the collector.
+What was blocked (or, in monitor mode, would have been) goes back in batches.
+
+Fails open: until rules arrive, and whenever the collector can't be reached,
+requests pass (with the last rules that arrived, if any). The rate limit
+counts in this process: with several workers, pass `counter` (e.g. Redis)
+for one count across them.
+"""
+import bisect
+import ipaddress
+import json
+import re
+import threading
+import time
+from datetime import datetime, timezone
+
+from .core import Periodic, RETRY, header
+from .request_rules import compile_rules, match_request
+
+PROTOCOL = 1
+MIN_SYNC = 30
+FLUSH_EVERY = 5
+BATCH = 200
+QUEUE_MAX = 2000
+COUNTER_MAX = 100000
+MAPPED = 0xFFFF << 32  # IPv4 as ::ffff:a.b.c.d, so one sorted list holds both
+
+
+def ip_key(text):
+    """An address as an int in IPv6 space, or None when invalid."""
+    try:
+        ip = ipaddress.ip_address(str(text).strip().split("%")[0])
+    except ValueError:
+        return None
+    if ip.version == 4:
+        return MAPPED | int(ip)
+    return int(ip)
+
+
+def parse_range(entry):
+    """'1.2.3.0/24' -> (start, end) as ip_key()s, or None."""
+    try:
+        net = ipaddress.ip_network(str(entry).strip(), strict=False)
+    except ValueError:
+        return None
+    start, end = int(net.network_address), int(net.broadcast_address)
+    if net.version == 4:
+        return MAPPED | start, MAPPED | end
+    return start, end
+
+
+class IpSet:
+    """Addresses and ranges, merged and sorted, looked up by binary search."""
+
+    def __init__(self, entries=()):
+        ranges = sorted(r for r in (parse_range(e) for e in entries if isinstance(e, str)) if r)
+        self.starts, self.ends = [], []
+        for start, end in ranges:
+            if self.ends and start <= self.ends[-1] + 1:
+                self.ends[-1] = max(self.ends[-1], end)
+            else:
+                self.starts.append(start)
+                self.ends.append(end)
+
+    def has(self, key):
+        i = bisect.bisect_right(self.starts, key) - 1
+        return i >= 0 and self.ends[i] >= key
+
+    def __len__(self):
+        return len(self.starts)
+
+
+def compile_probes(probes):
+    """The rules' probes (addresses of files no visitor asks for: .env,
+    .git/...) -> {"exact": set, "prefix": tuple, "ban": seconds}, or None."""
+    if not isinstance(probes, dict):
+        return None
+    def paths(key):
+        return [p.lower() for p in probes.get(key) or [] if isinstance(p, str) and p]
+    exact, prefix = set(paths("exact")), tuple(paths("prefix"))
+    if not exact and not prefix:
+        return None
+    try:
+        ban = max(0, int(probes.get("ban") or 0))
+    except (TypeError, ValueError):
+        ban = 0
+    return {"exact": exact, "prefix": prefix, "ban": ban}
+
+
+def is_probe(path, probes):
+    """True when the path (no query, lower-cased, "//" as "/") is a probe."""
+    if not probes:
+        return False
+    clean = re.sub(r"/{2,}", "/", re.split(r"[?#]", str(path or ""), 1)[0].lower())
+    return clean in probes["exact"] or (bool(probes["prefix"]) and clean.startswith(probes["prefix"]))
+
+
+def client_ip(remote, headers, trust_proxy):
+    """The visitor's address. trust_proxy: None/0 the connection's address; a
+    number of proxies in X-Forwarded-For (True = 1); "cloudflare" reads
+    CF-Connecting-IP; a function gets the headers and returns it."""
+    if callable(trust_proxy):
+        return str(trust_proxy(headers) or "")
+    if trust_proxy == "cloudflare":
+        return header(headers, "cf-connecting-ip") or remote
+    hops = 1 if trust_proxy is True else (trust_proxy if isinstance(trust_proxy, int) else 0)
+    if hops > 0:
+        chain = [s.strip() for s in header(headers, "x-forwarded-for").split(",") if s.strip()]
+        if chain:
+            return chain[max(0, len(chain) - hops)]
+    return remote
+
+
+class Firewall:
+    """Options: trust_proxy, mode ("monitor"/"block": overrides the dashboard),
+    counter (callable(key, ttl) -> hits, shared between workers), cache_file
+    (rules kept there between restarts)."""
+
+    def __init__(self, core, trust_proxy=None, mode=None, counter=None, cache_file=None):
+        self.core = core
+        self.trust_proxy = trust_proxy
+        self.mode = mode if mode in ("monitor", "block") else None
+        self.counter = counter
+        self.cache_file = cache_file
+        self.rules = None
+        self.etag = ""
+        self.lock = threading.Lock()
+        self.counts = {}
+        self.queue = {}
+        # Bot protection here: address -> when its ban ends; address -> [window start, failed logins].
+        self.bans = {}
+        self.logins = {}
+        if cache_file:
+            try:
+                with open(cache_file) as f:
+                    cached = json.load(f)
+                self.rules = self._compile(cached["rules"])
+                self.etag = cached.get("etag", "")
+            except (OSError, ValueError, KeyError, TypeError):
+                pass
+        self.jobs = []
+        if core.valid:
+            self.jobs = [Periodic(self._sync), Periodic(self._flush_job, FLUSH_EVERY)]
+
+    def _compile(self, data):
+        if not isinstance(data, dict) or data.get("v") != PROTOCOL:
+            raise ValueError("unknown rules version")
+        rate = data.get("rate") or None
+        if rate and int(rate.get("limit") or 0) > 0:
+            rate = {"limit": int(rate["limit"]), "window": max(1, int(rate.get("window") or 60))}
+        else:
+            rate = None
+        return {
+            "enabled": data.get("enabled") is True,
+            "mode": "block" if data.get("mode") == "block" else "monitor",
+            "sync": max(MIN_SYNC, int(data.get("sync") or RETRY)),
+            "allow": IpSet(data.get("allow") or []),
+            # Crawlers the rate limit must not catch (absent in older rules).
+            "goodbots": IpSet(data.get("goodbots") or []),
+            "deny": IpSet(data.get("deny") or []),
+            "list": IpSet(data.get("lists") or []),
+            "shared": IpSet(data.get("shared") or []),
+            "rate": rate,
+            "banned": IpSet(data.get("banned") or []),
+            "ban": int((data.get("ban") or {}).get("seconds") or 0),
+            "login": data.get("login") if isinstance(data.get("login"), dict) and int(data["login"].get("limit") or 0) > 0 else None,
+            "probes": compile_probes(data.get("probes")),
+            # Virtual patching: rules that match the request, not the address.
+            "requests": compile_rules(data.get("requests")),
+        }
+
+    def _sync(self):
+        headers = {"If-None-Match": self.etag} if self.etag else {}
+        res = self.core.send("firewall", "/events/firewall/rules?site_id=" + self.core.site_id, method="GET", auth="bearer", headers=headers)
+        if res is not None and res.status == 200:
+            data = res.json()
+            try:
+                self.rules = self._compile(data)
+                self.etag = res.headers.get("etag", "")
+                if self.cache_file:
+                    with open(self.cache_file, "w") as f:
+                        json.dump({"etag": self.etag, "rules": data}, f)
+            except (ValueError, OSError) as error:
+                self.core.log("firewall", "rules not used:", error)
+        return self.rules["sync"] if self.rules else RETRY
+
+    def _over_rate(self, ip, rate):
+        window = int(time.time() // rate["window"])
+        if self.counter:
+            return int(self.counter("afw:%s:%s:%s" % (self.core.site_id, ip, window), rate["window"] * 2)) > rate["limit"]
+        with self.lock:
+            entry = self.counts.get(ip)
+            if not entry or entry[0] != window:
+                if not entry and len(self.counts) >= COUNTER_MAX:
+                    self.counts.clear()
+                entry = [window, 0]
+                self.counts[ip] = entry
+            entry[1] += 1
+            return entry[1] > rate["limit"]
+
+    def _banned_here(self, ip):
+        until = self.bans.get(ip)
+        if not until:
+            return False
+        if until > time.time():
+            return True
+        self.bans.pop(ip, None)
+        return False
+
+    def _ban_here(self, ip, seconds):
+        if seconds > 0:
+            with self.lock:
+                if len(self.bans) >= COUNTER_MAX:
+                    self.bans.clear()
+                self.bans[ip] = max(self.bans.get(ip, 0), time.time() + seconds)
+
+    def login_failed(self, ip):
+        """A failed login on your site: counted here (past the site's limit the
+        address is banned straight away) and reported, so it counts on the
+        Security page and gets banned on the other servers too."""
+        key = ip_key(ip)
+        rules = self.rules
+        if key is None or (rules and rules["allow"].has(key)):
+            return
+        login = rules["login"] if rules else None
+        if login:
+            now = time.time()
+            with self.lock:
+                entry = self.logins.get(ip)
+                if not entry or now - entry[0] >= int(login.get("window") or 3600):
+                    if not entry and len(self.logins) >= COUNTER_MAX:
+                        self.logins.clear()
+                    entry = self.logins[ip] = [now, 0]
+                entry[1] += 1
+                reached = entry[1] >= int(login["limit"])
+                if reached:
+                    self.logins.pop(ip, None)
+            if reached:
+                self._ban_here(str(ip), int(login.get("ban") or 3600))
+        self._report({"ip": str(ip), "rule": "login", "action": "monitor", "method": "", "path": "", "user_agent": ""})
+
+    def _report(self, event):
+        key = "|".join((event["ip"], event["rule"], event["action"], event["method"], event["path"]))
+        with self.lock:
+            row = self.queue.get(key)
+            if row:
+                row["hits"] += 1
+            elif len(self.queue) < QUEUE_MAX:
+                self.queue[key] = dict(event, at=datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"), hits=1)
+
+    def flush(self):
+        with self.lock:
+            rows, self.queue = list(self.queue.values()), {}
+        for i in range(0, len(rows), BATCH):
+            self.core.send("firewall", "/events/firewall/events", auth="bearer",
+                           body={"site_id": self.core.site_id, "events": rows[i:i + BATCH]})
+
+    def _flush_job(self):
+        self.flush()
+        return FLUSH_EVERY
+
+    def check(self, ip, method="", path="", user_agent=""):
+        """-> {"action": "allow" | "block" | "monitor", "rule": ..., "status": ...}.
+        Allowed addresses skip every other rule."""
+        allow = {"action": "allow", "rule": "", "status": 200}
+        rules = self.rules
+        if not rules or not rules["enabled"]:
+            return allow
+        key = ip_key(ip)
+        if key is None or rules["allow"].has(key):
+            return allow
+        action = "block" if (self.mode or rules["mode"]) == "block" else "monitor"
+        rule = ("deny" if rules["deny"].has(key)
+                else "ban" if rules["banned"].has(key) or self._banned_here(str(ip))
+                else "list" if rules["list"].has(key) else "shared" if rules["shared"].has(key) else "")
+        if not rule and is_probe(path, rules["probes"]):
+            rule = "probe"
+            # Asking for a secret file: banned here in block mode; the report bans it on the other servers.
+            if action == "block":
+                self._ban_here(str(ip), rules["probes"]["ban"])
+        matched = None
+        if not rule:
+            matched = match_request(rules.get("requests") or [], method, path, user_agent)
+            if matched:
+                rule = "request:" + matched["id"]
+                # A rule the dashboard only watches passes even in block mode;
+                # one that blocks also bans the address here, as a flood does.
+                action = "block" if action == "block" and matched["action"] == "block" else "monitor"
+                if action == "block" and matched["ban"]:
+                    self._ban_here(str(ip), matched["ban"])
+        if not rule and rules["rate"] and not rules["goodbots"].has(key) and self._over_rate(str(ip), rules["rate"]):
+            rule = "rate"
+            # Banned here straight away; the report bans it on the site's other servers.
+            self._ban_here(str(ip), rules["ban"])
+        if not rule:
+            return allow
+        self._report({
+            "ip": str(ip), "rule": rule, "action": action,
+            "method": str(method)[:10], "path": str(path).split("?")[0][:300], "user_agent": str(user_agent)[:300],
+        })
+        return {"action": action, "rule": rule, "status": 429 if rule == "rate" else 403}
+
+    def retry_after(self):
+        rules = self.rules
+        return str(rules["rate"]["window"]) if rules and rules["rate"] else "60"
+
+    def client_ip(self, remote, headers):
+        return client_ip(remote, headers, self.trust_proxy)
+
+    def close(self):
+        for job in self.jobs:
+            job.stop()
+        self.flush()

analytics_platform/flags.py

@@ -0,0 +1,46 @@
+"""Feature flags module: turn features of your app on or off from the
+dashboard (Site settings -> Server), for everyone, a share of users, or listed
+user IDs. is_enabled() answers from memory; the flags come with the module
+switches (core), about once a minute.
+"""
+
+
+def bucket(key, user):
+    """FNV-1a over "key:user", 0-99: the same as the Node and PHP packages."""
+    h = 0x811C9DC5
+    for byte in ("%s:%s" % (key, user)).encode("utf-8"):
+        h ^= byte
+        h = (h * 0x01000193) & 0xFFFFFFFF
+    return h % 100
+
+
+def evaluate(flag, key, user):
+    if not flag.get("on"):
+        return False
+    uid = "" if user is None else str(user)
+    if uid and uid in (flag.get("users") or []):
+        return True
+    rollout = int(flag.get("rollout", 100))
+    if rollout >= 100:
+        return True
+    if rollout <= 0 or not uid:
+        return False
+    return bucket(key, uid) < rollout
+
+
+class Flags:
+    def __init__(self, core, **_):
+        self.core = core
+
+    def is_enabled(self, key, user=None, default=False):
+        try:
+            flag = self.core.flags().get(key) if self.core.is_on("flags") else None
+            return evaluate(flag, key, user) if isinstance(flag, dict) else default
+        except Exception:
+            return default
+
+    def flush(self):
+        pass
+
+    def close(self):
+        pass

analytics_platform/forms.py

@@ -0,0 +1,58 @@
+"""Form protection module: checks a form your server received before you
+accept it (POST /collectanalytics/shield/verify, the same check as spam
+protection's). It reads the hidden "analytics-shield" answer the tracker puts
+in protected forms, and checks the email, name and text for fake sign-ups.
+Spam lands in the site's spam folder (Leads -> Spam). Passwords, card numbers
+and tokens are never sent. Fails open: when the check can't be made, the form
+is accepted (checked False).
+"""
+import re
+
+PRIVATE_FIELD = re.compile(r"pass|card|cvc|cvv|secret|token|ssn|iban|csrf|analytics-shield", re.I)
+MAX_FIELDS = 50
+ANSWER = "analytics-shield"
+
+
+def plain_fields(fields):
+    out = {}
+    for label, value in list((fields or {}).items())[:MAX_FIELDS]:
+        if PRIVATE_FIELD.search(str(label)):
+            continue
+        if isinstance(value, (list, tuple)):
+            value = ", ".join(v for v in value if isinstance(v, str))
+        if isinstance(value, str):
+            out[str(label)[:100]] = value[:2000]
+    return out
+
+
+class Forms:
+    def __init__(self, core, **_):
+        self.core = core
+
+    def check(self, fields, ip="", email=None, name=None, form=None):
+        """fields: the form as a dict. -> {"ok", "spam", "reasons", "checked"}."""
+        unchecked = {"ok": True, "spam": False, "reasons": ["unchecked"], "checked": False}
+        if not self.core.is_on("forms"):
+            return {"ok": True, "spam": False, "reasons": [], "checked": False}
+        fields = dict(fields or {})
+        token = fields.get(ANSWER)
+        if isinstance(token, (list, tuple)):
+            token = token[0] if token else ""
+        body = {"token": token if isinstance(token, str) else "", "fields": plain_fields(fields), "ip": ip or ""}
+        for key, value in (("email", email), ("name", name), ("form", form)):
+            if isinstance(value, str):
+                body[key] = value
+        res = self.core.send("forms", "/collectanalytics/shield/verify", body=body)
+        if res is None or res.status >= 500 or res.status in (403, 429):
+            if res is not None and res.status == 403:
+                self.core.log("forms", "the site secret was refused; forms aren't checked")
+            return unchecked
+        data = res.json() or {}
+        spam = data.get("success") is False
+        return {"ok": not spam, "spam": spam, "reasons": list(data.get("reasons") or []), "checked": True}
+
+    def flush(self):
+        pass
+
+    def close(self):
+        pass

analytics_platform/inventory.py

@@ -0,0 +1,72 @@
+"""Software inventory module (protocol in sdk/protocols/inventory.md): the
+packages installed in the app's environment (importlib.metadata) and its
+Python version, sent to POST /events/inventory a minute after start and then
+once a day (the collector's `every`), so the Security check can match them
+against known security holes. Runs in a background thread, never in a
+request; names and versions only.
+"""
+import platform
+import re
+import socket
+from datetime import datetime, timezone
+
+from .core import Periodic
+
+FIRST = 60
+RETRY_EVERY = 60 * 60
+EVERY = 24 * 60 * 60
+MAX_PACKAGES = 5000
+
+
+def installed_packages():
+    """[{"ecosystem": "PyPI", "name", "version"}], one per distribution (by
+    its normalized name), as published."""
+    try:
+        from importlib import metadata
+    except ImportError:  # Python 3.7
+        return []
+    found = {}
+    for dist in metadata.distributions():
+        try:
+            name = dist.metadata["Name"]
+            version = dist.version
+        except Exception:
+            continue
+        if not name or not version:
+            continue
+        key = re.sub(r"[-_.]+", "-", name).lower()
+        found.setdefault(key, {"ecosystem": "PyPI", "name": name, "version": str(version)})
+    return sorted(found.values(), key=lambda p: p["name"].lower())
+
+
+class Inventory:
+    """Options: host (the server's name; default the host name)."""
+
+    def __init__(self, core, host=None, **_):
+        self.core = core
+        self.host = re.sub(r"[^A-Za-z0-9._-]", "-", str(host if host is not None else socket.gethostname()))[:100] or "server"
+        self.job = Periodic(self._report, FIRST) if core.valid else None
+
+    def _report(self):
+        if not self.core.is_on("inventory"):
+            return RETRY_EVERY
+        packages = installed_packages()
+        res = self.core.send("inventory", "/events/inventory", auth="bearer", body={
+            "site_id": self.core.site_id,
+            "host": self.host,
+            "at": datetime.now(timezone.utc).isoformat().replace("+00:00", "Z"),
+            "runtime": {"python": platform.python_version()},
+            "packages": packages[:MAX_PACKAGES],
+            "truncated": len(packages) > MAX_PACKAGES,
+        })
+        if res is None or not res.ok:
+            return RETRY_EVERY
+        every = (res.json() or {}).get("every")
+        return max(RETRY_EVERY, int(every)) if isinstance(every, int) and every > 0 else EVERY
+
+    def flush(self):
+        pass
+
+    def close(self):
+        if self.job:
+            self.job.stop()

analytics_platform/maintenance.py

@@ -0,0 +1,61 @@
+"""Maintenance mode module: while it's on (Site settings -> Server), visitors
+get a "back soon" page (503, so search engines know it's temporary), except
+allowed addresses and whoever opened the preview link (?site_preview=<code>,
+remembered for a day in a cookie).
+"""
+import html
+from http.cookies import SimpleCookie
+from urllib.parse import parse_qs
+
+from .firewall import IpSet, ip_key
+
+COOKIE = "site_preview"
+
+
+def page(message):
+    text = html.escape(message or "We're doing some maintenance. Please check back in a few minutes.")
+    return ("<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">"
+            "<title>Back soon</title><style>body{margin:0;min-height:100vh;display:grid;place-items:center;font:16px/1.5 system-ui,sans-serif;"
+            "background:#f8fafc;color:#0f172a}main{max-width:32rem;padding:2rem;text-align:center}h1{font-size:1.6rem;margin:0 0 .5rem}"
+            "p{color:#475569;margin:0}@media(prefers-color-scheme:dark){body{background:#0f172a;color:#e2e8f0}p{color:#94a3b8}}</style></head>"
+            "<body><main><h1>Back soon</h1><p>%s</p></main></body></html>" % text).encode("utf-8")
+
+
+class Maintenance:
+    """Options: skip(path) -> True lets a request through (health checks)."""
+
+    def __init__(self, core, skip=None, **_):
+        self.core = core
+        self.skip = skip
+        self._allow_for = None
+        self._allow = IpSet([])
+
+    def decide(self, ip, path, query, cookie_header):
+        """None to let the request through, else (status, headers, body)."""
+        m = self.core.maintenance() if self.core.is_on("maintenance") else None
+        if not m or not m.get("on") or (self.skip and self.skip(path)):
+            return None
+        if self._allow_for is not m.get("allow"):
+            self._allow_for = m.get("allow")
+            self._allow = IpSet(m.get("allow") or [])
+        key = ip_key(ip)
+        if key is not None and self._allow.has(key):
+            return None
+        code = m.get("bypass") or ""
+        if code:
+            if parse_qs(query or "").get(COOKIE, [""])[0] == code:
+                return ("pass", [("Set-Cookie", "%s=%s; Path=/; Max-Age=86400; HttpOnly; SameSite=Lax" % (COOKIE, code))])
+            cookies = SimpleCookie()
+            try:
+                cookies.load(cookie_header or "")
+            except Exception:
+                pass
+            if COOKIE in cookies and cookies[COOKIE].value == code:
+                return None
+        return (503, [("Content-Type", "text/html; charset=utf-8"), ("Retry-After", "600"), ("Cache-Control", "no-store")], page(m.get("message")))
+
+    def flush(self):
+        pass
+
+    def close(self):
+        pass

analytics_platform/performance.py

@@ -0,0 +1,98 @@
+"""Performance & API monitoring module: times every request (from arriving
+to the response being ready) and sends one row per minute, method, route and
+status code (how many, total and slowest time, and a count per time bucket)
+to POST /events/server-requests. Nothing about visitors is sent.
+
+The route is the framework's own pattern when the integration knows it
+(Django, Flask, FastAPI); otherwise numbers and IDs in the path become ":id",
+and unmatched 404s are one route.
+"""
+import platform as host
+import re
+import socket
+import threading
+import time
+from datetime import datetime, timezone
+
+from .core import Periodic
+
+# Keep in step with the collector (expresscollect/Analytics/serverRequests.js).
+BUCKET_EDGES_MS = [5, 10, 25, 50, 100, 250, 500, 1000, 2500, 5000, 10000]
+FLUSH_EVERY = 60
+MAX_KEYS = 300
+MAX_ROWS = 500
+NOT_FOUND = "/(not found)"
+_ID = re.compile(r"^(\d+|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|[0-9a-f]{16,})$", re.I)
+
+
+def normalize_route(path):
+    """'/orders/123/items/9f8e...' -> '/orders/:id/items/:id'"""
+    path = re.split(r"[?#]", str(path or "/"))[0] or "/"
+    parts = [":id" if _ID.match(s) or (len(s) >= 20 and re.search(r"\d", s)) else s for s in path.split("/")]
+    route = "/".join(parts)
+    return (route if route.startswith("/") else "/" + route)[:200]
+
+
+def bucket_of(ms):
+    for i, edge in enumerate(BUCKET_EDGES_MS):
+        if ms <= edge:
+            return i
+    return len(BUCKET_EDGES_MS)
+
+
+class Performance:
+    """Options: server_name (default the host name)."""
+
+    def __init__(self, core, server_name=None, **_):
+        self.core = core
+        self.server_name = str(server_name or socket.gethostname())[:100]
+        self.runtime = "Python " + host.python_version()
+        self.rows = {}
+        self.lock = threading.Lock()
+        self.job = Periodic(self._flush_job, FLUSH_EVERY) if core.valid else None
+
+    def record(self, method, route, status, ms, path=""):
+        """One finished request. route: the framework's pattern, or "" to
+        work it out from path."""
+        if not self.core.is_on("performance"):
+            return
+        status = int(status or 0)
+        if not route:
+            route = NOT_FOUND if status == 404 else normalize_route(path)
+        method = str(method or "GET").upper()[:10]
+        minute = int(time.time() // 60) * 60
+        with self.lock:
+            key = (minute, method, route[:200], status)
+            if key not in self.rows and len(self.rows) >= MAX_KEYS:
+                key = (minute, method, "(other)", status)
+            row = self.rows.get(key)
+            if row is None:
+                row = self.rows[key] = {"count": 0, "sum_ms": 0.0, "max_ms": 0.0, "buckets": [0] * (len(BUCKET_EDGES_MS) + 1)}
+            row["count"] += 1
+            row["sum_ms"] += ms
+            row["max_ms"] = max(row["max_ms"], ms)
+            row["buckets"][bucket_of(ms)] += 1
+
+    def flush(self, everything=True):
+        current = int(time.time() // 60) * 60
+        with self.lock:
+            ready = [(k, v) for k, v in self.rows.items() if everything or k[0] < current]
+            for k, _ in ready:
+                del self.rows[k]
+        rows = [{
+            "minute": datetime.fromtimestamp(k[0], timezone.utc).isoformat().replace("+00:00", "Z"),
+            "method": k[1], "route": k[2], "status": k[3], "count": v["count"],
+            "sum_ms": round(v["sum_ms"], 1), "max_ms": round(v["max_ms"], 1), "buckets": v["buckets"],
+        } for k, v in ready]
+        for i in range(0, len(rows), MAX_ROWS):
+            self.core.send("performance", "/events/server-requests",
+                           body={"server_name": self.server_name, "runtime": self.runtime, "rows": rows[i:i + MAX_ROWS]})
+
+    def _flush_job(self):
+        self.flush(everything=False)
+        return FLUSH_EVERY
+
+    def close(self):
+        if self.job:
+            self.job.stop()
+        self.flush()