Add a REST api endpoint to create a plan and run it

[stan-dot]

in order to champion delightful dev experience we should add a new POST endpoint as a thin wrapper around the logic for plan creation and plan execution. example

[callumforrester]

We can't allow uploading arbitrary code and executing it on the server for security reasons

[DiamondJoseph]

As above, but additionally

• Would require special handling for traceability and metrics
• Isn't reliably repeatable (information lost on pod restart)
• Not debuggable remotely or easily debuggable locally How is the dev experience improved by POSTing an arbitrary python file vs. committing the python file?

[DiamondJoseph]

We may have misread this as "POST a random .py file": is it intended to be that or just "an endpoint that combines

@app.post(
    "/tasks",
    response_model=TaskResponse,
    status_code=status.HTTP_201_CREATED,
)
def submit_task(

and

@app.put(
    "/worker/task",
    response_model=WorkerTask,
    responses={status.HTTP_409_CONFLICT: {"worker": "already active"}},
)
def update_task(

?

[stan-dot]

well yes, it's about the second one - what verification could run there? the second one would be suitable

[callumforrester]

The reason they are currently two endpoints is to allow clients to syncrhonise on the task ID

[DiamondJoseph]

To expand: we need the client to have the task ID before the task begins, in case the task completes almost instantly (e.g. a failed scan). Posting the initial task returns the task ID which is used as a temporary queue name in RabbitMQ, that the client would not be able to know anything until after the task has potentially failed. Then the client attempts to listen to the queue and it never receives any messages. The client times-out, assuming the task has locked up when actually the task failed prior.

[stan-dot]

what if we use a websocket connection instead of REST for stuff like this then? davidia already has a setup like that

[stan-dot]

The reason they are currently two endpoints is to allow clients to syncrhonise on the task ID

that does not exclude the option for this endpoint to exist for API debugging purposes