Triggering authenticated workflows

Start with the proposed Mermaid sequence: blueapi requests the Workflow Manager to start an analysis, while DataAPI stores raw and processed data. Identify the workflow-manager and authorization entry points needed to support authenticated triggering, scoped access, and shared visit/run IDs. Done means the described live and post-processing flows work with the stated permissions.

Assuming:

• There is a service called blueapi, which requires an authenticated request and creates "raw data"
• There is a process called analysis, which generically consumes "raw data" and creates "processed data"
• A user makes a request to blueapi to create "raw data" and knows they want a specific form of analysis to produce "processed data" either while blueapi is acting or afterwards.
• To leverage the workflow system, the user should not need to manually create the analysis instance
• The analysis instance should write data to the same visit as the raw data and request that spawned it
• The analysis should be authorized to read only the raw data that it requires

sequenceDiagram
    actor Alice
    Note left of Alice: my_scan uses my_analysis
    Alice ->> +blueapi: run my_scan, visit=a1
    Note over Alice,blueapi: scope read data visit=a1
    Note over Alice,blueapi: scope write data visit=a1
    Note over Alice,blueapi: scope run my_analysis visit=a1

    participant raw as Raw Data Store<br>[via DataAPI]
    blueapi ->> raw: StartDocument runid=a1-1
    Note over blueapi,raw: AuthZ'd to write

    participant manager as Workflow Manager
    blueapi ->> manager: start my_analysis visit=a1 runid=a1-1
    Note over blueapi,manager: AuthZ'd to run
    
    create participant Analysis as my_analysis
    manager ->> +Analysis: creates
    Note over manager,Analysis: scope read data visit=a1
    Note over manager,Analysis: scope write data visit=a1
    
    opt Live Analysis
    Analysis ->> raw: fetch data so far
    raw ->> Analysis: 
    Note over Analysis,raw: AuthZ'd to read
    Analysis ->> processed: processed data
    Note over Analysis,processed: AuthZ'd to write

    loop until scan over
    blueapi ->> raw: Documents
    Analysis -->> raw: poll for new data
    Analysis ->> processed: processed data
    end
    blueapi ->> raw: StopDocument
    Analysis -->> raw: poll for new data
    Analysis ->> processed: processed data
    end
    opt Post Processing
    blueapi ->> raw: Documents
    blueapi ->> -raw: StopDocument
    Analysis ->> raw: fetch all data
    raw ->> Analysis:     
    Note over raw,Analysis: AuthZ'd to read
    end
    deactivate Analysis

    participant processed as Processed Data Store<br>[via DataAPI]
    destroy Analysis
    Analysis ->> processed: processed data
    Note over Analysis,processed: AuthZ'd to write

    Alice ->> raw: 
    raw ->> Alice: 
    Note over Alice,raw: AuthZ'd to read
    Alice ->> processed: 
    processed ->> Alice: 
    Note over Alice,processed: AuthZ'd to read