feat(api): onboarding endpoints for unified targets #142

Merged

sharang merged 1 commits from feat/onboarding-api into main 2026-07-12 20:15:22 +00:00

Conversation 0 Commits 1 Files Changed 6

+493 -2

sharang commented 2026-07-10 18:06:55 +00:00

Owner

Copy Link

Copy Source

Closes #131. The REST surface the onboarding wizard drives, on the unified OnboardedTarget model.

Endpoints (api/handlers/onboarding.rs, routes in routes.rs)

Method	Path	Purpose
GET / POST	/api/v1/targets	list (paginated) / create
GET / PATCH / DELETE	/api/v1/targets/{id}	fetch / update / delete (+cascade findings·scans by repo_id)
POST	/api/v1/targets/{id}/artifacts	attach an artifact by reference
GET	/api/v1/targets/{id}/applicable-scans	scan-applicability matrix + pentest support
POST	/api/v1/targets/{id}/detect	kind-based classification

Follows the existing conventions exactly (ApiResponse, PaginationParams, tenant_db, collect_cursor_async, TenantCtx — so it inherits the global JWT/tenant gate). Clients send a light ArtifactInput (kind + source_ref + optional branch/plc_format); the server builds the Artifact (and its id).

/detect is the lightweight pass — it classifies from artifact kinds without ingesting (cloning) sources, so it returns immediately (e.g. a PLC-project artifact → suggests plc_sps). Deep detection after ingest (with tramiton firmware analysis) is a follow-up background step, as is multipart artifact upload and the scan-trigger endpoint (which needs the unified pipeline, #133).

Also fixes the integration harness

TestServer used a 37-char db-name prefix, over the pool's 30-char cap — so TestServer::start() panicked and every API integration test was silently broken locally (CI runs --lib only, so it went unnoticed). Shortened to a 16-hex suffix.

Testing

3 HTTP integration tests (create/list/applicable-scans; detect→PLC; add-artifact/delete) — pass against local Mongo. (Not run in CI, which is --lib-only.)

Refs #118.

Closes #131. The REST surface the onboarding wizard drives, on the unified `OnboardedTarget` model. ## Endpoints (`api/handlers/onboarding.rs`, routes in `routes.rs`) | Method | Path | Purpose | |---|---|---| | GET / POST | `/api/v1/targets` | list (paginated) / create | | GET / PATCH / DELETE | `/api/v1/targets/{id}` | fetch / update / delete (+cascade findings·scans by `repo_id`) | | POST | `/api/v1/targets/{id}/artifacts` | attach an artifact by reference | | GET | `/api/v1/targets/{id}/applicable-scans` | scan-applicability matrix + pentest support | | POST | `/api/v1/targets/{id}/detect` | kind-based classification | Follows the existing conventions exactly (`ApiResponse`, `PaginationParams`, `tenant_db`, `collect_cursor_async`, `TenantCtx` — so it inherits the global JWT/tenant gate). Clients send a light `ArtifactInput` (kind + source_ref + optional branch/plc_format); the server builds the `Artifact` (and its id). `/detect` is the **lightweight** pass — it classifies from artifact kinds without ingesting (cloning) sources, so it returns immediately (e.g. a PLC-project artifact → suggests `plc_sps`). Deep detection after ingest (with tramiton firmware analysis) is a follow-up background step, as is multipart artifact **upload** and the **scan-trigger** endpoint (which needs the unified pipeline, #133). ## Also fixes the integration harness `TestServer` used a 37-char db-name prefix, over the pool's 30-char cap — so `TestServer::start()` panicked and **every API integration test was silently broken locally** (CI runs `--lib` only, so it went unnoticed). Shortened to a 16-hex suffix. ## Testing 3 HTTP integration tests (create/list/applicable-scans; detect→PLC; add-artifact/delete) — **pass** against local Mongo. (Not run in CI, which is `--lib`-only.) Refs #118.

sharang added this to the Onboarding v1 milestone 2026-07-10 18:06:55 +00:00

sharang added the enhancementonboarding labels 2026-07-10 18:06:55 +00:00

sharang added 1 commit 2026-07-10 18:06:55 +00:00

feat(api): onboarding endpoints for unified targets (#131) ... c8255bf024

REST surface the wizard drives onboarding through:
- GET/POST /api/v1/targets (list paginated / create)
- GET/PATCH/DELETE /api/v1/targets/{id} (fetch / update / delete + cascade
  findings/scans by repo_id)
- POST /api/v1/targets/{id}/artifacts (attach an artifact by reference)
- GET /api/v1/targets/{id}/applicable-scans (scan matrix + pentest support)
- POST /api/v1/targets/{id}/detect (kind-based classification — no ingest;
  deep post-ingest detection is a follow-up)

Follows the existing axum handler/route/DTO conventions (ApiResponse,
PaginationParams, tenant_db, collect_cursor_async, TenantCtx). Multipart artifact
upload and the scan-trigger endpoint (needs the unified pipeline, #133) are
follow-ups.

Also fixes the TestServer db-name prefix (was 37 chars, over the pool's 30-char
cap) which had silently broken every API integration test locally.

3 HTTP integration tests (create/list/applicable-scans, detect->PLC,
add-artifact/delete) — pass against local Mongo.

Closes #131.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sharang merged commit a204f0c59c into main 2026-07-12 20:15:22 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

P0-demo

CERTifAI P0 demo build tickets (CS-*)

bug

critical

enhancement

epic

Tracking issue spanning multiple sub-issues

high

infrastructure

onboarding

Multi-target onboarding wizard redesign

performance

security

v0.3.0

No labels enhancement onboarding

Milestone

No items

No Milestone Onboarding v1

Projects

Clear projects

No projects

Assignees

Clear assignees

Benjamin_Boenisch sharang (Sharang Parnerkar)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#142