Triggering authenticated workflows

Assuming:

• There is a service called blueapi, which requires an authenticated request and creates "raw data"
• There is a process called analysis, which generically consumes "raw data" and creates "processed data"
• A user makes a request to blueapi to create "raw data" and knows they want a specific form of analysis to produce "processed data" either while blueapi is acting or afterwards.
• To leverage the workflow system, the user should not need to manually create the analysis instance
• The analysis instance should write data to the same visit as the raw data and request that spawned it
• The analysis should be authorized to read only the raw data that it requires

sequenceDiagram
    actor Alice
    Note left of Alice: my_scan uses my_analysis
    Alice ->> +blueapi: run my_scan, visit=a1
    Note over Alice,blueapi: scope read data visit=a1
    Note over Alice,blueapi: scope write data visit=a1
    Note over Alice,blueapi: scope run my_analysis visit=a1

    participant raw as Raw Data Store<br>[via DataAPI]
    blueapi ->> raw: StartDocument runid=a1-1
    Note over blueapi,raw: AuthZ'd to write

    participant manager as Workflow Manager
    blueapi ->> manager: start my_analysis visit=a1 runid=a1-1
    Note over blueapi,manager: AuthZ'd to run
    
    create participant Analysis as my_analysis
    manager ->> +Analysis: creates
    Note over manager,Analysis: scope read data visit=a1
    Note over manager,Analysis: scope write data visit=a1
    
    opt Live Analysis
    Analysis ->> raw: fetch data so far
    raw ->> Analysis: 
    Note over Analysis,raw: AuthZ'd to read
    Analysis ->> processed: processed data
    Note over Analysis,processed: AuthZ'd to write

    loop until scan over
    blueapi ->> raw: Documents
    Analysis -->> raw: poll for new data
    Analysis ->> processed: processed data
    end
    blueapi ->> raw: StopDocument
    Analysis -->> raw: poll for new data
    Analysis ->> processed: processed data
    end
    opt Post Processing
    blueapi ->> raw: Documents
    blueapi ->> -raw: StopDocument
    Analysis ->> raw: fetch all data
    raw ->> Analysis:     
    Note over raw,Analysis: AuthZ'd to read
    end
    deactivate Analysis

    participant processed as Processed Data Store<br>[via DataAPI]
    destroy Analysis
    Analysis ->> processed: processed data
    Note over Analysis,processed: AuthZ'd to write

    Alice ->> raw: 
    raw ->> Alice: 
    Note over Alice,raw: AuthZ'd to read
    Alice ->> processed: 
    processed ->> Alice: 
    Note over Alice,processed: AuthZ'd to read

Comience con la secuencia de Mermaid propuesta: blueapi solicita al Workflow Manager que inicie un análisis, mientras DataAPI almacena los datos sin procesar y procesados. Identifique los puntos de entrada de workflow-manager y authorization necesarios para admitir la activación autenticada, el acceso con ámbito y los IDs de visita/ejecución compartidos. Se considera terminado cuando los flujos en vivo y de posprocesamiento descritos funcionan con los permisos indicados.