[feature] Experimental Advanced Query REST API

[jeffmendoza]

Is your feature request related to a problem? Please describe.

GUAC users and community members continue to identify novel questions or solutions that GUAC will enable answering. Not all of these translate into a single GraphQL query. Also, not all users are interested in learning GraphQL and crafting complex queries.

Example of these are in the guacone query cli command, however users want to be able to call this from other programs or scripts. GUAC should provide a "callabe" interface to the advanced queries that require filtering and/or graph traversal.

Describe the solution you'd like
A new guac binary that will serve an http REST API. Endpoints will be advanced queries that query GUAC GraphQL and return answers. Starting queries will be the same as in the guacone cli:

  bad         Query to find more information on certifyBad.
  known       Query for all the available information on a package, source, or artifact.
  vuln        query if a package is affected by the specified vulnerability

More advanced filters and conditions can be added to these. Also more queries can be added as well.

Describe alternatives you've considered

More advanced queries can be added as new queries directly to GUAC's GraphQL API.

Additional context

Initial discussion is to move forward with a new binary under cmd/. Update the Makefile to build it, but don't add it to release. Also, require an experimental env var to be set to run. The API should support both OpenAPI and be compatible/translatable to protobuf. Moving forward does not preclude the alternative above and will be treated as an experiment.

[nathannaveen]

I would like to work on this.

[lumjjb]

+1 on the proposal. I think this is quite a sizable feature and it'd be nice to have a design doc explaining a bit more about the mechanics of how this would work (both from an infrastructure level, as well as the dependencies of the other GUAC components and libraries).

[nathannaveen]

I am working on the REST APIs design and code (it experimental). Here is the design doc, https://github.com/nathannaveen/guac/blob/nathan/implementREST/cmd/rest/design.md.