How to handle write endpoints in public instance

[korikuzma]

We will be deploying a public AnyVLM instance in #49 . The DB users are RO so they will get a Ingestion failed: (psycopg2.errors.InsufficientPrivilege) permission denied error when they try to make a request to POST /ingest_vcf.

We should either:

1. Handle this exception and have detail be that only read operations are allowed on the public instance
2. Hide this endpoint

I'm going back and forth on which one to do. I prefer 2, but then it would introduce Wagner Lab-specific logic to hide this router. 1 is fine, but it seems silly to display an endpoint that will always return a permission denied error.

[jsstevenson]

I would say 1 -- presumably this is an error that would need to be handled anyway, and for the purposes of the "demo" i think it makes sense to demonstrate functionality even if it doesn't work

[theferrit32]

I would lean towards 1 as well. In the future we could look at some formal API key logic or something to handle authorization to the writeable endpoints. Or since the broader VLM network is going to be using an OIDC provider (Auth0) we could potentially even reuse or adapt some of the JWT functions ehclark wrote for AnyVar. Unauthorized writes should probably return 401 at the http layer rather than like a 500 error due to a database write fail.

[korikuzma]

It looks like we're going to remove the endpoint, so going to close this discussion.