Add scan queue execution and listing endpoint.

Run scans in background with progress/status updates and store scan metrics in memory or PostgreSQL.

Made-with: Cursor

internal/api/handler.go

@@ -3,6 +3,7 @@ package api
 import (
 	"encoding/json"
 	"net/http"
+	"strconv"
 	"strings"
 	"time"
 
@@ -11,16 +12,18 @@ import (
 
 type Handler struct {
 	store scans.Store
+	run   *scans.Runner
 }
 
-func NewHandler(store scans.Store) *Handler {
-	return &Handler{store: store}
+func NewHandler(store scans.Store, run *scans.Runner) *Handler {
+	return &Handler{store: store, run: run}
 }
 
 func (h *Handler) Routes() http.Handler {
 	mux := http.NewServeMux()
 	mux.HandleFunc("GET /health", h.health)
 	mux.HandleFunc("POST /api/scans", h.createScan)
+	mux.HandleFunc("GET /api/scans", h.listScans)
 	mux.HandleFunc("GET /api/scans/{id}", h.getScan)
 	return withJSON(mux)
 }
@@ -54,6 +57,25 @@ func (h *Handler) createScan(w http.ResponseWriter, r *http.Request) {
 		"scan_id": job.ID,
 		"status":  job.Status,
 	})
+
+	if h.run != nil {
+		h.run.Start(job)
+	}
+}
+
+func (h *Handler) listScans(w http.ResponseWriter, r *http.Request) {
+	limit := 50
+	if raw := r.URL.Query().Get("limit"); raw != "" {
+		n, err := strconv.Atoi(raw)
+		if err != nil || n <= 0 || n > 500 {
+			writeError(w, http.StatusBadRequest, "limit must be between 1 and 500")
+			return
+		}
+		limit = n
+	}
+	writeJSON(w, http.StatusOK, map[string]any{
+		"items": h.store.ListScans(limit),
+	})
 }
 
 func (h *Handler) getScan(w http.ResponseWriter, r *http.Request) {