When making a new RPC/runtime-api endpoint, what criteria should you have in mind regarding making it safe/unsafe?
For example, assume that a UI wants to fetch a large amount of data (a lot of keys in a double-map), in order to compute some result.
Instead of querying all of this data via
state_getStorage, an option is make an RPC call that would compute the same output on the node side, and return it.
But this begs the question: if done via an RPC call, is this a safe RPC? In principle, the amount of work that the replying node needs to do is less if it is all done in one RPC, compared to responding t large number of
Moreover, if done via
state_call, this RPC is already considered to be safe, so it is quite easy to make this mistake. Perhaps runtime APIs should also be tagged as
#[state_call_unsafe], which makes them prohibited from being called via