When should an RPC be unsafe?

Question

When making a new RPC/runtime-api endpoint, what criteria should you have in mind regarding making it safe/unsafe?

For example, assume that a UI wants to fetch a large amount of data (a lot of keys in a double-map), in order to compute some result.

Instead of querying all of this data via state_getStorage, an option is make an RPC call that would compute the same output on the node side, and return it.

But this begs the question: if done via an RPC call, is this a safe RPC? In principle, the amount of work that the replying node needs to do is less if it is all done in one RPC, compared to responding t large number of state_getStorage queries.

Moreover, if done via state_call, this RPC is already considered to be safe, so it is quite easy to make this mistake. Perhaps runtime APIs should also be tagged as #[state_call_unsafe], which makes them prohibited from being called via state_call

Answer 1

While it is hard to draw the exact line, there is a possibility that the new hypothetical RPC should actually be unsafe, because there is an important difference between the two.

Namely, in state_getStorage the amount of work that the node needs to do is split between multiple requests, and it can be rate-limited. Whilst the one-time state_call might impose a large amount of work on the node at once, which cannot be interrupted.

I think this is the main difference between the two, and why most often the latter should be unsafe.