|Open||None||T145944 Error: URL hostname is not whitelisted: wikiraw:///Fertility-csv|
|Declined||None||T145977 wikiraw:/// protocol does not need to use API to contact local wiki|
Actually we do need to use API, because unlike most other parser-based functionality, graphs do not happen in parser. Parser is aware of its context, so when parser goes through the wiki markup, it can process all the tags and produce output. With graphs/maps, and a number of other services, it is very different. The content is produced by either client-side rendering, or with separate services. So if its being done on the client, the client browser needs to get all the needed data from the backend via api, including the "local" content. Same thing for the service - nodejs service calls the same api to get that data, so it needs the api endpoint.
Lastly, about http -- this is more of a relict of the past, plus a more complex issues:
- vega could function in "trusted" and "non-trusted" mode. In the trusted mode, you can give it any URL, and as long as that URL is either one of the listed domains or subdomains, it will work (in other words, you only allow admins to edit content of that wiki)
- For non-trusted, the http: and https: are disabled. The wikiraw:// protocol could go to any subdomain of wikipedia.org (thus I don't have to specify them all). But the system still needs to know which protocol to use. So if I write wikiraw:///something on en.wikipedia.org, it will resolve "current wiki" to "en.wikipedia.org", and then it needs to know if it should use http or https to call api. So it tests both "http" and "https" whitelists, to see which one matches, and sees that "wikipedia.org" with subdomains should use "https".
This is different from geoshape: protocol, because geoshape always goes to the same host, so this complexity of listing the host in both http and https is not technically needed, but for consistency it makes it easier to have everything in one place.
Suggestions are welcome :)