Page MenuHomePhabricator

Make a subset of API query modules available to the Lua scripting environment
Open, LowestPublicFeature

Description

"To access the API, I think there would need to be some Lua module acting as a wrapper, and I think it also would need runtime support in the Scribunto implementation to make it use FakeRequest; after all such Lua "API calls" should not actually go over the network. In this wrapper and/or runtime it should be relatively simple to make accessible only a safe (in terms of execution time and other considerations) subset of the API. I would think that simple page-related queries such as the one that would be needed here would be part of that subset." -Lupo

Our conversation was triggered by the removal (T63268) of the ability to access the HTML of [[Special:PrefixIndex]].

Use cases:

  • Iterating over subpages to more efficiently find out which translations exist
  • ...

Event Timeline

Rillke raised the priority of this task from to Lowest.
Rillke updated the task description. (Show Details)
Rillke added a project: Scribunto.
Rillke changed Security from none to None.
Rillke subscribed.
Anomie subscribed.

Rather than trying to identify "safe" API modules, it would probably be better to add needed features directly to Scribunto.

See also T51726.

Rather than trying to identify "safe" API modules, it would probably be better to add needed features directly to Scribunto.

I don't think wrapping is the right approach. action=query tends to be extremely fast, and to build an extra layer on top of it when the whole idea is to let people experiment with it to see what comes out of it (often - not much useful, but eventually something does work) would be a much better way. In the past 2 years since this ticket has been filed, we haven't really added much in terms of exposing things like page history/contributions, page enumeration, and many other basic things, so it is clearly not a good way forward. I see messages on various boards asking for it, and we don't do anything to address it.

Just because no one has done the right thing yet doesn't mean calling the API from in the middle of the parser is suddenly less of a bad idea.

Tacsipacsi changed the subtype of this task from "Task" to "Feature Request".Feb 23 2022, 8:12 PM
Tacsipacsi subscribed.