Problem: enabling addhoc queries reveal tx data

actually... I'm still not sure it's the right move yet, I'm asking to the kwil team. I'll open a new issue about this. If the risk is only data exposure of transactions, it might be minor in this phase.

Originally posted by @outerlook in https://github.com/trufnetwork/node/issues/932#issuecomment-2883723790

from @brennanjl

Yes, disabling ad hoc queries also disables chain.block. This is because chain.block returns the entirety of the block data (all of the raw transactions). If this was not the case, then attackers could use chain.block as a workaround to read sensitive network information when queries are disabled

This is actually a perfect case where an rpc endpoint for querying a block header only would be ideal. It does not have the security concerns mentioned above because it doesn’t return the raw transaction data for a block

and I raised a point if it's as sensitive as enabling public direct access to 8484 endpoints from nodes

Start by tracing the chain.block RPC entry point and the ad hoc query configuration discussed in the issue. Determine the intended scope with the Kwil team before changing anything. Done would mean a block-header-only query path is clearly specified and does not expose raw transaction data when ad hoc queries are disabled.