Fix: arcgis allowed hosts

[cstirry]

Problem

The ArcGIS plugin validates Feature Service URLs against an allowlist. Only URLs hosted on *.arcgis.com or the configured portal_url domain are trusted. This may work for portals where the Hub API and Feature Services share the same domain, but breaks for cities where they don't.

For example, on DC's open data portal (opendata.dc.gov), most of the actual Feature Services are hosted on a separate domain (maps2.dcgis.dc.gov). This causes query_data to fail with:

Feature service URL host 'maps2.dcgis.dc.gov' is not within allowed domains (*.arcgis.com or opendata.dc.gov)

This has been observed in two ArcGIS deployments and without a fix the ArcGIS plugin is not production-ready:

• DC: maps2.dcgis.dc.gov
• Baltimore: opendata.baltimorecity.gov

---

Fix

Adds an optional allowed_hosts field to ArcGISPluginConfig. Any hostnames listed there are trusted in addition to *.arcgis.com and the portal domain. The opencontext configure wizard prompts for this value during ArcGIS setup, so config.yaml is written correctly without manual editing.

A more robust long-term solution may be to auto-detect additional domains from Feature Service URLs at configure time, but that requires more experimentation.

---

Current Files changed

plugins/arcgis/config_schema.py — adds allowed_hosts: List[str] field
plugins/arcgis/plugin.py — passes allowed_hosts to _validate_feature_url; updates method to check the list
cli/commands/configure.py — adds a prompt for extra trusted hosts in the ArcGIS wizard step

To configure for DC:
When running opencontext configure, enter maps2.dcgis.dc.gov at the new prompt. Assuming this is unique for all cities, or if not may want to automatically add this instead?

Screenshot Before

Screenshot After