Upcoming Breaking Change to Bot Permissions

[shaydewael]

🆕 This change previously noted that it would affect ATTACH_FILES and EMBED_LINKS, but that is no longer the case.

Change to Bot Permissions in Interactions and Webhooks

⚠️ This includes an upcoming breaking change for some bots

Starting on July 28, 2022 (in about a month), the way bot's permissions will be calculated for interaction responses and webhook execution will be updated for MENTION_EVERYONE and USE_EXTERNAL_EMOJIS. Instead of using the permissions calculated for @-everyone, these permissions will be calculated specifically for the bot (including any overwrites).

This change aligns with how bot's permissions are calculated when performing actions like posting a message to a channel. More details can be found in the change log entry.

📝 Change log entry: https://discord.com/developers/docs/change-log#changes-to-bot-permissions-for-interactions-and-webhooks

🧑‍💻 Updating your app
If your bot wants to use the MENTION_EVERYONE or USE_EXTERNAL_EMOJIS permissions when responding to interactions or executing a webhook, ensure that the bot was installed (or explicitly granted) with them.

Using the new app_permissions field will hopefully make it a bit easier to fetch the contextual permissions your bot has.

[advaith1]

This is a good and long-awaited change for the Use External Emojis permission.

However, as we have been discussing in DDevs #api, this change is a pain for permissions that previously were not checked for interactions and webhooks, such as Embed Links. One of the benefits of using interactions is that you don't need to worry about making sure the bot has embed permissions, since they are essential to most bots and if the server does not give everyone embed permissions, it is annoying to have to give the bot the permission, and it is also annoying to the dev to have to check if the bot has embed perms everywhere. Additionally, it's very weird to enforce these permission restrictions on webhooks, which are generally supposed to be standalone.

Please do not make this change for currently unchecked permissions like Embed Links.

[muddyfish]

+1, currently webhooks don't have embed links checked for at all, and in my bot it's a pretty widespread assumption that a webhook will be able to send embeds. Either having to disable this functionality or rework it to not will be a pain

[jagrosh]

As an alternative, maybe consider rich embeds in the payload sent by webhooks/bots not require the Embed Links permission at all:

1. I've always found it a bit strange that a permission specifically referencing unfurling links would apply to the content provided in the payload.
2. It's not great that sending a message with non-empty content and with an embed silently drops the embed but still allows the message to send.
3. Very rarely do bots actually change the output of their replies if they don't have the permission (I've never actually seen a bot do this, but I'm assuming that someone has done this before). Most bot developers that utilize embeds have them as the only form of output for some commands, requiring that either they get the permission anyway, or the server doesn't use the bot. I have never personally encountered someone who denied the Embed Links permission to a bot on purpose with the intent to prevent it from outputting certain commands.
4. Webhooks manually set up (like GitHub feeds and RSS hooks) don't do permissions checks once set up, and presumably a change like this would confuse some users whose GitHub webhooks are suddenly empty or stop completely.

[MinnDevelopment]

I've always found it a bit strange that a permission specifically referencing unfurling links would apply to the content provided in the payload.

The embeds can contain unfurled links in the case of embed images, which I believe is the primary goal of this permission. The reason to disable this permission, is to prevent users from sending images via links, in my experience at least.

However, if that is the goal of applying this permission here, then maybe those images could be just replaced by alt text instead.

[shaydewael]

Hey all—

I wanted to post an update that we're removing the ATTACH_FILES and EMBED_LINKS changes for this update based on feedback. The post above has ben edited to reflect that.