From 3c4e9e6c536c64f803c7eb6643220452218bde82 Mon Sep 17 00:00:00 2001
From: Rory& <root@rory.gay>
Date: Wed, 8 Jul 2026 20:51:49 +0200
Subject: [PATCH] Unify webhook token parameter name

---
 assets/openapi.json                           | Bin 993666 -> 1003782 bytes
 .../{#token => #webhook_token}/github.ts      |   0
 .../{#token => #webhook_token}/index.ts       |  24 ++++++++----------
 src/api/util/handlers/Webhook.ts              |  11 +++-----
 4 files changed, 14 insertions(+), 21 deletions(-)
 rename src/api/routes/webhooks/#webhook_id/{#token => #webhook_token}/github.ts (100%)
 rename src/api/routes/webhooks/#webhook_id/{#token => #webhook_token}/index.ts (89%)

diff --git a/assets/openapi.json b/assets/openapi.json
index ba11b111b021de9aaf2cc9e7a6905e088bf074e0..e8acfd44947e9670dd2b6ea93c290d5890e1b3db 100644
GIT binary patch
delta 536
zcmZp=Y}2;LwxNZwg{g(Pg{6hHg{_5s3x^voZ+U7`Mt**Fd`W(GYTop^4ql1rYmW2k
zZr>oxk;^zep^lM#`<|1$KUlWQC~<f*P6v`4(*q|n%1nRY$a!HpuQHH(UWy}hyTVl7
zP{!#WcsMkt2b|#$n7-bWS895IHJ{M-ofmm8vXP>FKCi|$KhC*~(*>N_WTzi6Wa6Ff
zz|NJveZeiBb4(-{<RHqcz3m;xZKmlPTsdbEtuYKOOfK%=TR(k)54+%YZaxkU7HmPV
z{l5^$6E>_ez`&WoflX#QP|u9*31>Lk8K*n2Ftcy3RO4{PY6eJU$8-g24zcO_yd2^j
suqfLeug8&#RmXOqt!tUVTH32EIe?fGh`E568;E&;n0I@%B_I0-09|sfkpKVy

delta 259
zcmZo$WZQJvrlEzgg{g(Pg{6hHg{_5s3x^voTS<O)YF_R1hYFnQrZ4be7o0xlI2Xrq
zds7aU>4xQ8Z>De1;*gnc;LGVe{R0n&=JW^GxCORvxXRJSINgDTnSFbL4aa_j%Fyiv
zP8`l0xOLWdaI`~pUiIa0Wy7K}j2Gf0{q)R|jMAj(g6*8T+Y455<l?q5f_b{YVGgnO
a{|OvG%n8I?K+FxqJV4C5{eJ=<`v(BgL0-}T

diff --git a/src/api/routes/webhooks/#webhook_id/#token/github.ts b/src/api/routes/webhooks/#webhook_id/#webhook_token/github.ts
similarity index 100%
rename from src/api/routes/webhooks/#webhook_id/#token/github.ts
rename to src/api/routes/webhooks/#webhook_id/#webhook_token/github.ts
diff --git a/src/api/routes/webhooks/#webhook_id/#token/index.ts b/src/api/routes/webhooks/#webhook_id/#webhook_token/index.ts
similarity index 89%
rename from src/api/routes/webhooks/#webhook_id/#token/index.ts
rename to src/api/routes/webhooks/#webhook_id/#webhook_token/index.ts
index a832c8a21..886236ea5 100644
--- a/src/api/routes/webhooks/#webhook_id/#token/index.ts
+++ b/src/api/routes/webhooks/#webhook_id/#webhook_token/index.ts
@@ -24,7 +24,6 @@ import { Webhook, Message } from "@spacebar/database";
 import { Config, DiscordApiErrors, emitEvent, handleFile, ValidateName, WebhooksUpdateEvent } from "@spacebar/util";
 import { executeWebhook } from "@spacebar/api/util/handlers/Webhook";
 import { WebhookUpdateSchema } from "@spacebar/schemas";
-import { FindOptionsWhere } from "typeorm";
 
 const router = Router({ mergeParams: true });
 
@@ -40,7 +39,7 @@ router.get(
         },
     }),
     async (req: Request, res: Response) => {
-        const { webhook_id, token } = req.params as { [key: string]: string };
+        const { webhook_id, webhook_token } = req.params as { [key: string]: string };
         const webhook = await Webhook.findOne({
             where: {
                 id: webhook_id,
@@ -52,7 +51,7 @@ router.get(
             throw DiscordApiErrors.UNKNOWN_WEBHOOK;
         }
 
-        if (webhook.token !== token) {
+        if (webhook.token !== webhook_token) {
             throw DiscordApiErrors.INVALID_WEBHOOK_TOKEN_PROVIDED;
         }
 
@@ -123,7 +122,7 @@ router.delete(
         },
     }),
     async (req: Request, res: Response) => {
-        const { webhook_id, token } = req.params as { [key: string]: string };
+        const { webhook_id, webhook_token } = req.params as { [key: string]: string };
 
         const webhook = await Webhook.findOne({
             where: {
@@ -132,13 +131,9 @@ router.delete(
             relations: { channel: true, guild: true, application: true },
         });
 
-        if (!webhook) {
-            throw DiscordApiErrors.UNKNOWN_WEBHOOK;
-        }
+        if (!webhook) throw DiscordApiErrors.UNKNOWN_WEBHOOK;
+        if (webhook.token !== webhook_token) throw DiscordApiErrors.INVALID_WEBHOOK_TOKEN_PROVIDED;
 
-        if (webhook.token !== token) {
-            throw DiscordApiErrors.INVALID_WEBHOOK_TOKEN_PROVIDED;
-        }
         const channel_id = webhook.channel_id;
         await Message.delete({ channel_id, webhook_id });
         await Webhook.delete({ id: webhook_id });
@@ -172,14 +167,17 @@ router.patch(
         },
     }),
     async (req: Request, res: Response) => {
-        // noinspection JSUnusedLocalSymbols - TODO: shouldnt token be checked?
-        const { webhook_id, token } = req.params as { [key: string]: string };
+        const { webhook_id, webhook_token } = req.params as { [key: string]: string };
         const body = req.body as WebhookUpdateSchema;
 
-        const webhook = await Webhook.findOneOrFail({
+        const webhook = await Webhook.findOne({
             where: { id: webhook_id },
             relations: { user: true, channel: true, source_channel: true, guild: true, source_guild: true, application: true },
         });
+
+        if (!webhook) throw DiscordApiErrors.UNKNOWN_WEBHOOK;
+        if (webhook.token != webhook_token) throw DiscordApiErrors.INVALID_WEBHOOK_TOKEN_PROVIDED;
+
         const channel_id = webhook.channel_id;
         if (!body.name && !body.avatar) {
             throw new HTTPError("Empty webhook updates are not allowed", 50006);
diff --git a/src/api/util/handlers/Webhook.ts b/src/api/util/handlers/Webhook.ts
index 1f4f60a73..3e1114ab2 100644
--- a/src/api/util/handlers/Webhook.ts
+++ b/src/api/util/handlers/Webhook.ts
@@ -28,7 +28,7 @@ export const executeWebhook = async (req: Request, res: Response) => {
     const body = req.body as WebhookExecuteSchema;
     const messageId = Snowflake.generate();
 
-    const { webhook_id, token } = req.params as { [key: string]: string };
+    const { webhook_id, webhook_token } = req.params as { [key: string]: string };
 
     const webhook = await Webhook.findOne({
         where: {
@@ -37,13 +37,8 @@ export const executeWebhook = async (req: Request, res: Response) => {
         relations: { channel: true, guild: true, application: true },
     });
 
-    if (!webhook) {
-        throw DiscordApiErrors.UNKNOWN_WEBHOOK;
-    }
-
-    if (webhook.token !== token) {
-        throw DiscordApiErrors.INVALID_WEBHOOK_TOKEN_PROVIDED;
-    }
+    if (!webhook) throw DiscordApiErrors.UNKNOWN_WEBHOOK;
+    if (webhook.token !== webhook_token) throw DiscordApiErrors.INVALID_WEBHOOK_TOKEN_PROVIDED;
 
     if (body.username) {
         ValidateName(body.username);