From 51da17cf19d476483ee44e5f832d1ebdcd844f88 Mon Sep 17 00:00:00 2001
From: Rory& <root@rory.gay>
Date: Tue, 4 Aug 2026 13:11:01 +0200
Subject: [PATCH] Assert membership, ignore everyone role and limit results of
 role member-ids endpoint

---
 .../routes/guilds/#guild_id/roles/#role_id/member-ids.ts    | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/api/routes/guilds/#guild_id/roles/#role_id/member-ids.ts b/src/api/routes/guilds/#guild_id/roles/#role_id/member-ids.ts
index 418e93650..7a774873f 100644
--- a/src/api/routes/guilds/#guild_id/roles/#role_id/member-ids.ts
+++ b/src/api/routes/guilds/#guild_id/roles/#role_id/member-ids.ts
@@ -25,6 +25,11 @@ const router = Router({ mergeParams: true });
 router.get("/", route({}), async (req: Request, res: Response) => {
     const { guild_id, role_id } = req.params as { [key: string]: string };
 
+    await Member.IsInGuildOrFail(req.user_id, guild_id);
+
+    // Does not return results for the @everyone role
+    if (guild_id == role_id) return res.json([]);
+
     // TODO: Is this route really not paginated?
     const members = await Member.find({
         select: { id: true },
@@ -34,6 +39,7 @@ router.get("/", route({}), async (req: Request, res: Response) => {
             },
             guild_id,
         },
+        take: 100,
     });
 
     return res.json(members.map((x) => x.id));