From 762d72e7ac451fb71b0dbb0fa2c7b9afea29bf40 Mon Sep 17 00:00:00 2001
From: Rory& <root@rory.gay>
Date: Wed, 8 Jul 2026 21:46:04 +0200
Subject: [PATCH] Fix webhook edit

---
 assets/openapi.json                           | Bin 1003782 -> 999965 bytes
 assets/schemas.json                           | Bin 445222 -> 444442 bytes
 .../#webhook_token/messages/#message_id.ts    |  25 +++++-------------
 .../uncategorised/WebhookExecuteSchema.ts     |   9 ++-----
 4 files changed, 9 insertions(+), 25 deletions(-)

diff --git a/assets/openapi.json b/assets/openapi.json
index e8acfd44947e9670dd2b6ea93c290d5890e1b3db..34fff09fe7d827a0a2a6b07194e1271d6201ff6c 100644
GIT binary patch
delta 265
zcmZo$WIMOTwxNZwg=q`(?Yq+hBAA_~PjF_Io~|&BEquB_7K`3?xj^QfjMM9MnA4`$
z*Roemb_h|NT+q%leL*!d%VdZ6wbT9U*$t-)2ytspKd_5SeY!v_yWDgKdFHI?|4o^-
zr=RCwQJk(YpV?z_!amRG8`zj7+P^(#24WT<W(8ul?cbiW^Q%vHU}0vTo?yeVY`Q@X
z$G7bT{v3x`r#l#MT5ew;#?i~TJ-?7+8zYABv?)9?+Z8-`Wf`{%xO41gf$OMaoGx&f
kLu|S}FNa!tr3nWRa{@6J5OV`D4-oSLG2iw|6aHQq01U}oq5uE@

delta 209
zcmbQ+V%xUJwxNZwg=q`(?Yq+#%wW-)9$?0*JN?3UX3fb3ES%Fn{9`^g`9r_b<b*>U
zaDnLwl^kr-^%7ZRP=&pIGaG^wO<vF?J3Zh6ALsN2KbE@b57OD9+WYS@12GE_vjQ>O
z_Wpb98+En^JmUS&vb{l)Lz88C{5vk`=^Ki<g|>&h;=RZQ5#27|!Lf~T`-jK8@yzW&
ZbwJDs#9Tnk4a7V^%nQVPK-K(nH2_-hR2l#P

diff --git a/assets/schemas.json b/assets/schemas.json
index 57dd9d6aeb7232590c827f7bda450d69b6c4c995..06555dbf0b3da15924908071d401f22da2c8ffe0 100644
GIT binary patch
delta 47
zcmZ2BO?uV@>4p}@7N#xCj)9X6c*Uom*~%m{U0?&7K>LIcW*}w(V%F^wLfEF20RWhc
B5cL26

delta 96
zcmbO=L3-IV>4p}@7N#xCj)9X-xJ|#3#;i2GU<TW=>3cO;q^CQuFt3}gugb_e{lNid
vF$i~GCbQP`f)+-(=@-mdIj0A#XO5dLFoD&p{ahe35VHU=>-KYjY(8ZG$wnif

diff --git a/src/api/routes/webhooks/#webhook_id/#webhook_token/messages/#message_id.ts b/src/api/routes/webhooks/#webhook_id/#webhook_token/messages/#message_id.ts
index 0902765cf..8d69512aa 100644
--- a/src/api/routes/webhooks/#webhook_id/#webhook_token/messages/#message_id.ts
+++ b/src/api/routes/webhooks/#webhook_id/#webhook_token/messages/#message_id.ts
@@ -20,21 +20,9 @@ import { Request, Response, Router } from "express";
 import { HTTPError } from "lambert-server/HTTPError";
 import multer from "multer";
 import { handleMessage, postHandleMessage, route } from "@spacebar/api/util";
-import { Attachment, Channel, Message, Webhook } from "@spacebar/database";
-import {
-    MessageCreateEvent,
-    MessageDeleteEvent,
-    MessageUpdateEvent,
-    Snowflake,
-    SpacebarApiErrors,
-    emitEvent,
-    getPermission,
-    getRights,
-    uploadFile,
-    NewUrlUserSignatureData,
-    DiscordApiErrors,
-} from "@spacebar/util";
-import { MessageCreateAttachment, MessageCreateCloudAttachment, MessageCreateSchema, MessageEditSchema, ChannelType } from "@spacebar/schemas";
+import { Channel, Message, Webhook } from "@spacebar/database";
+import { MessageDeleteEvent, MessageUpdateEvent, emitEvent, DiscordApiErrors } from "@spacebar/util";
+import { ChannelType, WebhookExecuteSchema } from "@spacebar/schemas";
 
 const router = Router({ mergeParams: true });
 // TODO: message content/embed string length limit
@@ -63,7 +51,7 @@ const messageUpload = multer({
 router.patch(
     "/",
     route({
-        requestBody: "MessageEditSchema",
+        requestBody: "WebhookExecuteSchema",
         responses: {
             200: {
                 body: "Message",
@@ -77,7 +65,7 @@ router.patch(
     }),
     async (req: Request, res: Response) => {
         const { webhook_id, webhook_token, message_id } = req.params as { [key: string]: string };
-        const body = req.body as MessageEditSchema;
+        const body = req.body as WebhookExecuteSchema;
 
         await assertValidWebhookAuth(webhook_id, webhook_token, message_id);
 
@@ -91,7 +79,8 @@ router.patch(
             // TODO: should message_reference be overridable?
             message_reference: message.message_reference,
             ...body,
-            author_id: message.author_id,
+            // author_id: message.author_id,
+            author_id: undefined, // skip rights check
             webhook_id: message.webhook_id,
             channel_id: message.channel_id,
             id: message_id,
diff --git a/src/schemas/uncategorised/WebhookExecuteSchema.ts b/src/schemas/uncategorised/WebhookExecuteSchema.ts
index 147a2d1a8..655a239c5 100644
--- a/src/schemas/uncategorised/WebhookExecuteSchema.ts
+++ b/src/schemas/uncategorised/WebhookExecuteSchema.ts
@@ -16,7 +16,7 @@
 	along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
-import { Embed } from "@spacebar/schemas";
+import { AllowedMentions, Embed } from "@spacebar/schemas";
 import { MessageCreateAttachment, PollCreationSchema } from "./MessageCreateSchema";
 
 export interface WebhookExecuteSchema {
@@ -25,12 +25,7 @@ export interface WebhookExecuteSchema {
     avatar_url?: string;
     tts?: boolean;
     embeds?: Embed[];
-    allowed_mentions?: {
-        parse?: string[];
-        roles?: string[];
-        users?: string[];
-        replied_user?: boolean;
-    };
+    allowed_mentions?: AllowedMentions;
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     components?: any[];
     file?: { filename: string };