From dcfd91035e3da42abf5f32d8d86a35219225b3d4 Mon Sep 17 00:00:00 2001
From: Rory& <root@rory.gay>
Date: Tue, 4 Aug 2026 13:28:48 +0200
Subject: [PATCH] Assert that requesting user is a member of (group/) DM before
 allowing them to add members

---
 src/api/routes/channels/#channel_id/recipients.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/api/routes/channels/#channel_id/recipients.ts b/src/api/routes/channels/#channel_id/recipients.ts
index 72ac12f7f..78cce3c72 100644
--- a/src/api/routes/channels/#channel_id/recipients.ts
+++ b/src/api/routes/channels/#channel_id/recipients.ts
@@ -39,6 +39,10 @@ router.put(
             relations: { recipients: true },
         });
 
+        if (!channel.recipients || channel.recipients.length == 0 || channel.recipients.filter((r) => r.user_id == req.user_id).length == 0) {
+            throw DiscordApiErrors.UNKNOWN_CHANNEL; // TODO: is this the right error
+        }
+
         if (channel.type !== ChannelType.GROUP_DM) {
             const recipients = [...new Set([...(channel.recipients?.map((r) => r.user_id) || []), user_id])];