Add a POST /invites/{invite.code} code

[Pandapip1]

The Add Guild Member endpoint (PUT /guilds/{guild.id}/members/{user.id})) currently just adds a member to a server of which the bot is a member of. However, this limits the applications of this for slash command-only bots.

I suggest that a new endpoint be added (POST /invites/{invite.code}):

1. The Authorization header will be the OAuth2 bearer token.
2. The endpoint increases the usage count of that particular invite, as if the user manually clicked on it.
3. The endpoint adds the user to the guild (if it has guilds.join), group DM (if it has gdm.join), or the friend list (would require a new oauth scope) as if the user clicked on it.

Also, I suggest it do the following if the user has an open client (would open up a lot of fun possibilities):

1. It should navigate to the invite's channel.
2. If there's a call going on in a group DM or regular DM, it should add them to the call, but muted by default.
3. If the invite is a voice channel, it should automatically mute them.
4. If the invite has an event, if it is active and the user is a moderator, it should add them to the speakers (but muted by default). If the event is active but the user isn't a moderator, it should add them to the audience. Otherwise, it should add them to the audience and mark them as interested in the event.
5. If the invite doesn't have an event but targets a stage channel, it should always add the user to the audience.
6. If the invite has an activity, it should join the user to the activity.
7. If the invite is a school hub, instead of adding the user to it and navigating to it, it should prompt the user for an email with the @domain.xxx already filled in.

[erkinalp]

It should navigate to the invite's channel.
If there's a call going on in a group DM or regular DM, it should add them to the call, but muted by default.
If the invite has an event, if it is active and the user is a moderator, it should add them to the speakers (but muted by default). If the event is active but the user isn't a moderator, it should add them to the audience. Otherwise, it should add them to the audience and mark them as interested in the event.
If the invite has an activity, it should join the user to the activity.

Why would you want to remote control someone else's client?

[Pandapip1]

e.g. the activities bot

https://github.com/advaith1/activities

[AnotherCat]

Other than this being a bad idea as it opens up many more ways of abuse, I don't think this would work anyways? A bot that's authorized with only the applications.commands scope and not the bot scope cannot create invites, or get invites.
The only reason I can see is a different user providing the invite which seems like a very bad idea

[AnotherCat]

What use cases are you talking about if the bot cannot create or get invites?

[Pandapip1]

Slash-command-only bots

[AnotherCat]

😕 doesn't really answer my question
I'm curious to what the use cases are 😅

[Pandapip1]

The activities bot, for example, could move a user into a voice channel without having to even request any permissions.

[advaith1]

this doesn't make any sense. the bot would still need the Create Invite permission to create the invite, and it would be a pointless headache to get the users to authorize via oauth2, when currently they can skip all of that by just clicking a link to the invite, which is better than this request in every way. I would not make the bot use this, and this request still seems totally useless to me. literally just link to the discord.gg url directly.

[advaith1]

POST /invites/:code support was intentionally removed so people use Add Guild Member instead; Add Guild Member is abused enough and I don't think there is a point in adding accept invite support back. If you want to add a user to a server just put the bot in the server.

[erkinalp]

The better solution is to have actual user-specific invites, that the user can accept, refuse, or even block certain users from inviting them in the first place.

[Pandapip1]

IMHO bot users are inherently more abusable than being able to add users to a server.

[advaith1]

Bot users cannot modify users' accounts, which is considered the bigger issue.