Allow message content in (private) threads created by the bot

[archer-321]

My application uses private threads for a ticket/mod-mail system that doesn't require users to open their DMs.
Currently, this forces my bot to use the privileged message content intent to allow users to download a transcript of their ticket.

My idea is to allow applications to receive messages in threads they created themselves without requiring privileged intents. The thread could then display a warning similar to the "Clyde can read all messages in this thread" mentioned in threads Clyde creates.

Since applications can already receive content for messages that mention the bot or are in DMs with the bot, this wouldn't affect users' privacy either. It could even improve privacy if this feature allows bots to work without the privileged intent to see all messages.
Like with threads started by Clyde, I believe it's obvious for a user that they're communicating with the application if they send a message in a (private) thread created by a bot interaction.

[AlmostSuspense]

I feel like it kinda defeats the point, it exists as an obtainable intent so legitimate usecases aren’t affected by the restriction around message content. Requiring privileged intents to work isn’t a bad thing on its own, or something to try to go around unless Discord doesn’t consider the usecase valid, but then they wouldn’t want to make the data non privileged anyway..

As for the argument that says it’s similar to DMs and mentions, as far as I know the reason those were exempted is because there’s a form of expectation from users that their messages will be seen by the bot because it’s directly targeted at it. I don’t think users go out of their way to check who is the creator of the thread when sending a message, as it’s much less obvious

[archer-321]

Thanks for the feedback!

I feel like it kinda defeats the point, it exists as an obtainable intent so legitimate usecases aren’t affected by the restriction around message content. Requiring privileged intents to work isn’t a bad thing on its own, or something to try to go around unless Discord doesn’t consider the usecase valid, but then they wouldn’t want to make the data non privileged anyway..

This proposal doesn't want to work around privileged intents. Its focus is to prevent having to request overkill privileges to maintain the principle of least privilege. In my use case, the app would have to request message content access for all channels the bot can access. With most server setups, that's the entire server. Especially considering that this approach is reusable wherever bots need non-interaction access to content (like submitting attachments for a modal; currently, there's no component to do this, so users would have to use slash commands or simple messages with attachments instead), this can reduce the number of apps that need message content access to read individual messages in a limited set of channels.

As for the argument that says it’s similar to DMs and mentions, as far as I know the reason those were exempted is because there’s a form of expectation from users that their messages will be seen by the bot because it’s directly targeted at it. I don’t think users go out of their way to check who is the creator of the thread when sending a message, as it’s much less obvious

I agree that applications should only have access to content where it's transparent for the user that they're "communicating with the application". However, a warning like the one in the screenshot above would make this obvious enough.

Alternatively, this could be limited to private threads. Those are less likely to contain a general discussion, as all users have to be invited manually. I.e., they act more as a per-server DM from a user's perspective, and it's evident that the user is communicating with the app if it creates the thread as a response to an interaction.

[AlmostSuspense]

The Least Privilege is a good point, but I’m not fully sure if giving more data to everyone is better (okay this isn’t really everyone since not all bots create threads) than giving even more data to a smaller number of bots… i guess Discord can figure that out with their analytics

Also side note but slash commands don’t need the intent, and receiving attachments via modals can be done with a link, or an attachment option in a slash command, so these wouldn’t impact the number of bots needing the intent

Although I disagree on the private threads part, because I feel like users would share more private information inside a private thread than a public place, since it’s well, private. But adding a warning in the UI would probably cover this enough so yeah

[ooliver1]

I suppose something like the Clyde can read all messages in this thread. would be ideal if that was done.

[ftilly]

It's quite obvious that any bot should naturally have access to messages within a thread it creates. The inconsistency of bots owning servers not being able to bypass such a simple intent is too big to ignore.