8000 fix(oauth2): encode permissions as bitfield in authorization url by merlinfuchs · Pull Request #571 · disgoorg/disgo · GitHub
[go: up one dir, main page]

Skip to content

fix(oauth2): encode permissions as bitfield in authorization url - #571

Merged
topi314 merged 1 commit into
disgoorg:masterfrom
merlinfuchs:merlin/fix-oauth2-permissions-query
Aug 4, 2026
Merged

topi314 merged 1 commit into
disgoorg:masterfrom
merlinfuchs:merlin/fix-oauth2-permissions-query

Conversation

@merlinfuchs
Copy link
Copy Markdown
Contributor

Problem

AuthorizationURLParams.Permissions produces a broken authorize URL.

QueryValues.Encode renders every value with fmt.Sprint (discord/url.go:18), which picks up Permissions.String() (discord/permissions.go:189). That returns display names, not the bitfield:

values["permissions"] = params.Permissions // oauth2/client.go:94
?permissions=Send+Messages%2C+Video

Discord expects the raw integer, so any caller setting Permissions gets an invalid invite URL. MarshalJSON is unaffected — it already emits the numeric string; only the query-value path is wrong.

Fix

Pass the raw bitfield explicitly so the Stringer is bypassed:

values["permissions"] = uint64(params.Permissions)
?permissions=2560

Plus a regression test asserting the encoded value.

Permissions.String() returns display names, so fmt.Sprint in
QueryValues.Encode emitted "Send Messages, Video" instead of the raw
bitfield, producing an invalid authorize url.
@topi314
topi314 merged commit ba37603 into disgoorg:master Aug 4, 2026
4 checks passed
@topi314
topi314 commented Aug 4, 2026
Copy link
Copy Markdown
Member

good catch, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Development

Successfully merging this pull request may close these issues.

2 participants

0