Discord

These endpoints were called by Discord bots and by the "link your Discord account" button of the dashboard: linking a Discord account, reading which resources a Discord member owns, granting a resource, and reading the public information of a Discord server.

All of them live under https://groupez.dev/api/v1/discord.

OverviewCopy Anchor Link

Common behaviourCopy Anchor Link

Middleware and rate limitCopy Anchor Link

The routes are mounted with the api middleware group: throttle:api, implicit model binding and Cloudflare proxy trust. There is no session and no CSRF check.

The api limiter allows 60 requests per minute, keyed by user id or, for anonymous callers (always the case here), by IP address. Above the limit the framework answers 429 Too Many Requests; with Accept: application/json the body is:

{
  "message": "Too Many Attempts."
}

Content type and errorsCopy Anchor Link

With Accept: application/json and APP_DEBUG off, an error raised by abort($code, $message) renders as {"message": "<message>"}; a 404 from a failed model binding renders as {"message": "No query results for model [App\\Models\\<Model>] <value>"}.

Route declaration orderCopy Anchor Link

Accesses payloadCopy Anchor Link

POST /discord and POST /discord/{user} return raw rows of the plugin_accesses table, read through the query builder:

No explicit ordering is applied (database order).

GET /api/v1/discord/authenticationCopy Anchor Link

OAuth2 redirect URI of the "link your Discord account" flow. Discord redirects the browser here with code and state; the endpoint exchanges the code for a token, reads the Discord profile and stores the link in discord_users, then redirects to the account page of the dashboard.

Path parameters: none.

Query parameters:

The authorization URL that leads here is built by User::getDiscordAuthLink(): https://discord.com/api/oauth2/authorize?client_id=...&redirect_uri=<this endpoint>&response_type=code&scope=identify&state=<user id>.

ResponsesCopy Anchor Link

Every outcome is a 302 redirect to https://groupez.dev/dashboard/account with a flashed message (in French):

ExampleCopy Anchor Link

curl -i "https://groupez.dev/api/v1/discord/authentication?code=<code>&state=7"

NotesCopy Anchor Link

• Meant to be reached by a browser coming back from Discord, not called by a bot.
• The check is missing('code') && missing('state'): only a request missing both is rejected as malformed. A request with only one of them goes on and fails at a later step.
• The groupez.dev account is identified by state alone, which is the plain user id. The request is not tied to the logged-in session.
• The flashed messages are written from the api route group, which has no StartSession middleware: the redirect flashes them into a session store that is never started nor saved, so read from the code they are most likely lost and never shown on the dashboard. This was not observed in production.
• On success, a user log entry ("Création de la liaison discord pour ...") is also written.
• On the current platform this address only redirects to the standard Discord sign-in flow (see v2).

POST /api/v1/discordCopy Anchor Link

Intended to return the accesses of a Discord member identified by the discord body field.

Path parameters: none.

Body parameters:

ResponsesCopy Anchor Link

200 OK — a bare array of accesses:

[
  {
    "id": 42,
    "user_id": 7,
    "plugin_id": 12,
    "payment_id": 1534,
    "created_at": "2021-10-15 12:00:00",
    "updated_at": "2021-10-15 12:00:00"
  }
]

400 Bad Request — the discord field is absent:

{
  "message": "Discord not found"
}

404 Not Found — no user has that Discord id:

{
  "message": "User not found"
}

ExampleCopy Anchor Link

curl -X POST https://groupez.dev/api/v1/discord \
  -H "Accept: application/json" \
  -d "discord=123456789012345678"

NotesCopy Anchor Link

• The check is has('discord'): an empty value is not rejected by the 400 (empty strings are converted to null by the global middleware).
• Revoked accesses do not exist on the legacy platform: every row of plugin_accesses for the user is returned.

POST /api/v1/discord/{user}Copy Anchor Link

Returns a Discord member (name, groupez.dev id, avatar) with all their accesses.

Path parameters:

Body parameters: none.

ResponsesCopy Anchor Link

200 OK

{
  "user": {
    "name": "Bobby",
    "id": 7,
    "avatar": "https://groupez.dev/storage/images/users/0/0/0/7.png"
  },
  "plugins": [
    {
      "id": 42,
      "user_id": 7,
      "plugin_id": 12,
      "payment_id": 1534,
      "created_at": "2021-10-15 12:00:00",
      "updated_at": "2021-10-15 12:00:00"
    }
  ]
}

404 Not Found — no discord_users row has that discord_id. With Accept: application/json, the body is the framework's model-not-found message:

{
  "message": "No query results for model [App\\Models\\DiscordUser] 123456789012345678"
}

ExampleCopy Anchor Link

curl -X POST https://groupez.dev/api/v1/discord/123456789012345678 \
  -H "Accept: application/json"

NotesCopy Anchor Link

• Served as text/html (see Content type and errors).
• The 404 message names the internal model class and echoes the requested id; rely on the status code.

POST /api/v1/discord/{user}/apply/{plugin}Copy Anchor Link

Grants a resource to a Discord member, protected by a shared secret.

Path parameters:

Body parameters:

ResponsesCopy Anchor Link

200 OK — the access was created:

{
  "message": "ok"
}

200 OK — the user already had this resource:

{
  "message": "ko"
}

403 Forbidden — custom_password does not match:

{
  "message": ""
}

404 Not Found — unknown Discord id or unknown resource (model binding). The {user} binding is resolved first, so an unknown Discord id names DiscordUser; with a known member and an unknown resource id the body names Plugin:

{
  "message": "No query results for model [App\\Models\\Plugin] 12"
}

422 Unprocessable Entity — custom_password missing (only with Accept: application/json; otherwise a 302 redirect back):

{
  "message": "The given data was invalid.",
  "errors": {
    "custom_password": [
      "The custom password field is required."
    ]
  }
}

ExampleCopy Anchor Link

curl -X POST https://groupez.dev/api/v1/discord/123456789012345678/apply/12 \
  -H "Accept: application/json" \
  -d "custom_password=<shared secret>"

NotesCopy Anchor Link

• Evaluation order: model bindings (404), then validation (422), then the secret (403), then the grant.
• The secret is compared with !== against env('DISCORD_PURCHASE_CONFIRM'), read directly from the environment. If the configuration is cached (config:cache), env() returns null outside config files and every call is refused with 403.
• The created row has no payment_id.
• Nothing is logged for a grant.
• Served as text/html (see Content type and errors).

GET /api/v1/discord/{serverId}Copy Anchor Link

Returns the public information of a Discord server (guild), read from its public widget.

Path parameters:

Query parameters: none.

ResponsesCopy Anchor Link

200 OK (application/json)

{
  "id": "987654321098765432",
  "name": "GroupeZ",
  "invite": "https://discord.gg/groupez"
}

id, name and invite are copied as-is from the widget's id, name and instant_invite.

404 Not Found — any failure: widget disabled, unknown guild, network error, or a widget without one of the three fields. The controller calls abort(404) without a message, so with Accept: application/json (and APP_DEBUG off) the body is:

{
  "message": ""
}

ExampleCopy Anchor Link

curl https://groupez.dev/api/v1/discord/987654321098765432 \
  -H "Accept: application/json"

NotesCopy Anchor Link

• The data comes from https://discord.com/api/guilds/{serverId}/widget.json; the guild widget must be enabled.
• Every call reaches Discord: there is no cache, and the Guzzle client is created without a timeout.
• serverId is not validated before being inserted into the Discord URL.
• invite can be null if Discord returns instant_invite: null; if the key is absent altogether, the endpoint answers 404.