From 56dd6c87ee4ea9b9ae4ccbf16892ecacb52d6fba Mon Sep 17 00:00:00 2001
From: CyberL1 <cyber.hf18@gmail.com>
Date: Tue, 28 Oct 2025 17:36:41 +0100
Subject: [PATCH] fix: check for duplicated component IDs

---
 .../#interaction_token/callback.ts            | 23 ++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/src/api/routes/interactions/#interaction_id/#interaction_token/callback.ts b/src/api/routes/interactions/#interaction_id/#interaction_token/callback.ts
index 5f88f786..8a785ac7 100644
--- a/src/api/routes/interactions/#interaction_id/#interaction_token/callback.ts
+++ b/src/api/routes/interactions/#interaction_id/#interaction_token/callback.ts
@@ -16,7 +16,7 @@
   along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */
 
-import { InteractionCallbackSchema, InteractionCallbackType, MessageCreateSchema, MessageType } from "@spacebar/schemas";
+import { ButtonStyle, InteractionCallbackSchema, InteractionCallbackType, MessageComponentType, MessageCreateSchema, MessageType } from "@spacebar/schemas";
 import { route } from "@spacebar/api";
 import { Request, Response, Router } from "express";
 import { emitEvent, FieldErrors, InteractionSuccessEvent, Message, MessageCreateEvent, pendingInteractions, User } from "@spacebar/util";
@@ -27,6 +27,7 @@ router.post("/", route({}), async (req: Request, res: Response) => {
 	const body = req.body as InteractionCallbackSchema;
 
 	const errors: Record<string, { code?: string; message: string }> = {};
+	const knownComponentIds: string[] = [];
 
 	for (const row of body.data.components || []) {
 		if (!row.components) {
@@ -39,6 +40,26 @@ router.post("/", route({}), async (req: Request, res: Response) => {
 				message: `Must be between 1 and 5 in length.`,
 			};
 		}
+
+		for (const component of row.components) {
+			if (component.type == MessageComponentType.Button && component.style != ButtonStyle.Link) {
+				if (component.custom_id?.trim() === "") {
+					errors[`data.components[${body.data.components!.indexOf(row)}].components[${row.components.indexOf(component)}].custom_id`] = {
+						code: "BUTTON_COMPONENT_CUSTOM_ID_REQUIRED",
+						message: "A custom id required",
+					};
+				}
+
+				if (knownComponentIds.includes(component.custom_id!)) {
+					errors[`data.components[${body.data.components!.indexOf(row)}].components[${row.components.indexOf(component)}].custom_id`] = {
+						code: "COMPONENT_CUSTOM_ID_DUPLICATED",
+						message: "Component custom id cannot be duplicated",
+					};
+				} else {
+					knownComponentIds.push(component.custom_id!);
+				}
+			}
+		}
 	}
 
 	if (Object.keys(errors).length > 0) {