The `InteractionClient::update_command_permissions()` method gives an HTTP 403 Error with message `"Bots cannot use this endpoint"`

[OrangeTacTics]

What behavior are you experiencing?

I have the code:

        interaction_client.update_command_permissions(                                                     
            guild_id,                                                                                      
            command_id,                                                                           
            &permissions,                                                                                  
        )   
            .unwrap()                                                                                      
            .exec()                                                                                        
            .await?; 

When I run it, I am getting back the following error:

Error: Error { source: None, kind: Response { body: [123, 34, 109, 101, 115, 115, 97, 103, 101, 34, 58, 32, 34, 66, 111, 116, 115, 32, 99, 97, 110, 110, 111, 116, 32, 117, 115, 101, 32, 116, 104, 105, 115, 32, 101, 110, 100, 112, 111, 105, 110, 116, 34, 44, 32, 34, 99, 111, 100, 101, 34, 58, 32, 50, 48, 48, 48, 49, 125], error: General(GeneralApiError { code: 20001, message: "Bots cannot use this endpoint" }), status: StatusCode(403) } }

What are you running your code on?

I'm running on Ubuntu 20.04.4 LTS. This is on Twilight version 0.11.0, which I just migrated to.

How can we reproduce the issue?

The code above should provide a basis for reproduction. The snippet came from a CLI-based tool which simply creates a client, then an interaction client from that. I create several commands using create_guild_command() and then attempt to set the permissions.

The Discord Slash Command Permissions API apparently changed in the last version. Twilight version 0.11.0 looked to move to this new API. But I'm wondering if there is a bug in this release.

If you need additional help reproducing, I can attempt to provide a minimal working example.

[vilgotf]

The endpoint requires a bearer token https://discord.com/developers/docs/interactions/application-commands#edit-application-command-permissions, see https://discord.com/developers/docs/interactions/application-commands#edit-application-command-permissions for more info on Discord's authentication methods. Bearer tokens are ~supported by Twilight (https://api.twilight.rs/twilight_http/client/struct.Client.html#oauth), but they don't have great documentation and some endpoints are missing, see #1643

[itohatweb]

Since this endpoint is also heavily used by bots (I believe?) should we add a way of setting a custom token for this method?

[vilgotf]

I think we should strive for Clients being thin enough that it's fine to create a new client in such cases, or to store multiple clients at runtime. Updating the token at runtime is also infeasible it would encourage wrapping Client in a RwLock or Mutex.