Assert membership, ignore everyone role and limit results of role member-ids endpoint

1 files changed, 6 insertions, 0 deletions

diff --git a/src/api/routes/guilds/#guild_id/roles/#role_id/member-ids.ts b/src/api/routes/guilds/#guild_id/roles/#role_id/member-ids.ts

index 418e9365..7a774873 100644
--- a/src/api/routes/guilds/#guild_id/roles/#role_id/member-ids.ts
+++ b/src/api/routes/guilds/#guild_id/roles/#role_id/member-ids.ts
@@ -25,6 +25,11 @@ const router = Router({ mergeParams: true });
 router.get("/", route({}), async (req: Request, res: Response) => {
     const { guild_id, role_id } = req.params as { [key: string]: string };
 
+    await Member.IsInGuildOrFail(req.user_id, guild_id);
+
+    // Does not return results for the @everyone role
+    if (guild_id == role_id) return res.json([]);
+
     // TODO: Is this route really not paginated?
     const members = await Member.find({
         select: { id: true },
@@ -34,6 +39,7 @@ router.get("/", route({}), async (req: Request, res: Response) => {
             },
             guild_id,
         },
+        take: 100,
     });
 
     return res.json(members.map((x) => x.id));