Skip to content

Document re-checking Discord membership with the bot #120

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ryanbarlow97 merged 3 commits into from
Oct 10, 2026
Merged

Document re-checking Discord membership with the bot #120

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4538e43
docs: membership re-checked with the Discord bot before linking
ryanbarlow97 Oct 10, 2026
7328eff
docs: bot membership check pauses, reuse and fallback
ryanbarlow97 Oct 10, 2026
dd6caa7
docs: bounded wait and bot-refusal pause for membership checks
ryanbarlow97 Oct 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions projects/ProvinceSystem/docs/identity/auth-security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,27 @@ cookie, and sets an HttpOnly, SameSite=Lax session cookie. HTTPS uses the Secure
Cookie-authenticated writes enforce an origin check. `/account` exposes the
signed-in account and supports Minecraft linking and Patreon authorization.

Linking a Minecraft account needs TFMC server membership checked within the
last 15 minutes. Sign-in checks it. After that, the backend asks Discord with
`DISCORD_BOT_TOKEN` (`GET /guilds/{DISCORD_GUILD_ID}/members/{user}`) when an
unlinked player loads `/account` or starts a link, so a signed-in player never
has to sign in again just to link. "Unknown Member" or "Unknown User" means not
a member. One bot request runs at a time. A request that arrives mid-check
waits up to 4 seconds for that answer, and gives up asking if it takes longer.
A "not a member" answer is reused for 15 seconds without waiting. An unclear
answer keeps the old check, and that session is not asked again for a minute.
Some answers pause every check:

| Answer | Pause |
|--------|-------|
| Rate limit | Discord's `retry_after` |
| Timeout or 5xx | 30 seconds |
| 401, 403 or 404 Unknown Guild (the bot itself is refused) | 10 minutes |

`/account` returns `guild.can_recheck`. Unless it is true, Discord could not be
asked, and "I've joined, check again" falls back to a Discord sign-in.
Source: [`guild_check.py`](https://github.com/TF-Minecraft/ProvinceSystem/blob/main/backend/src/auth/guild_check.py).

## Microsoft link

Signed-in players can link Minecraft by signing in with Microsoft instead of
Expand Down