Interaction protocol links

[Rodentman87]

What

When a bot specifies interaction://custom_id as a link's location, it should trigger an interaction with that id from the message similar to a message component when a user clicks the link.

Why

Currently, message components take up a lot of space on a message and are always underneath all the text and images. This would allow for interactable objects to be inline with text or even work on an embed title, author, or footer (see images below as an example). Two of these buttons could be condensed into interactable links inside the embed to save space on the message and make it look cleaner.

Alternatives considered

While current message components do work for most use cases, buttons take up a lot of space on a message and when you have both a message with info and buttons beneath that, it starts to take up a lot of screen real estate, especially for mobile users.

[Rodentman87]

To illustrate this a bit more I've made a little bit of a demo use case here for something like an FAQ or wiki bot.

wiki.mp4

[IllagerCaptain]

An issue with this is for things that display user input, a user could theoretically send a link for an interaction that they should not access. For example, let's say pickle_juice is an interaction custom ID that renames the server to "Pickle Juice", but is only sent when a command restricted to admins is used. A user could use, let's say, /poll description:[a](interaction://pickle_juice) and then click "a" in the poll, and boom, server renamed to "Pickle Juice". Although bots should check permissions as the button is pressed, this could still be a security vulnerability for some bots.

[splatterxl]

Maybe to combat this issue an application could register custom IDs that can be interpreted and executed in another property in the message payload in an allowed_mentions-like syntax?

e.g.:

{
  "content": "<interaction://test> (gets rendered and can be executed) <interaction://evil_custom_id> (isn't rendered and cannot be executed)",
  "allowed_interactions": ["test"]
}

[IllagerCaptain]

Maybe to combat this issue an application could register custom IDs that can be interpreted and executed in another property in the message payload in an allowed_mentions-like syntax?

e.g.:

{
  "content": "<interaction://test> (gets rendered and can be executed) <interaction://evil_custom_id> (isn't rendered and cannot be executed)",
  "allowed_interactions": ["test"]
}

Still, what if the bot developer is on vacation and doesn't have time to add this to the field? For this to work they would need to have at least a month of this feature released before adding the interaction protocol links.

Edit: Actually, they could make the protocol links not work unless explicitly specified in allowed_interactions. This would just skip all issues entirely.

Edit 2: If they do that though it would be confusing in the case of buttons though, so maybe rename it to allowed_protocol_interactions or similar.

{
  "content": "<interaction://test> (gets rendered and can be executed) <interaction://evil_custom_id> (isn't rendered and cannot be executed)",
  "allowed_protocol_interactions": ["test"]
},
{
  "content": "<interaction://test> (isn't rendered and can't be executed, as it is not explicitly defined) <interaction://evil_custom_id> (isn't rendered and cannot be executed, like normal)"
}

[lolsuffocate]

To be honest I think I'd be less comfortable clicking masked hyperlinks if they had the potential to actually action something within the bot/discord. Maybe if they were rendered differently it'd be decent, like mention-style or just a different colour or something.

[f1nlay]

As the components system has recently been overhauled, I think this is worth bringing up again - I think this has so much potential.

[quiradon]

a slash command mansion with presented parameters would already help a lot