DEV Community

TiltedLunar123
TiltedLunar123

Posted on

Your Discord cleanup tool has to check who wrote every single message

The mental model most people start with is simple. Find my messages, delete my messages. Discord does not hand you that, and the gap between what it hands you and what you actually want is where the whole problem lives.

What Discord gives you is a channel, not a person

When you pull history from a channel, you get the channel. Everyone in it. Search has an author filter and it helps, but a filtered search result is a starting point rather than a delete list. You are assembling a queue of things you intend to destroy, one API call at a time, and the queue is built from data that includes other people by default.

So the question every message has to answer before it enters that queue is not "does this match my filter". It is "did I write this".

The bulk endpoint is not for you

There is a bulk delete in the Discord API and it is tempting for about five minutes. It needs Manage Messages, and it refuses anything older than two weeks. Both of those tell you what it is for: a moderator clearing a spam flood that happened this morning. It was never built for a person who wants their own three years of messages gone.

That leaves one DELETE per message. Which means the authorship check does not happen once over a batch. It happens on every message, thousands of times, and it has to be cheap and it has to be right.

Compare IDs, not names

The check itself is boring, and the boring version is the correct one: compare the message author's ID against your own user ID. The snowflake, not the username, and not the display name.

Usernames change. Display names are per-server nicknames, so the same person reads differently in two places, and two people can look identical in a third. Anything human-readable is a description of an account rather than the account itself. The ID is the account.

The failure mode that actually costs you something

Skip the check and you get 403s. That is the harmless version. It is wasteful, because a rejected call still spends rate limit budget you would rather spend on real work, but nothing is lost.

The version that matters is the opposite. If you happen to hold Manage Messages in a server, because you moderate it or because somebody handed you a role years ago and forgot, then a delete call against another person's message does not fail. It succeeds. A tool you pointed at your own history has just removed somebody else's post, and the first you hear about it is the server audit log.

That is the line between a personal cleanup tool and a moderation tool, and the only thing holding the line is an ID comparison.

Things the check has to survive

A few cases look like yours and are not:

  • Webhook and bot messages carry an author that is not a normal user account, and some of them are posting on your behalf.
  • System messages, the joins and the pin notices, are not authored by you in the sense you mean, and they do not delete the same way.
  • History permissions let you read a lot of messages that were never yours. Being able to see it is unrelated to being able to delete it.
  • Replies and forwards put someone else's name in the preview above your message and your name in the preview above theirs. Read the message object, not what is rendered around it.

Check twice

Do it when the message matches, and do it again immediately before the delete call.

Those two moments are not the same moment. A large run takes minutes, sometimes much longer once rate limits are respected properly, and the queue you built at the start is a snapshot of a server that kept moving. Re-checking right before you destroy something costs one comparison against data you already hold.

In practice

This is the part of Clearline I spent the most time on, and it is invisible when it works. You connect, pick where to look, filter by text or date range or attachments, and then you get a review screen with the count and the actual messages before anything happens. Runs over a hundred ask again. You can save a copy as HTML, JSON or CSV first, which is worth doing, because delete is delete.

It only ever touches messages you wrote. Your token stays in browser memory and never leaves, there is no account and no server behind it, and the only permission it asks for is storage.

Free on both stores:

Source is MIT if you would rather read it than trust it: https://github.com/TiltedLunar123/clearline

One last thing worth saying plainly: automating a user account is against Discord's terms of service, and that is true regardless of the messages being your own. Export before you delete.

Top comments (0)