APIAcceptMember chose between "advance a captcha-passer per group policy" and
"a moderator admits a member past admission review" using only the member's
current status. The directory bot is a group admin and called the same command,
so when a member was already pending review at the moment the bot's approval ran
(e.g. a prior approval already advanced them), the bot's captcha approval silently
ran the full-admit branch - admitting the member past admission review (visible to
everyone, able to send) in a plain p2p group with review still correctly enabled.
Add screeningApproval to APIAcceptMember: the directory bot passes True and can
only advance a pending-approval member per policy, never admit past review (a
no-op on a pending-review member); human moderators (screeningApproval=False, the
default; parser flag screening=on) keep the full behaviour. Backward compatible -
apps send /_accept member as a string command.
Also take the group lock in APIAcceptMember and the group-profile update commands
as concurrency hardening for the read-modify-write of member_admission.
Narasimha-sc
346f2b1748