Narasimha-sc 346f2b1748 core: directory bot must not admit members past admission review ...

APIAcceptMember chose between "advance a captcha-passer per group policy" and
"a moderator admits a member past admission review" using only the member's
current status. The directory bot is a group admin and called the same command,
so when a member was already pending review at the moment the bot's approval ran
(e.g. a prior approval already advanced them), the bot's captcha approval silently
ran the full-admit branch - admitting the member past admission review (visible to
everyone, able to send) in a plain p2p group with review still correctly enabled.

Add screeningApproval to APIAcceptMember: the directory bot passes True and can
only advance a pending-approval member per policy, never admit past review (a
no-op on a pending-review member); human moderators (screeningApproval=False, the
default; parser flag screening=on) keep the full behaviour. Backward compatible -
apps send /_accept member as a string command.

Also take the group lock in APIAcceptMember and the group-profile update commands
as concurrency hardening for the read-modify-write of member_admission.

2026-07-10 11:50:12 +00:00

..

BroadcastTests.hs

core, ui: support SimpleX names (#7045)

2026-07-03 12:51:52 +01:00

DirectoryTests.hs

core: directory bot must not admit members past admission review

2026-07-10 11:50:12 +00:00