Add option for mods to review new accounts / invite only / private instances

[Nutomic]

• Add a new site columns as admin settings: review_new_accounts signup_questionnaire
  • Admins can edit this, or enable/disable it
• Add a column in the local_user table: pending.
• If the questionnaire is enabled, the text is shown in the signup form, together with a mandatory, multiline text input for the response
• The response is stored in a new table registration_application
  • columns: (local_user_id, answer, admin_id?, accepted? (True, false, null), deny_reason?)
  • Data from this table is shown to admins, so they can review new applications
  • Possible actions are accept or deny, and possibly a way to contact the user in case something is unclear (can be done simply by showing the email address).
  • Accepted and denied applications are hidden, but can still be browsed by other admins
  • Might be useful to store which admin approved/denied an application
  • Might be good to send a notification for new applications to admins. Possibly through a separate "moderation notifications" system, also for reports?
• If email verification is enabled, only show registration application to admins after the new user's email is verified
• While waiting for admin approval, the new user might be allowed to login, browse public content and vote. Or simply disallow login to keep things simple.

---

Mastodon has an option where people have to fill in a form with "why do you want to join". Mods then have to review and approve the text before the user can login. The question might also be customizable or even randomly choose between multiple options. But even the basic option should do a lot to prevent spammers from signing up.

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[dessalines]

Question, does this overlap at all with #187 ?

Is it necessary to have private communities (where only mods could comment / post / etc), if every new user goes through this invite process?

Seem like this might be a better idea, and not do private communities.

Or maybe this review process should exist for not only instances, but communities too?

[Nutomic]

I guess this could be a way to implement private communities as well (like people might just enter a community-spexific password in the form). So that means instances and communities would both need the option that people can join only after mod review.

[dessalines]

Now that I have email set up and working, this should be doable.

[dessalines]

I just wanted to add some thoughts on this based on the onboarding processes I've helped out with discord servers.

Sometimes, a simple form isn't enough: you might give the user a series of questions, but their answers might not be clear enough, so you have to ask clarifying questions. So most discords have an "onboarding / application" channel where you can have a back-and-forth chat, and once they pass, you give them a role to fully onboard them.

It would be nice to have this in lemmy, and there are many ways to do it. Maybe a pending column in the user role, which lets a user only see one newly created post, asking them to answer the form questions, and where they can have this back-and-forth.

[trymeouteh]

I prefer a email verification over moderator approval. However will it be possible to have both? The instance owner can choose to have

1. Email Verification
2. Moderator review

#691

[poVoq]

This idea is nice, but quite manual and time consuming. If there was an alternative sign-up that would allow linking of existing accounts via Oauth2 ( #489 ) or some sort of 2FA would be great. Ideally 2FA with XMPP ( https://blog.agayon.be/xmpp_auth_django.html )... one can dream right? :)

[Cam-B]

^ SAML or OIDC would be great.