Staff-generated invites bypass the must_approve_users requirement

[Simon_Manning]

@tobiaseigen

2. Do (1) but also add an extra “are you sure” warning step when admins create an invite link that can be used to immediately gain access to the site. Only on sites with approval required.
3. Change behavior so invite links created by admins respect the approval required setting just like invites by non-admins.

@Stephen

Is it safe to assume that if option 3 goes ahead there will be some option to match the existing behavior?

The training site we threw together would have been far harder to execute without the ability to bypass approvals for the groups who were invited en-masse.

It may be a much more complex change depending on how the guardian is involved in the different elements of this process but another option, which would also depend on 3, is:

4. Add a boolean property to the invites themselves for bypassing user approval. This property would be default off and only exposed in the create invite UI when must_approve_users is enabled

Edit: Actually looking again at the code David referenced, I guess the guardian isn’t involved at all in deciding whether an invited user needs to be approved. It looks like that part of it would be a straightforward replacement of invite.invited_by.staff? with something like invite.bypass_approval?