# Staff-generated invites bypass the must\_approve\_users requirement

**URL:** https://meta.discourse.org/t/staff-generated-invites-bypass-the-must-approve-users-requirement/228199
**Category:** Feature
**Tags:** invites
**Created:** [May 26, 2022, 8:37pm UTC](https://meta.discourse.org/t/staff-generated-invites-bypass-the-must-approve-users-requirement/228199 "2022-05-26T20:37:13Z")
**Posts on this page:** 1
**Showing post:** 21

<div class="post-metadata">

### Author: ![Simon\_Manning](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon_manning/32/198596_2.png) [@Simon\_Manning](https://meta.discourse.org/u/Simon_Manning)
#### Post date: [June 1, 2022, 10:42pm UTC](https://meta.discourse.org/t/staff-generated-invites-bypass-the-must-approve-users-requirement/228199/21 "2022-06-01T22:42:35Z")

</div>

> [@tobiaseigen](#):
>
> 1. Do (1) but also add an extra “are you sure” warning step when admins create an invite link that can be used to immediately gain access to the site. Only on sites with approval required.
> 2. Change behavior so invite links created by admins respect the approval required setting just like invites by non-admins.

> [@Stephen](#):
>
> Is it safe to assume that if option 3 goes ahead there will be some option to match the existing behavior?
> 
> The training site we threw together would have been far harder to execute without the ability to bypass approvals for the groups who were invited en-masse.

It may be a much more complex change depending on how the guardian is involved in the different elements of this process but another option, which would also depend on 3, is:

1. Add a boolean property to the invites themselves for bypassing user approval. This property would be default off and only exposed in the create invite UI when `must_approve_users` is enabled

**Edit** : Actually looking again at the code David referenced, I guess the guardian isn’t involved at all in deciding whether an invited user needs to be approved. It looks like that part of it would be a straightforward replacement of `invite.invited_by.staff?` with something like `invite.bypass_approval?`

---

_[View the full topic](https://meta.discourse.org/t/staff-generated-invites-bypass-the-must-approve-users-requirement/228199)._