From 2f2d88dcfc76bac6815d60fa9915b8e797853292 Mon Sep 17 00:00:00 2001
From: Mar0xy <marie@kaifa.ch>
Date: Wed, 18 Oct 2023 02:41:36 +0200
Subject: [PATCH 1/7] add: Require Approval for Signup

---
 .../migration/1697580470000-approvalSignup.js |  22 ++++
 packages/backend/src/core/SignupService.ts    |  10 +-
 .../src/core/entities/UserEntityService.ts    |   2 +
 packages/backend/src/models/Meta.ts           |   5 +
 packages/backend/src/models/User.ts           |  10 ++
 packages/backend/src/models/UserPending.ts    |   5 +
 .../backend/src/server/api/EndpointsModule.ts |   4 +
 .../src/server/api/SigninApiService.ts        |  20 +++
 .../src/server/api/SignupApiService.ts        |  32 +++++
 packages/backend/src/server/api/endpoints.ts  |   2 +
 .../api/endpoints/admin/approve-user.ts       |  61 +++++++++
 .../src/server/api/endpoints/admin/meta.ts    |   5 +
 .../server/api/endpoints/admin/show-user.ts   |   2 +
 .../server/api/endpoints/admin/update-meta.ts |   5 +
 .../backend/src/server/api/endpoints/meta.ts  |   5 +
 packages/backend/src/types.ts                 |   6 +
 .../src/components/MkSignupDialog.form.vue    |  14 ++
 .../src/components/MkSignupDialog.vue         |   5 +-
 .../src/components/MkVisitorDashboard.vue     |   3 +
 packages/frontend/src/pages/admin-user.vue    | 121 ++++++++++++++----
 .../frontend/src/pages/admin/moderation.vue   |   7 +
 .../src/pages/admin/modlog.ModLog.vue         |   6 +-
 packages/misskey-js/src/consts.ts             |   6 +
 packages/misskey-js/src/entities.ts           |   1 +
 24 files changed, 330 insertions(+), 29 deletions(-)
 create mode 100644 packages/backend/migration/1697580470000-approvalSignup.js
 create mode 100644 packages/backend/src/server/api/endpoints/admin/approve-user.ts

diff --git a/packages/backend/migration/1697580470000-approvalSignup.js b/packages/backend/migration/1697580470000-approvalSignup.js
new file mode 100644
index 000000000..c5f8255d4
--- /dev/null
+++ b/packages/backend/migration/1697580470000-approvalSignup.js
@@ -0,0 +1,22 @@
+/*
+ * SPDX-FileCopyrightText: syuilo and other misskey contributors
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+export class ApprovalSignup1697580470000 {
+    name = 'ApprovalSignup1697580470000'
+
+    async up(queryRunner) {
+        await queryRunner.query(`ALTER TABLE "meta" ADD "approvalRequiredForSignup" boolean DEFAULT false NOT NULL`);
+        await queryRunner.query(`ALTER TABLE "user" ADD "approved" boolean DEFAULT false NOT NULL`);
+        await queryRunner.query(`ALTER TABLE "user" ADD "signupReason" character varying(1000) NULL`);
+        await queryRunner.query(`ALTER TABLE "user_pending" ADD "reason" character varying(1000) NULL`);
+    }
+
+    async down(queryRunner) {
+        await queryRunner.query(`ALTER TABLE "meta" DROP COLUMN "approvalRequiredForSignup"`);
+        await queryRunner.query(`ALTER TABLE "user" DROP COLUMN "approved"`);
+        await queryRunner.query(`ALTER TABLE "user" DROP COLUMN "signupReason"`);
+        await queryRunner.query(`ALTER TABLE "user_pending" DROP COLUMN "reason"`);
+    }
+}
diff --git a/packages/backend/src/core/SignupService.ts b/packages/backend/src/core/SignupService.ts
index 359957cd5..32e3dee93 100644
--- a/packages/backend/src/core/SignupService.ts
+++ b/packages/backend/src/core/SignupService.ts
@@ -48,10 +48,12 @@ export class SignupService {
 		password?: string | null;
 		passwordHash?: MiUserProfile['password'] | null;
 		host?: string | null;
+		reason?: string | null;
 		ignorePreservedUsernames?: boolean;
 	}) {
-		const { username, password, passwordHash, host } = opts;
+		const { username, password, passwordHash, host, reason } = opts;
 		let hash = passwordHash;
+		const instance = await this.metaService.fetch(true);
 
 		// Validate username
 		if (!this.userEntityService.validateLocalUsername(username)) {
@@ -85,7 +87,6 @@ export class SignupService {
 		const isTheFirstUser = (await this.usersRepository.countBy({ host: IsNull() })) === 0;
 
 		if (!opts.ignorePreservedUsernames && !isTheFirstUser) {
-			const instance = await this.metaService.fetch(true);
 			const isPreserved = instance.preservedUsernames.map(x => x.toLowerCase()).includes(username.toLowerCase());
 			if (isPreserved) {
 				throw new Error('USED_USERNAME');
@@ -110,6 +111,9 @@ export class SignupService {
 			));
 
 		let account!: MiUser;
+		let defaultApproval = false;
+
+		if (!instance.approvalRequiredForSignup) defaultApproval = true;
 
 		// Start transaction
 		await this.db.transaction(async transactionalEntityManager => {
@@ -127,6 +131,8 @@ export class SignupService {
 				host: this.utilityService.toPunyNullable(host),
 				token: secret,
 				isRoot: isTheFirstUser,
+				approved: defaultApproval,
+				signupReason: reason,
 			}));
 
 			await transactionalEntityManager.save(new MiUserKeypair({
diff --git a/packages/backend/src/core/entities/UserEntityService.ts b/packages/backend/src/core/entities/UserEntityService.ts
index 3de95129f..a24319c45 100644
--- a/packages/backend/src/core/entities/UserEntityService.ts
+++ b/packages/backend/src/core/entities/UserEntityService.ts
@@ -489,6 +489,8 @@ export class UserEntityService implements OnModuleInit {
 			...(opts.includeSecrets ? {
 				email: profile!.email,
 				emailVerified: profile!.emailVerified,
+				approved: user.approved,
+				signupReason: user.signupReason,
 				securityKeysList: profile!.twoFactorEnabled
 					? this.userSecurityKeysRepository.find({
 						where: {
diff --git a/packages/backend/src/models/Meta.ts b/packages/backend/src/models/Meta.ts
index e4abe42de..e34c51a69 100644
--- a/packages/backend/src/models/Meta.ts
+++ b/packages/backend/src/models/Meta.ts
@@ -174,6 +174,11 @@ export class MiMeta {
 	})
 	public emailRequiredForSignup: boolean;
 
+	@Column('boolean', {
+		default: false,
+	})
+	public approvalRequiredForSignup: boolean;
+
 	@Column('boolean', {
 		default: false,
 	})
diff --git a/packages/backend/src/models/User.ts b/packages/backend/src/models/User.ts
index 4704c607a..81b46d543 100644
--- a/packages/backend/src/models/User.ts
+++ b/packages/backend/src/models/User.ts
@@ -272,6 +272,16 @@ export class MiUser {
 	})
 	public token: string | null;
 
+	@Column('boolean', {
+		default: false,
+	})
+	public approved: boolean;
+
+	@Column('varchar', {
+		length: 1000, nullable: true,
+	})
+	public signupReason: string | null;
+
 	constructor(data: Partial<MiUser>) {
 		if (data == null) return;
 
diff --git a/packages/backend/src/models/UserPending.ts b/packages/backend/src/models/UserPending.ts
index 8b1f8f617..6b26bd228 100644
--- a/packages/backend/src/models/UserPending.ts
+++ b/packages/backend/src/models/UserPending.ts
@@ -31,4 +31,9 @@ export class MiUserPending {
 		length: 128,
 	})
 	public password: string;
+
+	@Column('varchar', {
+		length: 1000,
+	})
+	public reason: string;
 }
diff --git a/packages/backend/src/server/api/EndpointsModule.ts b/packages/backend/src/server/api/EndpointsModule.ts
index 9aa75b0af..079040b85 100644
--- a/packages/backend/src/server/api/EndpointsModule.ts
+++ b/packages/backend/src/server/api/EndpointsModule.ts
@@ -62,6 +62,7 @@ import * as ep___admin_showModerationLogs from './endpoints/admin/show-moderatio
 import * as ep___admin_showUser from './endpoints/admin/show-user.js';
 import * as ep___admin_showUsers from './endpoints/admin/show-users.js';
 import * as ep___admin_suspendUser from './endpoints/admin/suspend-user.js';
+import * as ep___admin_approveUser from './endpoints/admin/approve-user.js';
 import * as ep___admin_unsuspendUser from './endpoints/admin/unsuspend-user.js';
 import * as ep___admin_updateMeta from './endpoints/admin/update-meta.js';
 import * as ep___admin_deleteAccount from './endpoints/admin/delete-account.js';
@@ -415,6 +416,7 @@ const $admin_showModerationLogs: Provider = { provide: 'ep:admin/show-moderation
 const $admin_showUser: Provider = { provide: 'ep:admin/show-user', useClass: ep___admin_showUser.default };
 const $admin_showUsers: Provider = { provide: 'ep:admin/show-users', useClass: ep___admin_showUsers.default };
 const $admin_suspendUser: Provider = { provide: 'ep:admin/suspend-user', useClass: ep___admin_suspendUser.default };
+const $admin_approveUser: Provider = { provide: 'ep:admin/approve-user', useClass: ep___admin_approveUser.default };
 const $admin_unsuspendUser: Provider = { provide: 'ep:admin/unsuspend-user', useClass: ep___admin_unsuspendUser.default };
 const $admin_updateMeta: Provider = { provide: 'ep:admin/update-meta', useClass: ep___admin_updateMeta.default };
 const $admin_deleteAccount: Provider = { provide: 'ep:admin/delete-account', useClass: ep___admin_deleteAccount.default };
@@ -772,6 +774,7 @@ const $sponsors: Provider = { provide: 'ep:sponsors', useClass: ep___sponsors.de
 		$admin_showUser,
 		$admin_showUsers,
 		$admin_suspendUser,
+		$admin_approveUser,
 		$admin_unsuspendUser,
 		$admin_updateMeta,
 		$admin_deleteAccount,
@@ -1123,6 +1126,7 @@ const $sponsors: Provider = { provide: 'ep:sponsors', useClass: ep___sponsors.de
 		$admin_showUser,
 		$admin_showUsers,
 		$admin_suspendUser,
+		$admin_approveUser,
 		$admin_unsuspendUser,
 		$admin_updateMeta,
 		$admin_deleteAccount,
diff --git a/packages/backend/src/server/api/SigninApiService.ts b/packages/backend/src/server/api/SigninApiService.ts
index 2d4de605e..fd247df22 100644
--- a/packages/backend/src/server/api/SigninApiService.ts
+++ b/packages/backend/src/server/api/SigninApiService.ts
@@ -21,6 +21,7 @@ import { IdService } from '@/core/IdService.js';
 import { bindThis } from '@/decorators.js';
 import { WebAuthnService } from '@/core/WebAuthnService.js';
 import { UserAuthService } from '@/core/UserAuthService.js';
+import { MetaService } from '@/core/MetaService.js';
 import { RateLimiterService } from './RateLimiterService.js';
 import { SigninService } from './SigninService.js';
 import type { AuthenticationResponseJSON } from '@simplewebauthn/typescript-types';
@@ -46,6 +47,7 @@ export class SigninApiService {
 		private signinService: SigninService,
 		private userAuthService: UserAuthService,
 		private webAuthnService: WebAuthnService,
+		private metaService: MetaService,
 	) {
 	}
 
@@ -64,6 +66,8 @@ export class SigninApiService {
 		reply.header('Access-Control-Allow-Origin', this.config.url);
 		reply.header('Access-Control-Allow-Credentials', 'true');
 
+		const instance = await this.metaService.fetch(true);
+
 		const body = request.body;
 		const username = body['username'];
 		const password = body['password'];
@@ -123,6 +127,17 @@ export class SigninApiService {
 
 		const profile = await this.userProfilesRepository.findOneByOrFail({ userId: user.id });
 
+		if (!user.approved && instance.approvalRequiredForSignup) {
+			reply.code(403);
+			return {
+				error: {
+					message: 'The account has not been approved by an admin yet. Try again later.',
+					code: 'NOT_APPROVED',
+					id: '22d05606-fbcf-421a-a2db-b32241faft1b',
+				},
+			};
+		}
+
 		// Compare password
 		const same = await argon2.verify(profile.password!, password) || bcrypt.compareSync(password, profile.password!);
 
@@ -147,6 +162,8 @@ export class SigninApiService {
 						password: newHash
 					});
 				}
+				if (!instance.approvalRequiredForSignup && !user.approved) this.usersRepository.update(user.id, { approved: true });
+
 				return this.signinService.signin(request, reply, user);
 			} else {
 				return await fail(403, {
@@ -176,6 +193,8 @@ export class SigninApiService {
 				});
 			}
 
+			if (!instance.approvalRequiredForSignup && !user.approved) this.usersRepository.update(user.id, { approved: true });
+
 			return this.signinService.signin(request, reply, user);
 		} else if (body.credential) {
 			if (!same && !profile.usePasswordLessLogin) {
@@ -187,6 +206,7 @@ export class SigninApiService {
 			const authorized = await this.webAuthnService.verifyAuthentication(user.id, body.credential);
 
 			if (authorized) {
+				if (!instance.approvalRequiredForSignup && !user.approved) this.usersRepository.update(user.id, { approved: true });
 				return this.signinService.signin(request, reply, user);
 			} else {
 				return await fail(403, {
diff --git a/packages/backend/src/server/api/SignupApiService.ts b/packages/backend/src/server/api/SignupApiService.ts
index 02e5cd4fd..53f770e17 100644
--- a/packages/backend/src/server/api/SignupApiService.ts
+++ b/packages/backend/src/server/api/SignupApiService.ts
@@ -22,6 +22,7 @@ import { bindThis } from '@/decorators.js';
 import { L_CHARS, secureRndstr } from '@/misc/secure-rndstr.js';
 import { SigninService } from './SigninService.js';
 import type { FastifyRequest, FastifyReply } from 'fastify';
+import instance from './endpoints/charts/instance.js';
 
 @Injectable()
 export class SignupApiService {
@@ -63,6 +64,7 @@ export class SignupApiService {
 				host?: string;
 				invitationCode?: string;
 				emailAddress?: string;
+				reason?: string;
 				'hcaptcha-response'?: string;
 				'g-recaptcha-response'?: string;
 				'turnstile-response'?: string;
@@ -100,6 +102,7 @@ export class SignupApiService {
 		const password = body['password'];
 		const host: string | null = process.env.NODE_ENV === 'test' ? (body['host'] ?? null) : null;
 		const invitationCode = body['invitationCode'];
+		const reason = body['reason'];
 		const emailAddress = body['emailAddress'];
 
 		if (instance.emailRequiredForSignup) {
@@ -115,6 +118,13 @@ export class SignupApiService {
 			}
 		}
 
+		if (instance.approvalRequiredForSignup) {
+			if (reason == null || typeof reason !== 'string') {
+				reply.code(400);
+				return;
+			}
+		}
+
 		let ticket: MiRegistrationTicket | null = null;
 
 		if (instance.disableRegistration) {
@@ -170,6 +180,7 @@ export class SignupApiService {
 				email: emailAddress!,
 				username: username,
 				password: hash,
+				reason: reason,
 			}).then(x => this.userPendingsRepository.findOneByOrFail(x.identifiers[0]));
 
 			const link = `${this.config.url}/signup-complete/${code}`;
@@ -185,6 +196,19 @@ export class SignupApiService {
 				});
 			}
 
+			reply.code(204);
+			return;
+		} else if (instance.approvalRequiredForSignup) {
+			await this.signupService.signup({
+				username, password, host, reason,
+			});
+
+			if (emailAddress) {
+				this.emailService.sendEmail(emailAddress, 'Approval pending',
+					'Congratulations! Your account is now pending approval. You will get notified when you have been accepted.',
+					'Congratulations! Your account is now pending approval. You will get notified when you have been accepted.');
+			}
+
 			reply.code(204);
 			return;
 		} else {
@@ -222,12 +246,15 @@ export class SignupApiService {
 
 		const code = body['code'];
 
+		const instance = await this.metaService.fetch(true);
+
 		try {
 			const pendingUser = await this.userPendingsRepository.findOneByOrFail({ code });
 
 			const { account, secret } = await this.signupService.signup({
 				username: pendingUser.username,
 				passwordHash: pendingUser.password,
+				reason: pendingUser.reason,
 			});
 
 			this.userPendingsRepository.delete({
@@ -250,6 +277,11 @@ export class SignupApiService {
 					pendingUserId: null,
 				});
 			}
+			
+			if (instance.approvalRequiredForSignup) {
+				reply.code(204);
+				return;
+			}
 
 			return this.signinService.signin(request, reply, account as MiLocalUser);
 		} catch (err) {
diff --git a/packages/backend/src/server/api/endpoints.ts b/packages/backend/src/server/api/endpoints.ts
index d7f5611f5..e97809336 100644
--- a/packages/backend/src/server/api/endpoints.ts
+++ b/packages/backend/src/server/api/endpoints.ts
@@ -62,6 +62,7 @@ import * as ep___admin_showModerationLogs from './endpoints/admin/show-moderatio
 import * as ep___admin_showUser from './endpoints/admin/show-user.js';
 import * as ep___admin_showUsers from './endpoints/admin/show-users.js';
 import * as ep___admin_suspendUser from './endpoints/admin/suspend-user.js';
+import * as ep___admin_approveUser from './endpoints/admin/approve-user.js';
 import * as ep___admin_unsuspendUser from './endpoints/admin/unsuspend-user.js';
 import * as ep___admin_updateMeta from './endpoints/admin/update-meta.js';
 import * as ep___admin_deleteAccount from './endpoints/admin/delete-account.js';
@@ -413,6 +414,7 @@ const eps = [
 	['admin/show-user', ep___admin_showUser],
 	['admin/show-users', ep___admin_showUsers],
 	['admin/suspend-user', ep___admin_suspendUser],
+	['admin/approve-user', ep___admin_approveUser],
 	['admin/unsuspend-user', ep___admin_unsuspendUser],
 	['admin/update-meta', ep___admin_updateMeta],
 	['admin/delete-account', ep___admin_deleteAccount],
diff --git a/packages/backend/src/server/api/endpoints/admin/approve-user.ts b/packages/backend/src/server/api/endpoints/admin/approve-user.ts
new file mode 100644
index 000000000..0ea656dda
--- /dev/null
+++ b/packages/backend/src/server/api/endpoints/admin/approve-user.ts
@@ -0,0 +1,61 @@
+import { Inject, Injectable } from '@nestjs/common';
+import { Endpoint } from '@/server/api/endpoint-base.js';
+import type { UserProfilesRepository, UsersRepository } from '@/models/_.js';
+import { ModerationLogService } from '@/core/ModerationLogService.js';
+import { DI } from '@/di-symbols.js';
+import { EmailService } from '@/core/EmailService.js';
+
+export const meta = {
+	tags: ['admin'],
+
+	requireCredential: true,
+	requireModerator: true,
+} as const;
+
+export const paramDef = {
+	type: 'object',
+	properties: {
+		userId: { type: 'string', format: 'misskey:id' },
+	},
+	required: ['userId'],
+} as const;
+
+@Injectable()
+export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-disable-line import/no-default-export
+	constructor(
+		@Inject(DI.usersRepository)
+		private usersRepository: UsersRepository,
+
+        @Inject(DI.userProfilesRepository)
+		private userProfilesRepository: UserProfilesRepository,
+
+		private moderationLogService: ModerationLogService,
+        private emailService: EmailService,
+	) {
+		super(meta, paramDef, async (ps, me) => {
+			const user = await this.usersRepository.findOneBy({ id: ps.userId });
+
+			if (user == null) {
+				throw new Error('user not found');
+			}
+
+			const profile = await this.userProfilesRepository.findOneBy({ userId: ps.userId });
+
+			await this.usersRepository.update(user.id, {
+				approved: true,
+			});
+
+			if (profile?.email) {
+				this.emailService.sendEmail(profile.email, 'Account Approved',
+					'Your Account has been approved have fun socializing!',
+					'Your Account has been approved have fun socializing!');
+			}
+
+			this.moderationLogService.log(me, 'approve', {
+				userId: user.id,
+				userUsername: user.username,
+				userHost: user.host,
+			});
+		});
+	}
+}
diff --git a/packages/backend/src/server/api/endpoints/admin/meta.ts b/packages/backend/src/server/api/endpoints/admin/meta.ts
index 88725ddbb..763c4ea80 100644
--- a/packages/backend/src/server/api/endpoints/admin/meta.ts
+++ b/packages/backend/src/server/api/endpoints/admin/meta.ts
@@ -32,6 +32,10 @@ export const meta = {
 				type: 'boolean',
 				optional: false, nullable: false,
 			},
+			approvalRequiredForSignup: {
+				type: 'boolean',
+				optional: false, nullable: false,
+			},
 			enableHcaptcha: {
 				type: 'boolean',
 				optional: false, nullable: false,
@@ -353,6 +357,7 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 				privacyPolicyUrl: instance.privacyPolicyUrl,
 				disableRegistration: instance.disableRegistration,
 				emailRequiredForSignup: instance.emailRequiredForSignup,
+				approvalRequiredForSignup: instance.approvalRequiredForSignup,
 				enableHcaptcha: instance.enableHcaptcha,
 				hcaptchaSiteKey: instance.hcaptchaSiteKey,
 				enableRecaptcha: instance.enableRecaptcha,
diff --git a/packages/backend/src/server/api/endpoints/admin/show-user.ts b/packages/backend/src/server/api/endpoints/admin/show-user.ts
index f550c4fd2..5ad90f48b 100644
--- a/packages/backend/src/server/api/endpoints/admin/show-user.ts
+++ b/packages/backend/src/server/api/endpoints/admin/show-user.ts
@@ -73,6 +73,8 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 			return {
 				email: profile.email,
 				emailVerified: profile.emailVerified,
+				approved: user.approved,
+				signupReason: user.signupReason,
 				autoAcceptFollowed: profile.autoAcceptFollowed,
 				noCrawle: profile.noCrawle,
 				preventAiLearning: profile.preventAiLearning,
diff --git a/packages/backend/src/server/api/endpoints/admin/update-meta.ts b/packages/backend/src/server/api/endpoints/admin/update-meta.ts
index 40cc50fe7..be14037a7 100644
--- a/packages/backend/src/server/api/endpoints/admin/update-meta.ts
+++ b/packages/backend/src/server/api/endpoints/admin/update-meta.ts
@@ -59,6 +59,7 @@ export const paramDef = {
 		cacheRemoteFiles: { type: 'boolean' },
 		cacheRemoteSensitiveFiles: { type: 'boolean' },
 		emailRequiredForSignup: { type: 'boolean' },
+		approvalRequiredForSignup: { type: 'boolean' },
 		enableHcaptcha: { type: 'boolean' },
 		hcaptchaSiteKey: { type: 'string', nullable: true },
 		hcaptchaSecretKey: { type: 'string', nullable: true },
@@ -249,6 +250,10 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 				set.emailRequiredForSignup = ps.emailRequiredForSignup;
 			}
 
+			if (ps.approvalRequiredForSignup !== undefined) {
+				set.approvalRequiredForSignup = ps.approvalRequiredForSignup;
+			}
+
 			if (ps.enableHcaptcha !== undefined) {
 				set.enableHcaptcha = ps.enableHcaptcha;
 			}
diff --git a/packages/backend/src/server/api/endpoints/meta.ts b/packages/backend/src/server/api/endpoints/meta.ts
index d37919b47..dbd72763b 100644
--- a/packages/backend/src/server/api/endpoints/meta.ts
+++ b/packages/backend/src/server/api/endpoints/meta.ts
@@ -100,6 +100,10 @@ export const meta = {
 				type: 'boolean',
 				optional: false, nullable: false,
 			},
+			approvalRequiredForSignup: {
+				type: 'boolean',
+				optional: false, nullable: false,
+			},
 			enableHcaptcha: {
 				type: 'boolean',
 				optional: false, nullable: false,
@@ -308,6 +312,7 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 				privacyPolicyUrl: instance.privacyPolicyUrl,
 				disableRegistration: instance.disableRegistration,
 				emailRequiredForSignup: instance.emailRequiredForSignup,
+				approvalRequiredForSignup: instance.approvalRequiredForSignup,
 				enableHcaptcha: instance.enableHcaptcha,
 				hcaptchaSiteKey: instance.hcaptchaSiteKey,
 				enableRecaptcha: instance.enableRecaptcha,
diff --git a/packages/backend/src/types.ts b/packages/backend/src/types.ts
index 316073c99..dfc6bcba9 100644
--- a/packages/backend/src/types.ts
+++ b/packages/backend/src/types.ts
@@ -30,6 +30,7 @@ export const ffVisibility = ['public', 'followers', 'private'] as const;
 export const moderationLogTypes = [
 	'updateServerSettings',
 	'suspend',
+	'approve',
 	'unsuspend',
 	'updateUserNote',
 	'addCustomEmoji',
@@ -72,6 +73,11 @@ export type ModerationLogPayloads = {
 		userUsername: string;
 		userHost: string | null;
 	};
+	approve: {
+		userId: string;
+		userUsername: string;
+		userHost: string | null;
+	};
 	unsuspend: {
 		userId: string;
 		userUsername: string;
diff --git a/packages/frontend/src/components/MkSignupDialog.form.vue b/packages/frontend/src/components/MkSignupDialog.form.vue
index 174b04264..8975842c6 100644
--- a/packages/frontend/src/components/MkSignupDialog.form.vue
+++ b/packages/frontend/src/components/MkSignupDialog.form.vue
@@ -61,6 +61,10 @@ SPDX-License-Identifier: AGPL-3.0-only
 					<span v-if="passwordRetypeState == 'not-match'" style="color: var(--error)"><i class="ph-warning ph-bold ph-lg ti-fw"></i> {{ i18n.ts.passwordNotMatched }}</span>
 				</template>
 			</MkInput>
+			<MkInput v-if="instance.approvalRequiredForSignup" v-model="reason" type="text" :spellcheck="false" required data-cy-signup-reason>
+				<template #label>Reason <div v-tooltip:dialog="i18n.ts._signup.emailAddressInfo" class="_button _help"><i class="ph-question ph-bold ph-lg"></i></div></template>
+				<template #prefix><i class="ph-envelope ph-bold ph-lg"></i></template>
+			</MkInput>
 			<MkCaptcha v-if="instance.enableHcaptcha" ref="hcaptcha" v-model="hCaptchaResponse" :class="$style.captcha" provider="hcaptcha" :sitekey="instance.hcaptchaSiteKey"/>
 			<MkCaptcha v-if="instance.enableRecaptcha" ref="recaptcha" v-model="reCaptchaResponse" :class="$style.captcha" provider="recaptcha" :sitekey="instance.recaptchaSiteKey"/>
 			<MkCaptcha v-if="instance.enableTurnstile" ref="turnstile" v-model="turnstileResponse" :class="$style.captcha" provider="turnstile" :sitekey="instance.turnstileSiteKey"/>
@@ -97,6 +101,7 @@ const props = withDefaults(defineProps<{
 const emit = defineEmits<{
 	(ev: 'signup', user: Record<string, any>): void;
 	(ev: 'signupEmailPending'): void;
+	(ev: 'approvalPending'): void;
 }>();
 
 const host = toUnicode(config.host);
@@ -109,6 +114,7 @@ let username: string = $ref('');
 let password: string = $ref('');
 let retypedPassword: string = $ref('');
 let invitationCode: string = $ref('');
+let reason: string = $ref('');
 let email = $ref('');
 let usernameState: null | 'wait' | 'ok' | 'unavailable' | 'error' | 'invalid-format' | 'min-range' | 'max-range' = $ref(null);
 let emailState: null | 'wait' | 'ok' | 'unavailable:used' | 'unavailable:format' | 'unavailable:disposable' | 'unavailable:mx' | 'unavailable:smtp' | 'unavailable' | 'error' = $ref(null);
@@ -249,6 +255,7 @@ async function onSubmit(): Promise<void> {
 			password,
 			emailAddress: email,
 			invitationCode,
+			reason,
 			'hcaptcha-response': hCaptchaResponse,
 			'g-recaptcha-response': reCaptchaResponse,
 			'turnstile-response': turnstileResponse,
@@ -260,6 +267,13 @@ async function onSubmit(): Promise<void> {
 				text: i18n.t('_signup.emailSent', { email }),
 			});
 			emit('signupEmailPending');
+		} else if (instance.approvalRequiredForSignup) {
+			os.alert({
+				type: 'success',
+				title: i18n.ts._signup.almostThere,
+				text: i18n.t('_signup.emailSent', { email }),
+			});
+			emit('approvalPending');
 		} else {
 			const res = await os.api('signin', {
 				username,
diff --git a/packages/frontend/src/components/MkSignupDialog.vue b/packages/frontend/src/components/MkSignupDialog.vue
index d860ba5fe..20b7cb634 100644
--- a/packages/frontend/src/components/MkSignupDialog.vue
+++ b/packages/frontend/src/components/MkSignupDialog.vue
@@ -25,7 +25,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 				<XServerRules @done="isAcceptedServerRule = true" @cancel="dialog.close()"/>
 			</template>
 			<template v-else>
-				<XSignup :autoSet="autoSet" @signup="onSignup" @signupEmailPending="onSignupEmailPending"/>
+				<XSignup :autoSet="autoSet" @signup="onSignup" @signupEmailPending="onSignupEmailPending" @approvalPending="onApprovalPending"/>
 			</template>
 		</Transition>
 	</div>
@@ -64,6 +64,9 @@ function onSignup(res) {
 function onSignupEmailPending() {
 	dialog.close();
 }
+function onApprovalPending() {
+	dialog.close();
+}
 </script>
 
 <style lang="scss" module>
diff --git a/packages/frontend/src/components/MkVisitorDashboard.vue b/packages/frontend/src/components/MkVisitorDashboard.vue
index d507a3604..412f58363 100644
--- a/packages/frontend/src/components/MkVisitorDashboard.vue
+++ b/packages/frontend/src/components/MkVisitorDashboard.vue
@@ -21,6 +21,9 @@ SPDX-License-Identifier: AGPL-3.0-only
 			<div v-if="instance.disableRegistration" :class="$style.mainWarn">
 				<MkInfo warn>{{ i18n.ts.invitationRequiredToRegister }}</MkInfo>
 			</div>
+			<div v-if="instance.approvalRequiredForSignup" :class="$style.mainWarn">
+				<MkInfo warn>This instance is only accepting users who specify a reason for registration.<br />You must enter a reason during sign up as to why you want to join this instance.</MkInfo>
+			</div>
 			<div class="_gaps_s" :class="$style.mainActions">
 				<MkButton :class="$style.mainAction" full rounded gradate data-cy-signup style="margin-right: 12px;" @click="signup()">{{ i18n.ts.joinThisServer }}</MkButton>
 				<MkButton :class="$style.mainAction" full rounded @click="exploreOtherServers()">{{ i18n.ts.exploreOtherServers }}</MkButton>
diff --git a/packages/frontend/src/pages/admin-user.vue b/packages/frontend/src/pages/admin-user.vue
index f639054a6..dce74c0ea 100644
--- a/packages/frontend/src/pages/admin-user.vue
+++ b/packages/frontend/src/pages/admin-user.vue
@@ -15,6 +15,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 						<span class="name"><MkUserName class="name" :user="user"/></span>
 						<span class="sub"><span class="acct _monospace">@{{ acct(user) }}</span></span>
 						<span class="state">
+							<span v-if="!approved" class="silenced">Not Approved</span>
 							<span v-if="suspended" class="suspended">Suspended</span>
 							<span v-if="silenced" class="silenced">Silenced</span>
 							<span v-if="moderator" class="moderator">Moderator</span>
@@ -176,6 +177,20 @@ SPDX-License-Identifier: AGPL-3.0-only
 				<MkObjectView tall :value="user">
 				</MkObjectView>
 			</div>
+
+			<div v-else-if="tab === 'approval'" class="_gaps_m">
+				<MkKeyValue oneline>
+					<template #key>Approval Status</template>
+					<template #value><span class="_monospace">{{ approved ? 'Approved' : 'Not Approved' }}</span></template>
+				</MkKeyValue>
+
+				<MkTextarea v-model="signupReason" readonly>
+					<template #label>Reason</template>
+				</MkTextarea>
+
+				<MkButton v-if="$i.isAdmin" inline success @click="approveAccount">Approve</MkButton>
+				<MkButton v-if="$i.isAdmin" inline danger @click="deleteAccount">Deny & Delete</MkButton>
+			</div>
 		</FormSuspense>
 	</MkSpacer>
 </MkStickyContainer>
@@ -222,8 +237,11 @@ let ips = $ref(null);
 let ap = $ref(null);
 let moderator = $ref(false);
 let silenced = $ref(false);
+let approved = $ref(false);
 let suspended = $ref(false);
 let moderationNote = $ref('');
+let signupReason = $ref('');
+
 const filesPagination = {
 	endpoint: 'admin/drive/files' as const,
 	limit: 10,
@@ -253,8 +271,10 @@ function createFetcher() {
 		ips = _ips;
 		moderator = info.isModerator;
 		silenced = info.isSilenced;
+		approved = info.approved;
 		suspended = info.isSuspended;
 		moderationNote = info.moderationNote;
+		signupReason = info.signupReason;
 
 		watch($$(moderationNote), async () => {
 			await os.api('admin/update-user-note', { userId: user.id, text: moderationNote });
@@ -346,6 +366,16 @@ async function deleteAccount() {
 	}
 }
 
+async function approveAccount() {
+	const confirm = await os.confirm({
+		type: 'warning',
+		text: i18n.ts.suspendConfirm,
+	});
+	if (confirm.canceled) return;
+	await os.api('admin/approve-user', { userId: user.id });
+	await refreshUser();
+}
+
 async function assignRole() {
 	const roles = await os.api('admin/roles/list');
 
@@ -432,31 +462,60 @@ watch($$(user), () => {
 
 const headerActions = $computed(() => []);
 
-const headerTabs = $computed(() => [{
-	key: 'overview',
-	title: i18n.ts.overview,
-	icon: 'ph-info ph-bold ph-lg',
-}, {
-	key: 'roles',
-	title: i18n.ts.roles,
-	icon: 'ph-seal-check ph-bold pg-lg',
-}, {
-	key: 'announcements',
-	title: i18n.ts.announcements,
-	icon: 'ph-megaphone ph-bold ph-lg',
-}, {
-	key: 'drive',
-	title: i18n.ts.drive,
-	icon: 'ph-cloud ph-bold ph-lg',
-}, {
-	key: 'chart',
-	title: i18n.ts.charts,
-	icon: 'ph-chart-line ph-bold pg-lg',
-}, {
-	key: 'raw',
-	title: 'Raw',
-	icon: 'ph-code ph-bold pg-lg',
-}]);
+const headerTabs = $computed(() => iAmAdmin && !approved ?
+	[{
+		key: 'overview',
+		title: i18n.ts.overview,
+		icon: 'ph-info ph-bold ph-lg',
+	}, {
+		key: 'roles',
+		title: i18n.ts.roles,
+		icon: 'ph-seal-check ph-bold pg-lg',
+	}, {
+		key: 'announcements',
+		title: i18n.ts.announcements,
+		icon: 'ph-megaphone ph-bold ph-lg',
+	}, {
+		key: 'drive',
+		title: i18n.ts.drive,
+		icon: 'ph-cloud ph-bold ph-lg',
+	}, {
+		key: 'chart',
+		title: i18n.ts.charts,
+		icon: 'ph-chart-line ph-bold pg-lg',
+	}, {
+		key: 'raw',
+		title: 'Raw',
+		icon: 'ph-code ph-bold pg-lg',
+	}, {
+		key: 'approval',
+		title: 'Approval',
+		icon: 'ph-eye ph-bold pg-lg',
+	}] : [{
+		key: 'overview',
+		title: i18n.ts.overview,
+		icon: 'ph-info ph-bold ph-lg',
+	}, {
+		key: 'roles',
+		title: i18n.ts.roles,
+		icon: 'ph-seal-check ph-bold pg-lg',
+	}, {
+		key: 'announcements',
+		title: i18n.ts.announcements,
+		icon: 'ph-megaphone ph-bold ph-lg',
+	}, {
+		key: 'drive',
+		title: i18n.ts.drive,
+		icon: 'ph-cloud ph-bold ph-lg',
+	}, {
+		key: 'chart',
+		title: i18n.ts.charts,
+		icon: 'ph-chart-line ph-bold pg-lg',
+	}, {
+		key: 'raw',
+		title: 'Raw',
+		icon: 'ph-code ph-bold pg-lg',
+	}]);
 
 definePageMetadata(computed(() => ({
 	title: user ? acct(user) : i18n.ts.userInfo,
@@ -547,6 +606,18 @@ definePageMetadata(computed(() => ({
 		}
 	}
 }
+
+.casdwq {
+	.silenced {
+		color: var(--warn);
+		border-color: var(--warn);
+	}
+
+	.moderator {
+		color: var(--success);
+		border-color: var(--success);
+	}
+}
 </style>
 
 <style lang="scss" module>
diff --git a/packages/frontend/src/pages/admin/moderation.vue b/packages/frontend/src/pages/admin/moderation.vue
index 5e0d92376..379a78580 100644
--- a/packages/frontend/src/pages/admin/moderation.vue
+++ b/packages/frontend/src/pages/admin/moderation.vue
@@ -18,6 +18,10 @@ SPDX-License-Identifier: AGPL-3.0-only
 						<template #label>{{ i18n.ts.emailRequiredForSignup }}</template>
 					</MkSwitch>
 
+					<MkSwitch v-model="approvalRequiredForSignup">
+						<template #label>Require approval for new sign-ups</template>
+					</MkSwitch>
+
 					<FormLink to="/admin/server-rules">{{ i18n.ts.serverRules }}</FormLink>
 
 					<MkInput v-model="tosUrl">
@@ -71,6 +75,7 @@ import FormLink from '@/components/form/link.vue';
 
 let enableRegistration: boolean = $ref(false);
 let emailRequiredForSignup: boolean = $ref(false);
+let approvalRequiredForSignup: boolean = $ref(false);
 let sensitiveWords: string = $ref('');
 let preservedUsernames: string = $ref('');
 let tosUrl: string | null = $ref(null);
@@ -80,6 +85,7 @@ async function init() {
 	const meta = await os.api('admin/meta');
 	enableRegistration = !meta.disableRegistration;
 	emailRequiredForSignup = meta.emailRequiredForSignup;
+	approvalRequiredForSignup = meta.approvalRequiredForSignup;
 	sensitiveWords = meta.sensitiveWords.join('\n');
 	preservedUsernames = meta.preservedUsernames.join('\n');
 	tosUrl = meta.tosUrl;
@@ -90,6 +96,7 @@ function save() {
 	os.apiWithDialog('admin/update-meta', {
 		disableRegistration: !enableRegistration,
 		emailRequiredForSignup,
+		approvalRequiredForSignup,
 		tosUrl,
 		privacyPolicyUrl,
 		sensitiveWords: sensitiveWords.split('\n'),
diff --git a/packages/frontend/src/pages/admin/modlog.ModLog.vue b/packages/frontend/src/pages/admin/modlog.ModLog.vue
index c70bf784e..ffb03cfa2 100644
--- a/packages/frontend/src/pages/admin/modlog.ModLog.vue
+++ b/packages/frontend/src/pages/admin/modlog.ModLog.vue
@@ -10,11 +10,12 @@ SPDX-License-Identifier: AGPL-3.0-only
 			:class="{
 				[$style.logGreen]: ['createRole', 'addCustomEmoji', 'createGlobalAnnouncement', 'createUserAnnouncement', 'createAd', 'createInvitation'].includes(log.type),
 				[$style.logYellow]: ['markSensitiveDriveFile', 'resetPassword'].includes(log.type),
-				[$style.logRed]: ['suspend', 'deleteRole', 'suspendRemoteInstance', 'deleteGlobalAnnouncement', 'deleteUserAnnouncement', 'deleteCustomEmoji', 'deleteNote', 'deleteDriveFile', 'deleteAd'].includes(log.type)
+				[$style.logRed]: ['suspend', 'approve', 'deleteRole', 'suspendRemoteInstance', 'deleteGlobalAnnouncement', 'deleteUserAnnouncement', 'deleteCustomEmoji', 'deleteNote', 'deleteDriveFile', 'deleteAd'].includes(log.type)
 			}"
 		>{{ i18n.ts._moderationLogTypes[log.type] }}</b>
 		<span v-if="log.type === 'updateUserNote'">: @{{ log.info.userUsername }}{{ log.info.userHost ? '@' + log.info.userHost : '' }}</span>
 		<span v-else-if="log.type === 'suspend'">: @{{ log.info.userUsername }}{{ log.info.userHost ? '@' + log.info.userHost : '' }}</span>
+		<span v-else-if="log.type === 'approve'">: @{{ log.info.userUsername }}{{ log.info.userHost ? '@' + log.info.userHost : '' }}</span>
 		<span v-else-if="log.type === 'unsuspend'">: @{{ log.info.userUsername }}{{ log.info.userHost ? '@' + log.info.userHost : '' }}</span>
 		<span v-else-if="log.type === 'resetPassword'">: @{{ log.info.userUsername }}{{ log.info.userHost ? '@' + log.info.userHost : '' }}</span>
 		<span v-else-if="log.type === 'assignRole'">: @{{ log.info.userUsername }}{{ log.info.userHost ? '@' + log.info.userHost : '' }} <i class="ti ti-arrow-right"></i> {{ log.info.roleName }}</span>
@@ -65,6 +66,9 @@ SPDX-License-Identifier: AGPL-3.0-only
 		<template v-else-if="log.type === 'suspend'">
 			<div>{{ i18n.ts.user }}: <MkA :to="`/admin/user/${log.info.userId}`" class="_link">@{{ log.info.userUsername }}{{ log.info.userHost ? '@' + log.info.userHost : '' }}</MkA></div>
 		</template>
+		<template v-else-if="log.type === 'approve'">
+			<div>{{ i18n.ts.user }}: <MkA :to="`/admin/user/${log.info.userId}`" class="_link">@{{ log.info.userUsername }}{{ log.info.userHost ? '@' + log.info.userHost : '' }}</MkA></div>
+		</template>
 		<template v-else-if="log.type === 'unsuspend'">
 			<div>{{ i18n.ts.user }}: <MkA :to="`/admin/user/${log.info.userId}`" class="_link">@{{ log.info.userUsername }}{{ log.info.userHost ? '@' + log.info.userHost : '' }}</MkA></div>
 		</template>
diff --git a/packages/misskey-js/src/consts.ts b/packages/misskey-js/src/consts.ts
index 23659ed08..c01a87812 100644
--- a/packages/misskey-js/src/consts.ts
+++ b/packages/misskey-js/src/consts.ts
@@ -48,6 +48,7 @@ export const permissions = [
 export const moderationLogTypes = [
 	'updateServerSettings',
 	'suspend',
+	'approve',
 	'unsuspend',
 	'updateUserNote',
 	'addCustomEmoji',
@@ -87,6 +88,11 @@ export type ModerationLogPayloads = {
 		userUsername: string;
 		userHost: string | null;
 	};
+	approve: {
+		userId: string;
+		userUsername: string;
+		userHost: string | null;
+	};
 	unsuspend: {
 		userId: string;
 		userUsername: string;
diff --git a/packages/misskey-js/src/entities.ts b/packages/misskey-js/src/entities.ts
index 5145b6a93..2011bec95 100644
--- a/packages/misskey-js/src/entities.ts
+++ b/packages/misskey-js/src/entities.ts
@@ -348,6 +348,7 @@ export type LiteInstanceMetadata = {
 	driveCapacityPerLocalUserMb: number;
 	driveCapacityPerRemoteUserMb: number;
 	emailRequiredForSignup: boolean;
+	approvalRequiredForSignup: boolean;
 	enableHcaptcha: boolean;
 	hcaptchaSiteKey: string | null;
 	enableRecaptcha: boolean;

From 3f0cc256dc444fe4de945d92cbe1fb05849ed13f Mon Sep 17 00:00:00 2001
From: Mar0xy <marie@kaifa.ch>
Date: Wed, 18 Oct 2023 03:00:48 +0200
Subject: [PATCH 2/7] add: locales for approval feature

---
 locales/en-US.yml                                   | 10 ++++++++++
 locales/index.d.ts                                  | 10 ++++++++++
 locales/ja-JP.yml                                   | 10 ++++++++++
 .../frontend/src/components/MkSignupDialog.form.vue |  6 +++---
 .../frontend/src/components/MkVisitorDashboard.vue  |  2 +-
 packages/frontend/src/pages/admin-user.vue          | 13 +++++++------
 packages/frontend/src/pages/admin/moderation.vue    |  2 +-
 7 files changed, 42 insertions(+), 11 deletions(-)

diff --git a/locales/en-US.yml b/locales/en-US.yml
index a231f2271..465b579f6 100644
--- a/locales/en-US.yml
+++ b/locales/en-US.yml
@@ -142,6 +142,7 @@ unsuspend: "Unsuspend"
 blockConfirm: "Are you sure that you want to block this account?"
 unblockConfirm: "Are you sure that you want to unblock this account?"
 suspendConfirm: "Are you sure that you want to suspend this account?"
+approveConfirm: "Are you sure that you want to approve this account?"
 unsuspendConfirm: "Are you sure that you want to unsuspend this account?"
 selectList: "Select a list"
 editList: "Edit list"
@@ -871,6 +872,7 @@ itsOff: "Disabled"
 on: "On"
 off: "Off"
 emailRequiredForSignup: "Require email address for sign-up"
+approvalRequiredForSignup: "Require approval for new users"
 unread: "Unread"
 filter: "Filter"
 controlPanel: "Control Panel"
@@ -929,6 +931,11 @@ requireAdminForView: "You must log in with an administrator account to view this
 isSystemAccount: "An account created and automatically operated by the system."
 typeToConfirm: "Please enter {x} to confirm"
 deleteAccount: "Delete account"
+approveAccount: "Approve"
+denyAccount: "Deny & Delete"
+approved: "Approved"
+notApproved: "Not Approved"
+approvalStatus: "Approval Status"
 document: "Documentation"
 numberOfPageCache: "Number of cached pages"
 numberOfPageCacheDescription: "Increasing this number will improve convenience for but cause more load as more memory usage on the user's device."
@@ -1020,6 +1027,7 @@ disableFederationConfirm: "Really disable federation?"
 disableFederationConfirmWarn: "Even if defederated, posts will continue to be public unless set otherwise. You usually do not need to do this."
 disableFederationOk: "Disable"
 invitationRequiredToRegister: "This instance is invite-only. You must enter a valid invite code sign up."
+approvalRequiredToRegister: "This instance is only accepting users who specify a reason for registration."
 emailNotSupported: "This instance does not support sending emails"
 postToTheChannel: "Post to channel"
 cannotBeChangedLater: "This cannot be changed later."
@@ -1540,6 +1548,8 @@ _signup:
   almostThere: "Almost there"
   emailAddressInfo: "Please enter your email address. It will not be made public."
   emailSent: "A confirmation email has been sent to your email address ({email}). Please click the included link to complete account creation."
+  approvalPending: "Your account has been created and is awaiting approval."
+  reasonInfo: "Please enter a reason as to why you want to join the instance."
 _accountDelete:
   accountDelete: "Delete account"
   mayTakeTime: "As account deletion is a resource-heavy process, it may take some time to complete depending on how much content you have created and how many files you have uploaded."
diff --git a/locales/index.d.ts b/locales/index.d.ts
index fd9a2cb7e..8109ffb34 100644
--- a/locales/index.d.ts
+++ b/locales/index.d.ts
@@ -145,6 +145,7 @@ export interface Locale {
     "blockConfirm": string;
     "unblockConfirm": string;
     "suspendConfirm": string;
+    "approveConfirm": string;
     "unsuspendConfirm": string;
     "selectList": string;
     "editList": string;
@@ -869,6 +870,7 @@ export interface Locale {
     "on": string;
     "off": string;
     "emailRequiredForSignup": string;
+    "approvalRequiredForSignup": string;
     "unread": string;
     "filter": string;
     "controlPanel": string;
@@ -927,6 +929,11 @@ export interface Locale {
     "isSystemAccount": string;
     "typeToConfirm": string;
     "deleteAccount": string;
+    "approveAccount": string;
+    "denyAccount": string;
+    "approved": string;
+    "notApproved": string;
+    "approvalStatus": string;
     "document": string;
     "numberOfPageCache": string;
     "numberOfPageCacheDescription": string;
@@ -1018,6 +1025,7 @@ export interface Locale {
     "disableFederationConfirmWarn": string;
     "disableFederationOk": string;
     "invitationRequiredToRegister": string;
+    "approvalRequiredToRegister": string;
     "emailNotSupported": string;
     "postToTheChannel": string;
     "cannotBeChangedLater": string;
@@ -1627,6 +1635,8 @@ export interface Locale {
         "almostThere": string;
         "emailAddressInfo": string;
         "emailSent": string;
+        "approvalPending": string;
+        "reasonInfo": string;
     };
     "_accountDelete": {
         "accountDelete": string;
diff --git a/locales/ja-JP.yml b/locales/ja-JP.yml
index deab375c1..cc93204f1 100644
--- a/locales/ja-JP.yml
+++ b/locales/ja-JP.yml
@@ -142,6 +142,7 @@ unsuspend: "解凍"
 blockConfirm: "ブロックしますか？"
 unblockConfirm: "ブロック解除しますか？"
 suspendConfirm: "凍結しますか？"
+approveConfirm: "このアカウントを承認してもよろしいですか？"
 unsuspendConfirm: "解凍しますか？"
 selectList: "リストを選択"
 editList: "リストを編集"
@@ -866,6 +867,7 @@ itsOff: "オフになっています"
 on: "オン"
 off: "オフ"
 emailRequiredForSignup: "アカウント登録にメールアドレスを必須にする"
+approvalRequiredForSignup: "新規ユーザーの承認が必要"
 unread: "未読"
 filter: "フィルタ"
 controlPanel: "コントロールパネル"
@@ -924,6 +926,11 @@ requireAdminForView: "閲覧するには管理者アカウントでログイン
 isSystemAccount: "システムにより自動で作成・管理されているアカウントです。"
 typeToConfirm: "この操作を行うには {x} と入力してください"
 deleteAccount: "アカウント削除"
+approveAccount: "承認する"
+denyAccount: "拒否と削除"
+approved: "承認済み"
+notApproved: "承認されていない"
+approvalStatus: "承認状況"
 document: "ドキュメント"
 numberOfPageCache: "ページキャッシュ数"
 numberOfPageCacheDescription: "多くすると利便性が向上しますが、負荷とメモリ使用量が増えます。"
@@ -1015,6 +1022,7 @@ disableFederationConfirm: "連合なしにしますか？"
 disableFederationConfirmWarn: "連合なしにしても投稿は非公開になりません。ほとんどの場合、連合なしにする必要はありません。"
 disableFederationOk: "連合なしにする"
 invitationRequiredToRegister: "現在このサーバーは招待制です。招待コードをお持ちの方のみ登録できます。"
+approvalRequiredToRegister: "このインスタンスは、登録理由を指定したユーザーのみを受け入れています。"
 emailNotSupported: "このサーバーではメール配信はサポートされていません"
 postToTheChannel: "チャンネルに投稿"
 cannotBeChangedLater: "後から変更できません。"
@@ -1546,6 +1554,8 @@ _signup:
   almostThere: "ほとんど完了です"
   emailAddressInfo: "あなたが使っているメールアドレスを入力してください。メールアドレスが公開されることはありません。"
   emailSent: "入力されたメールアドレス({email})宛に確認のメールが送信されました。メールに記載されたリンクにアクセスすると、アカウントの作成が完了します。"
+  approvalPending: "アカウントが作成され、承認待ちの状態です。"
+  reasonInfo: "インスタンスに参加したい理由を入力してください。"
 
 _accountDelete:
   accountDelete: "アカウントの削除"
diff --git a/packages/frontend/src/components/MkSignupDialog.form.vue b/packages/frontend/src/components/MkSignupDialog.form.vue
index 8975842c6..389acb82b 100644
--- a/packages/frontend/src/components/MkSignupDialog.form.vue
+++ b/packages/frontend/src/components/MkSignupDialog.form.vue
@@ -62,8 +62,8 @@ SPDX-License-Identifier: AGPL-3.0-only
 				</template>
 			</MkInput>
 			<MkInput v-if="instance.approvalRequiredForSignup" v-model="reason" type="text" :spellcheck="false" required data-cy-signup-reason>
-				<template #label>Reason <div v-tooltip:dialog="i18n.ts._signup.emailAddressInfo" class="_button _help"><i class="ph-question ph-bold ph-lg"></i></div></template>
-				<template #prefix><i class="ph-envelope ph-bold ph-lg"></i></template>
+				<template #label>Reason <div v-tooltip:dialog="i18n.ts._signup.reasonInfo" class="_button _help"><i class="ph-question ph-bold ph-lg"></i></div></template>
+				<template #prefix><i class="ph-chalkboard-teacher ph-bold ph-lg"></i></template>
 			</MkInput>
 			<MkCaptcha v-if="instance.enableHcaptcha" ref="hcaptcha" v-model="hCaptchaResponse" :class="$style.captcha" provider="hcaptcha" :sitekey="instance.hcaptchaSiteKey"/>
 			<MkCaptcha v-if="instance.enableRecaptcha" ref="recaptcha" v-model="reCaptchaResponse" :class="$style.captcha" provider="recaptcha" :sitekey="instance.recaptchaSiteKey"/>
@@ -271,7 +271,7 @@ async function onSubmit(): Promise<void> {
 			os.alert({
 				type: 'success',
 				title: i18n.ts._signup.almostThere,
-				text: i18n.t('_signup.emailSent', { email }),
+				text: i18n.ts._signup.approvalPending,
 			});
 			emit('approvalPending');
 		} else {
diff --git a/packages/frontend/src/components/MkVisitorDashboard.vue b/packages/frontend/src/components/MkVisitorDashboard.vue
index 412f58363..5f269409b 100644
--- a/packages/frontend/src/components/MkVisitorDashboard.vue
+++ b/packages/frontend/src/components/MkVisitorDashboard.vue
@@ -22,7 +22,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 				<MkInfo warn>{{ i18n.ts.invitationRequiredToRegister }}</MkInfo>
 			</div>
 			<div v-if="instance.approvalRequiredForSignup" :class="$style.mainWarn">
-				<MkInfo warn>This instance is only accepting users who specify a reason for registration.<br />You must enter a reason during sign up as to why you want to join this instance.</MkInfo>
+				<MkInfo warn>{{ i18n.ts.approvalRequiredToRegister }}</MkInfo>
 			</div>
 			<div class="_gaps_s" :class="$style.mainActions">
 				<MkButton :class="$style.mainAction" full rounded gradate data-cy-signup style="margin-right: 12px;" @click="signup()">{{ i18n.ts.joinThisServer }}</MkButton>
diff --git a/packages/frontend/src/pages/admin-user.vue b/packages/frontend/src/pages/admin-user.vue
index dce74c0ea..47b4b1b14 100644
--- a/packages/frontend/src/pages/admin-user.vue
+++ b/packages/frontend/src/pages/admin-user.vue
@@ -15,7 +15,8 @@ SPDX-License-Identifier: AGPL-3.0-only
 						<span class="name"><MkUserName class="name" :user="user"/></span>
 						<span class="sub"><span class="acct _monospace">@{{ acct(user) }}</span></span>
 						<span class="state">
-							<span v-if="!approved" class="silenced">Not Approved</span>
+							<span v-if="!approved" class="silenced">{{ i18n.ts.notApproved }}</span>
+							<span v-if="approved" class="moderator">{{ i18n.ts.approved }}</span>
 							<span v-if="suspended" class="suspended">Suspended</span>
 							<span v-if="silenced" class="silenced">Silenced</span>
 							<span v-if="moderator" class="moderator">Moderator</span>
@@ -180,16 +181,16 @@ SPDX-License-Identifier: AGPL-3.0-only
 
 			<div v-else-if="tab === 'approval'" class="_gaps_m">
 				<MkKeyValue oneline>
-					<template #key>Approval Status</template>
-					<template #value><span class="_monospace">{{ approved ? 'Approved' : 'Not Approved' }}</span></template>
+					<template #key>{{ i18n.ts.approvalStatus }}</template>
+					<template #value><span class="_monospace">{{ approved ? {{ i18n.ts.approved }} : {{ i18n.ts.notApproved }} }}</span></template>
 				</MkKeyValue>
 
 				<MkTextarea v-model="signupReason" readonly>
 					<template #label>Reason</template>
 				</MkTextarea>
 
-				<MkButton v-if="$i.isAdmin" inline success @click="approveAccount">Approve</MkButton>
-				<MkButton v-if="$i.isAdmin" inline danger @click="deleteAccount">Deny & Delete</MkButton>
+				<MkButton v-if="$i.isAdmin" inline success @click="approveAccount">{{ i18n.ts.approveAccount }}</MkButton>
+				<MkButton v-if="$i.isAdmin" inline danger @click="deleteAccount">{{ i18n.ts.denyAccount }}</MkButton>
 			</div>
 		</FormSuspense>
 	</MkSpacer>
@@ -369,7 +370,7 @@ async function deleteAccount() {
 async function approveAccount() {
 	const confirm = await os.confirm({
 		type: 'warning',
-		text: i18n.ts.suspendConfirm,
+		text: i18n.ts.approveConfirm,
 	});
 	if (confirm.canceled) return;
 	await os.api('admin/approve-user', { userId: user.id });
diff --git a/packages/frontend/src/pages/admin/moderation.vue b/packages/frontend/src/pages/admin/moderation.vue
index 379a78580..193dd9f08 100644
--- a/packages/frontend/src/pages/admin/moderation.vue
+++ b/packages/frontend/src/pages/admin/moderation.vue
@@ -19,7 +19,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 					</MkSwitch>
 
 					<MkSwitch v-model="approvalRequiredForSignup">
-						<template #label>Require approval for new sign-ups</template>
+						<template #label>{{ i18n.ts.approvalRequiredForSignup }}</template>
 					</MkSwitch>
 
 					<FormLink to="/admin/server-rules">{{ i18n.ts.serverRules }}</FormLink>

From 32fc540df4a77076e3365e5471e13ea45a04c508 Mon Sep 17 00:00:00 2001
From: Mar0xy <marie@kaifa.ch>
Date: Wed, 18 Oct 2023 03:21:06 +0200
Subject: [PATCH 3/7] upd: handle email signups properly with approval enabled

---
 packages/backend/src/server/api/SignupApiService.ts | 10 +++++++---
 packages/frontend/src/pages/admin-user.vue          |  2 +-
 packages/frontend/src/pages/signup-complete.vue     |  7 +++++++
 3 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/packages/backend/src/server/api/SignupApiService.ts b/packages/backend/src/server/api/SignupApiService.ts
index 53f770e17..418656fdb 100644
--- a/packages/backend/src/server/api/SignupApiService.ts
+++ b/packages/backend/src/server/api/SignupApiService.ts
@@ -277,10 +277,14 @@ export class SignupApiService {
 					pendingUserId: null,
 				});
 			}
-			
+
 			if (instance.approvalRequiredForSignup) {
-				reply.code(204);
-				return;
+				if (pendingUser.email) {
+					this.emailService.sendEmail(pendingUser.email, 'Approval pending',
+						'Congratulations! Your account is now pending approval. You will get notified when you have been accepted.',
+						'Congratulations! Your account is now pending approval. You will get notified when you have been accepted.');
+				}
+				return { pendingApproval: true };
 			}
 
 			return this.signinService.signin(request, reply, account as MiLocalUser);
diff --git a/packages/frontend/src/pages/admin-user.vue b/packages/frontend/src/pages/admin-user.vue
index 47b4b1b14..4643ac6e7 100644
--- a/packages/frontend/src/pages/admin-user.vue
+++ b/packages/frontend/src/pages/admin-user.vue
@@ -182,7 +182,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 			<div v-else-if="tab === 'approval'" class="_gaps_m">
 				<MkKeyValue oneline>
 					<template #key>{{ i18n.ts.approvalStatus }}</template>
-					<template #value><span class="_monospace">{{ approved ? {{ i18n.ts.approved }} : {{ i18n.ts.notApproved }} }}</span></template>
+					<template #value><span class="_monospace">{{ approved ? i18n.ts.approved : i18n.ts.notApproved }}</span></template>
 				</MkKeyValue>
 
 				<MkTextarea v-model="signupReason" readonly>
diff --git a/packages/frontend/src/pages/signup-complete.vue b/packages/frontend/src/pages/signup-complete.vue
index 4ebd0e15b..3b1e5468f 100644
--- a/packages/frontend/src/pages/signup-complete.vue
+++ b/packages/frontend/src/pages/signup-complete.vue
@@ -45,6 +45,13 @@ function submit() {
 	os.api('signup-pending', {
 		code: props.code,
 	}).then(res => {
+		if (res.pendingApproval) {
+			return os.alert({
+				type: 'success',
+				title: i18n.ts._signup.almostThere,
+				text: i18n.ts._signup.approvalPending,
+			});
+		}
 		return login(res.i, '/');
 	}).catch(() => {
 		submitting = false;

From cab0ec5de1e6f2d1cff54640e7165a999e221630 Mon Sep 17 00:00:00 2001
From: Mar0xy <marie@kaifa.ch>
Date: Wed, 18 Oct 2023 03:40:51 +0200
Subject: [PATCH 4/7] upd: add `Not Approved` state sorter to Users tab

---
 packages/backend/src/server/api/endpoints/admin/show-users.ts | 3 ++-
 packages/frontend/src/pages/admin/users.vue                   | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/packages/backend/src/server/api/endpoints/admin/show-users.ts b/packages/backend/src/server/api/endpoints/admin/show-users.ts
index fc810987d..c7f717ff1 100644
--- a/packages/backend/src/server/api/endpoints/admin/show-users.ts
+++ b/packages/backend/src/server/api/endpoints/admin/show-users.ts
@@ -34,7 +34,7 @@ export const paramDef = {
 		limit: { type: 'integer', minimum: 1, maximum: 100, default: 10 },
 		offset: { type: 'integer', default: 0 },
 		sort: { type: 'string', enum: ['+follower', '-follower', '+createdAt', '-createdAt', '+updatedAt', '-updatedAt', '+lastActiveDate', '-lastActiveDate'] },
-		state: { type: 'string', enum: ['all', 'alive', 'available', 'admin', 'moderator', 'adminOrModerator', 'suspended'], default: 'all' },
+		state: { type: 'string', enum: ['all', 'alive', 'available', 'admin', 'moderator', 'adminOrModerator', 'suspended', 'approved'], default: 'all' },
 		origin: { type: 'string', enum: ['combined', 'local', 'remote'], default: 'combined' },
 		username: { type: 'string', nullable: true, default: null },
 		hostname: {
@@ -63,6 +63,7 @@ export default class extends Endpoint<typeof meta, typeof paramDef> { // eslint-
 				case 'available': query.where('user.isSuspended = FALSE'); break;
 				case 'alive': query.where('user.updatedAt > :date', { date: new Date(Date.now() - 1000 * 60 * 60 * 24 * 5) }); break;
 				case 'suspended': query.where('user.isSuspended = TRUE'); break;
+				case 'approved': query.where('user.approved = FALSE'); break;
 				case 'admin': {
 					const adminIds = await this.roleService.getAdministratorIds();
 					if (adminIds.length === 0) return [];
diff --git a/packages/frontend/src/pages/admin/users.vue b/packages/frontend/src/pages/admin/users.vue
index c3203fef2..a1f32ba80 100644
--- a/packages/frontend/src/pages/admin/users.vue
+++ b/packages/frontend/src/pages/admin/users.vue
@@ -21,6 +21,7 @@ SPDX-License-Identifier: AGPL-3.0-only
 						<template #label>{{ i18n.ts.state }}</template>
 						<option value="all">{{ i18n.ts.all }}</option>
 						<option value="available">{{ i18n.ts.normal }}</option>
+						<option value="approved">{{ i18n.ts.notApproved }}</option>
 						<option value="admin">{{ i18n.ts.administrator }}</option>
 						<option value="moderator">{{ i18n.ts.moderator }}</option>
 						<option value="suspended">{{ i18n.ts.suspend }}</option>

From 288fa1143d3a2c8a92a84ee1c4ea7661e0554c4c Mon Sep 17 00:00:00 2001
From: Mar0xy <marie@kaifa.ch>
Date: Wed, 18 Oct 2023 04:32:40 +0200
Subject: [PATCH 5/7] upd: display correct `approval_required` value on masto
 instance endpoint

---
 packages/backend/src/server/api/mastodon/endpoints/meta.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/backend/src/server/api/mastodon/endpoints/meta.ts b/packages/backend/src/server/api/mastodon/endpoints/meta.ts
index 5c5e1e2ad..61713b341 100644
--- a/packages/backend/src/server/api/mastodon/endpoints/meta.ts
+++ b/packages/backend/src/server/api/mastodon/endpoints/meta.ts
@@ -28,7 +28,7 @@ export async function getInstance(
 		thumbnail: meta.backgroundImageUrl || '/static-assets/transparent.png',
 		languages: meta.langs,
 		registrations: !meta.disableRegistration || response.registrations,
-		approval_required: !response.registrations,
+		approval_required: meta.approvalRequiredForSignup,
 		invites_enabled: response.registrations,
 		configuration: {
 			accounts: {

From 4e121892e6ddd39983b9baf98983592887cbc2c6 Mon Sep 17 00:00:00 2001
From: Mar0xy <marie@kaifa.ch>
Date: Wed, 18 Oct 2023 19:57:03 +0200
Subject: [PATCH 6/7] add: type for approve-user endpoint

---
 packages/misskey-js/src/api.types.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/misskey-js/src/api.types.ts b/packages/misskey-js/src/api.types.ts
index 09a7c6c65..ed1f3def9 100644
--- a/packages/misskey-js/src/api.types.ts
+++ b/packages/misskey-js/src/api.types.ts
@@ -33,6 +33,7 @@ export type Endpoints = {
 	'admin/suspend-user': { req: TODO; res: TODO; };
 	'admin/nsfw-user': { req: TODO; res: TODO; };
 	'admin/unnsfw-user': { req: TODO; res: TODO; };
+	'admin/approve-user': { req: TODO; res: TODO; };
 	'admin/unsilence-user': { req: TODO; res: TODO; };
 	'admin/unsuspend-user': { req: TODO; res: TODO; };
 	'admin/update-meta': { req: TODO; res: TODO; };

From 20e0d0b2e21fc56c25eede098401fdfb40ccc50f Mon Sep 17 00:00:00 2001
From: Mar0xy <marie@kaifa.ch>
Date: Wed, 18 Oct 2023 20:56:41 +0200
Subject: [PATCH 7/7] upd: mark remote users as approved

---
 packages/backend/src/core/activitypub/models/ApPersonService.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/backend/src/core/activitypub/models/ApPersonService.ts b/packages/backend/src/core/activitypub/models/ApPersonService.ts
index 5a4070a1d..f1cdd8707 100644
--- a/packages/backend/src/core/activitypub/models/ApPersonService.ts
+++ b/packages/backend/src/core/activitypub/models/ApPersonService.ts
@@ -316,6 +316,7 @@ export class ApPersonService implements OnModuleInit {
 					alsoKnownAs: person.alsoKnownAs,
 					isExplorable: person.discoverable,
 					username: person.preferredUsername,
+					approved: true,
 					usernameLower: person.preferredUsername?.toLowerCase(),
 					host,
 					inbox: person.inbox,