fix(auth): fix approval signups and auto-join invites (#3467)

fluxer_docs/src/content/docs/admin-api/instance.mdx

@@ -309,9 +309,12 @@ One account that registered and is still waiting for an Admin decision.
 | requested_at | ISO8601 timestamp | Time the account registered |
 | registration_url_id | ?string | [Registration URL](#registration-url-object) the account signed up through (1-128 characters), or null when it registered directly |
 | client_ip<sup>1</sup> | ?string | IP address the account registered from, or null when none was recorded |
+| invite_code<sup>2</sup> | ?string | Invite the account joins on approval (0-256 characters), or null when it has none |
 
 <sup>1</sup> Stored at registration time and never refreshed, so it can be stale by the time an Admin reads it
 
+<sup>2</sup> The invite code sent with the registration, or the instance's configured auto-join invite when it sent none. An account that registered through SSO sends no invite code, so it stores the auto-join invite or null
+
 ## Pending registration list object
 
 Every account still waiting for an Admin decision.
@@ -940,7 +943,7 @@ Both decisions remove the pending registration, but the endpoint does not requir
 
 ### Side effects
 
-Approval removes both the `registration_pending_approval` trait and the `registration_rejected` trait, and joins the account to the single community when that mode is enabled and a guild is designated. A join that fails is logged and does not fail the request. Rejection removes the `registration_pending_approval` trait and adds the `registration_rejected` trait, which blocks login and every later session creation. A session issued before the decision stays valid. The pending registration is removed either way.
+Approval removes both the `registration_pending_approval` trait and the `registration_rejected` trait. When the account still had the `registration_pending_approval` trait, approval then accepts the stored `invite_code` when there is one and joins the account to the single community when that mode is enabled and a guild is designated. A join that fails, such as one through an invite that was deleted, has expired or needs the account to be online, is logged and does not fail the request. Rejection removes the `registration_pending_approval` trait and adds the `registration_rejected` trait, which blocks login and every later session creation. A session issued before the decision stays valid. The pending registration is removed either way.
 
 When the stored pending registration list fails validation, the request fails before Fluxer changes the account. A failure after Fluxer writes the account traits leaves those traits written and can leave the entry in the pending list. Check the account traits and the pending list before retrying.
 

fluxer_docs/src/content/docs/http-api/authentication.mdx

@@ -590,7 +590,7 @@ Registration verifies a [CAPTCHA](/topics/captcha/). It permits 3 attempts per h
 
 Fluxer resolves the region from the client IP address, and an age below the minimum for that region returns the field code `MUST_BE_MINIMUM_AGE`. That minimum is 13 years unless the region sets a different minimum, and the applied minimum appears only in the localised message.
 
-Registration returns 403 `REGISTRATION_CLOSED` when the instance is closed and no valid registration URL was supplied. A username whose discriminator space is exhausted returns the field code `TOO_MANY_USERS_WITH_THIS_USERNAME`. A username or display name containing a blocked substring returns 403 `CONTENT_BLOCKED`.
+Registration returns 403 `REGISTRATION_CLOSED` when the instance is closed and no valid registration URL was supplied. A registration that would wait for approval, through the approval mode or a registration URL that requires approval, returns 400 `REGISTRATION_CREDENTIALS_REQUIRED` unless it has a `password`, and on an `email` instance also an `email`, because an account without them could never sign in once approved. That refusal counts against no registration allowance and uses no registration URL seat. A username whose discriminator space is exhausted returns the field code `TOO_MANY_USERS_WITH_THIS_USERNAME`. A username or display name containing a blocked substring returns 403 `CONTENT_BLOCKED`.
 
 After the route rate limit, the CAPTCHA and schema validation, the setup token is checked before every other registration rule. A registration that presents the correct token is admitted whatever the registration mode is, is exempt from the registration allowances above, and receives the wildcard [Admin ACL](/admin-api/#acl-registry) when it creates a claimed account, which needs `email` on an `email` instance and `password` on a `username` instance. A client IP address is permitted 10 wrong tokens per 30 minutes, and further requests that present a token from that address return 429 until the window passes, the correct token included. A request with no token does not count.
 
@@ -607,7 +607,7 @@ There is no retry key. A repeated request with the same values creates a second
 | Status | Body | Condition |
 | --- | --- | --- |
 | 200 | [authentication token response](#authentication-token-response) \| [registration pending approval response](#registration-pending-approval-response-object) | Registration completed or entered the approval state |
-| 400 | [error response](/http-api/#error-response) | The body, CAPTCHA, account fields, registration URL code, or setup token is invalid |
+| 400 | [error response](/http-api/#error-response) | The body, CAPTCHA, account fields, sign-in credentials, registration URL code, or setup token is invalid |
 | 403 | [error response](/http-api/#error-response) | SSO enforcement, registration policy, or content moderation rejects the registration |
 | 423 | [error response](/http-api/#error-response) | `GENERAL_ERROR`, because a self-hosted instance with no account yet is still settling its [sign-in method](/http-api/instance/#set-the-setup-sign-in-method) after 15 seconds |
 | 429 | [rate limit response](/topics/rate-limits/#rate-limit-response-object) | A route, global, email, IP, or subnet bucket denies the request, or the address has used its wrong setup token allowance |
@@ -620,7 +620,7 @@ The operation applies the instance's registration, email-domain, breached-passwo
 
 Registration accepts the `invite_code` from the body, or the instance's configured auto-join invite when the body has none. On an instance with single-community mode enabled, the account also joins the community guild. Each join emits [Guild Member Add](/gateway/events/#guild-member-add) to the affected guild's sessions.
 
-Approval mode registration creates no guild membership and no authentication session, and the account cannot sign in until an administrator approves it. Every other successful registration creates one session and returns its token.
+Approval mode registration creates no guild membership and no authentication session, and the account cannot sign in until an administrator approves it. The pending registration keeps that invite, and [approving it](/admin-api/instance/#update-pending-registration) joins the account to that guild and to the single community guild. Every other successful registration creates one session and returns its token.
 
 ### Rate limit
 

fluxer_docs/src/content/docs/http-api/errors.md

@@ -890,6 +890,10 @@ Email verification is required for this action
 
 Registration is closed on this instance
 
+### `REGISTRATION_CREDENTIALS_REQUIRED`
+
+This instance reviews new accounts. Sign up from the sign-up page with a password so you can sign in once approved
+
 ### `REGISTRATION_PENDING_APPROVAL`
 
 This registration is waiting for admin approval