Moderated registration

[csett86]

Is your feature request related to a problem? Please describe.
Currently running an open matrix server with "just" email and CAPTCHA still attracts a lot of spammers, as they can send messages into rooms directly after signup.

Describe the solution you'd like
I'd really like to see a moderated signup option. This would be similar to how Mastodon allows the users to put in a reason for the account and then the moderators to review and manually approve each account.

Describe alternatives you've considered
An alternative would be to implement / configure this in an upstream OAuth provider and only use that in MAS. But this would compliate social login and migration from existing non-MAS to MAS scenarios.

Additional context
In non-MAS times this was done via eg. https://github.com/krombel/matrix-register-bot or https://github.com/ZerataX/matrix-registration to limit spam registrations

[sandhose]

A few notes on how one would implement this:

• introduce a new database model to store 'registration tokens', with a usage counter (optional) and expiration (optional as well)
• add an admin API to manage those tokens (create, list, revoke them)
• add a config flag for requiring a registration token on password registration
• make it a step in the password registration flow (see around here)