feat: auto-approve human join requests on invite acceptance

When a user accepts a human invite link, they are now automatically
approved and added as a company member. The manual approval step was
designed for agent onboarding where review is needed — for human
invites, the inviter already made the decision by sharing the link.

Agent join requests still require manual approval as before.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: stubbi

server/src/routes/access.ts

@@ -2358,7 +2358,7 @@ export function accessRoutes(
 
       const actorEmail =
         requestType === "human" ? await resolveActorEmail(db, req) : null;
-      const created = !inviteAlreadyAccepted
+      let created = !inviteAlreadyAccepted
         ? await db.transaction(async (tx) => {
             await tx
               .update(invites)
@@ -2530,6 +2530,40 @@ export function accessRoutes(
         }
       }
 
+      // Auto-approve human join requests — the inviter already made the decision.
+      let autoApproved = false;
+      if (requestType === "human" && !inviteAlreadyAccepted && created.requestingUserId) {
+        await access.ensureMembership(
+          companyId,
+          "user",
+          created.requestingUserId,
+          "member",
+          "active"
+        );
+        const grants = grantsFromDefaults(
+          invite.defaultsPayload as Record<string, unknown> | null,
+          "human"
+        );
+        await access.setPrincipalGrants(
+          companyId,
+          "user",
+          created.requestingUserId,
+          grants,
+          invite.invitedByUserId ?? null
+        );
+        await db
+          .update(joinRequests)
+          .set({
+            status: "approved",
+            approvedByUserId: invite.invitedByUserId ?? "system",
+            approvedAt: new Date(),
+            updatedAt: new Date()
+          })
+          .where(eq(joinRequests.id, created.id));
+        created = { ...created, status: "approved" as const, approvedAt: new Date() };
+        autoApproved = true;
+      }
+
       await logActivity(db, {
         companyId,
         actorType: req.actor.type === "agent" ? "agent" : "user",
@@ -2538,15 +2572,18 @@ export function accessRoutes(
             ? req.actor.agentId ?? "invite-agent"
             : req.actor.userId ??
               (requestType === "agent" ? "invite-anon" : "board"),
-        action: inviteAlreadyAccepted
-          ? "join.request_replayed"
-          : "join.requested",
+        action: autoApproved
+          ? "join.auto_approved"
+          : inviteAlreadyAccepted
+            ? "join.request_replayed"
+            : "join.requested",
         entityType: "join_request",
         entityId: created.id,
         details: {
           requestType,
           requestIp: created.requestIp,
-          inviteReplay: inviteAlreadyAccepted
+          inviteReplay: inviteAlreadyAccepted,
+          autoApproved
         }
       });