From d0b5a05075ec9c3566df8de90346c5969c3089f0 Mon Sep 17 00:00:00 2001
From: Lain Soykaf <lain@lain.com>
Date: Fri, 24 Jul 2026 23:14:03 +0400
Subject: [PATCH] fix(admin-api): confirm created users

---
 .../web/admin_api/controllers/user_controller.ex |  2 +-
 .../controllers/user_controller_test.exs         | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/lib/pleroma/web/admin_api/controllers/user_controller.ex b/lib/pleroma/web/admin_api/controllers/user_controller.ex
index f0edfe4ba..82ac4bd9d 100644
--- a/lib/pleroma/web/admin_api/controllers/user_controller.ex
+++ b/lib/pleroma/web/admin_api/controllers/user_controller.ex
@@ -180,7 +180,7 @@ defmodule Pleroma.Web.AdminAPI.UserController do
           bio: "."
         }
 
-        {User.register_changeset(%User{}, user_data, need_confirmation: false), passwordless?}
+        {User.register_changeset(%User{}, user_data, confirmed: true), passwordless?}
       end)
       |> Enum.reduce(Multi.new(), fn {changeset, passwordless?}, multi ->
         user_operation = {:user, Ecto.UUID.generate()}
diff --git a/test/pleroma/web/admin_api/controllers/user_controller_test.exs b/test/pleroma/web/admin_api/controllers/user_controller_test.exs
index 0bea0c185..7e05d67b7 100644
--- a/test/pleroma/web/admin_api/controllers/user_controller_test.exs
+++ b/test/pleroma/web/admin_api/controllers/user_controller_test.exs
@@ -176,6 +176,22 @@ defmodule Pleroma.Web.AdminAPI.UserControllerTest do
       assert ["lain", "lain2"] -- Enum.map(log_entry.data["subjects"], & &1["nickname"]) == []
     end
 
+    test "Admin-created users bypass account confirmation", %{conn: conn} do
+      clear_config([:instance, :account_activation_required], true)
+
+      conn
+      |> put_req_header("accept", "application/json")
+      |> put_req_header("content-type", "application/json")
+      |> post("/api/pleroma/admin/users", %{
+        "users" => [
+          %{"nickname" => "lain", "email" => "lain@example.org", "password" => "test"}
+        ]
+      })
+      |> json_response_and_validate_schema(200)
+
+      assert User.get_by_nickname("lain").is_confirmed
+    end
+
     test "Creating without a password returns a password reset link", %{conn: conn} do
       accounts =
         conn