Add admin-managed user creation

app/Http/Controllers/Admin/UserManagementController.php

@@ -4,6 +4,7 @@ namespace App\Http\Controllers\Admin;
 
 use App\Actions\Permissions\PermissionService;
 use App\Http\Controllers\Controller;
+use App\Http\Requests\Admin\StoreManagedUserRequest;
 use App\Http\Requests\Admin\SyncUserGlobalPermissionsRequest;
 use App\Http\Resources\PermissionOptionResource;
 use App\Http\Resources\UserResource;
@@ -35,6 +36,26 @@ class UserManagementController extends Controller
         ]);
     }
 
+    public function create(): Response
+    {
+        return Inertia::render('admin/users/Create');
+    }
+
+    public function store(StoreManagedUserRequest $request): RedirectResponse
+    {
+        $validated = $request->validated();
+
+        User::query()->create([
+            'name' => Arr::get($validated, 'name'),
+            'email' => Arr::get($validated, 'email'),
+            'password' => Arr::get($validated, 'password'),
+            'must_change_password_on_next_login' => (bool) Arr::get($validated, 'must_change_password_on_next_login', true),
+        ]);
+
+        return to_route('admin.users.index')
+            ->with('status', 'User was created.');
+    }
+
     public function update(SyncUserGlobalPermissionsRequest $request, User $user): RedirectResponse
     {
         $validated = $request->validated();

app/Http/Controllers/Settings/SecurityController.php

@@ -33,6 +33,8 @@ class SecurityController extends Controller implements HasMiddleware
         $user = $request->user();
         $props = [
             'canManageTwoFactor' => Features::canManageTwoFactorAuthentication(),
+            'mustChangePassword' => (bool) $user->must_change_password_on_next_login,
+            'status' => session('status'),
         ];
 
         if (Features::canManageTwoFactorAuthentication()) {
@@ -53,6 +55,7 @@ class SecurityController extends Controller implements HasMiddleware
         $user = $request->user();
 
         $user->update([
+            'must_change_password_on_next_login' => false,
             'password' => $request->password,
         ]);
 

app/Http/Middleware/RequirePasswordChange.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class RequirePasswordChange
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  Closure(Request): Response  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = $request->user();
+
+        if ($user === null || ! $user->must_change_password_on_next_login) {
+            return $next($request);
+        }
+
+        if ($request->routeIs([
+            'logout',
+            'password.confirm',
+            'password.confirm.*',
+            'security.edit',
+            'user-password.update',
+        ])) {
+            return $next($request);
+        }
+
+        return redirect()
+            ->route('security.edit')
+            ->with('status', 'You must change your password before continuing.');
+    }
+}

app/Http/Requests/Admin/StoreManagedUserRequest.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Http\Requests\Admin;
+
+use App\Concerns\PasswordValidationRules;
+use App\Concerns\ProfileValidationRules;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreManagedUserRequest extends FormRequest
+{
+    use PasswordValidationRules;
+    use ProfileValidationRules;
+
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return $this->user()?->can('access-admin') ?? false;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            ...$this->profileRules(),
+            'must_change_password_on_next_login' => ['required', 'boolean'],
+            'password' => $this->passwordRules(),
+        ];
+    }
+}

app/Http/Resources/UserResource.php

@@ -19,6 +19,7 @@ class UserResource extends JsonResource
             'name' => $this->name,
             'email' => $this->email,
             'email_verified_at' => $this->email_verified_at?->toISOString(),
+            'must_change_password_on_next_login' => (bool) $this->must_change_password_on_next_login,
             'created_at' => $this->created_at?->toISOString(),
             'updated_at' => $this->updated_at?->toISOString(),
         ];

app/Models/User.php

@@ -17,7 +17,7 @@ use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 use Laravel\Fortify\TwoFactorAuthenticatable;
 
-#[Fillable(['name', 'email', 'password'])]
+#[Fillable(['name', 'email', 'password', 'must_change_password_on_next_login'])]
 #[Hidden(['password', 'two_factor_secret', 'two_factor_recovery_codes', 'remember_token'])]
 class User extends Authenticatable
 {
@@ -40,6 +40,7 @@ class User extends Authenticatable
     {
         return [
             'email_verified_at' => 'datetime',
+            'must_change_password_on_next_login' => 'bool',
             'password' => 'hashed',
             'two_factor_confirmed_at' => 'datetime',
         ];