Add admin-managed user creation

tests/Feature/Admin/UserManagementControllerTest.php

@@ -46,6 +46,46 @@ class UserManagementControllerTest extends TestCase
             ->assertForbidden();
     }
 
+    /**
+     * Ensure admins can view the create user page.
+     */
+    public function test_admin_can_view_the_create_user_page(): void
+    {
+        $admin = User::factory()->admin()->create();
+
+        $this->actingAs($admin)
+            ->get(route('admin.users.create'))
+            ->assertOk()
+            ->assertInertia(fn (Assert $page) => $page
+                ->component('admin/users/Create'),
+            );
+    }
+
+    /**
+     * Ensure admins can create managed users.
+     */
+    public function test_admin_can_create_a_user_that_must_change_password_on_next_login(): void
+    {
+        $admin = User::factory()->admin()->create();
+
+        $this->actingAs($admin)
+            ->post(route('admin.users.store'), [
+                'name' => 'New Member',
+                'email' => 'new-member@example.com',
+                'password' => 'temporary-password',
+                'password_confirmation' => 'temporary-password',
+                'must_change_password_on_next_login' => true,
+            ])
+            ->assertRedirect(route('admin.users.index'))
+            ->assertSessionHas('status', 'User was created.');
+
+        $this->assertDatabaseHas('users', [
+            'name' => 'New Member',
+            'email' => 'new-member@example.com',
+            'must_change_password_on_next_login' => true,
+        ]);
+    }
+
     /**
      * Ensure admins can update another user's global permissions.
      */
@@ -126,4 +166,26 @@ class UserManagementControllerTest extends TestCase
             'scope_type' => null,
         ]);
     }
+
+    /**
+     * Ensure non-admin users cannot create managed users.
+     */
+    public function test_non_admin_cannot_create_a_user(): void
+    {
+        $member = User::factory()->create();
+
+        $this->actingAs($member)
+            ->post(route('admin.users.store'), [
+                'name' => 'Blocked User',
+                'email' => 'blocked-user@example.com',
+                'password' => 'temporary-password',
+                'password_confirmation' => 'temporary-password',
+                'must_change_password_on_next_login' => true,
+            ])
+            ->assertForbidden();
+
+        $this->assertDatabaseMissing('users', [
+            'email' => 'blocked-user@example.com',
+        ]);
+    }
 }

tests/Feature/Auth/AuthenticationTest.php

@@ -5,6 +5,7 @@ namespace Tests\Feature\Auth;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\RateLimiter;
+use Inertia\Testing\AssertableInertia as Assert;
 use Laravel\Fortify\Features;
 use Tests\TestCase;
 
@@ -32,6 +33,23 @@ class AuthenticationTest extends TestCase
         $response->assertRedirect(route('dashboard', absolute: false));
     }
 
+    public function test_users_who_must_change_their_password_are_redirected_to_security_settings_after_login()
+    {
+        $user = User::factory()->create([
+            'must_change_password_on_next_login' => true,
+        ]);
+
+        $response = $this->followingRedirects()->post(route('login.store'), [
+            'email' => $user->email,
+            'password' => 'password',
+        ]);
+
+        $this->assertAuthenticated();
+        $response->assertInertia(fn (Assert $page) => $page
+            ->component('auth/ConfirmPassword'),
+        );
+    }
+
     public function test_users_with_two_factor_enabled_are_redirected_to_two_factor_challenge()
     {
         $this->skipUnlessFortifyFeature(Features::twoFactorAuthentication());

tests/Feature/Settings/SecurityTest.php

@@ -89,6 +89,17 @@ class SecurityTest extends TestCase
             );
     }
 
+    public function test_users_who_must_change_their_password_are_redirected_to_security_when_visiting_other_pages()
+    {
+        $user = User::factory()->create([
+            'must_change_password_on_next_login' => true,
+        ]);
+
+        $this->actingAs($user)
+            ->get(route('dashboard'))
+            ->assertRedirect(route('security.edit'));
+    }
+
     public function test_password_can_be_updated()
     {
         $user = User::factory()->create();
@@ -109,6 +120,26 @@ class SecurityTest extends TestCase
         $this->assertTrue(Hash::check('new-password', $user->refresh()->password));
     }
 
+    public function test_password_update_clears_the_forced_password_change_flag()
+    {
+        $user = User::factory()->create([
+            'must_change_password_on_next_login' => true,
+        ]);
+
+        $this
+            ->actingAs($user)
+            ->from(route('security.edit'))
+            ->put(route('user-password.update'), [
+                'current_password' => 'password',
+                'password' => 'new-password',
+                'password_confirmation' => 'new-password',
+            ])
+            ->assertSessionHasNoErrors()
+            ->assertRedirect(route('security.edit'));
+
+        $this->assertFalse((bool) $user->refresh()->must_change_password_on_next_login);
+    }
+
     public function test_correct_password_must_be_provided_to_update_password()
     {
         $user = User::factory()->create();