Add admin-managed user creation

tests/Feature/Admin/UserManagementControllerTest.php

@@ -46,6 +46,46 @@ class UserManagementControllerTest extends TestCase
             ->assertForbidden();
     }
 
+    /**
+     * Ensure admins can view the create user page.
+     */
+    public function test_admin_can_view_the_create_user_page(): void
+    {
+        $admin = User::factory()->admin()->create();
+
+        $this->actingAs($admin)
+            ->get(route('admin.users.create'))
+            ->assertOk()
+            ->assertInertia(fn (Assert $page) => $page
+                ->component('admin/users/Create'),
+            );
+    }
+
+    /**
+     * Ensure admins can create managed users.
+     */
+    public function test_admin_can_create_a_user_that_must_change_password_on_next_login(): void
+    {
+        $admin = User::factory()->admin()->create();
+
+        $this->actingAs($admin)
+            ->post(route('admin.users.store'), [
+                'name' => 'New Member',
+                'email' => 'new-member@example.com',
+                'password' => 'temporary-password',
+                'password_confirmation' => 'temporary-password',
+                'must_change_password_on_next_login' => true,
+            ])
+            ->assertRedirect(route('admin.users.index'))
+            ->assertSessionHas('status', 'User was created.');
+
+        $this->assertDatabaseHas('users', [
+            'name' => 'New Member',
+            'email' => 'new-member@example.com',
+            'must_change_password_on_next_login' => true,
+        ]);
+    }
+
     /**
      * Ensure admins can update another user's global permissions.
      */
@@ -126,4 +166,26 @@ class UserManagementControllerTest extends TestCase
             'scope_type' => null,
         ]);
     }
+
+    /**
+     * Ensure non-admin users cannot create managed users.
+     */
+    public function test_non_admin_cannot_create_a_user(): void
+    {
+        $member = User::factory()->create();
+
+        $this->actingAs($member)
+            ->post(route('admin.users.store'), [
+                'name' => 'Blocked User',
+                'email' => 'blocked-user@example.com',
+                'password' => 'temporary-password',
+                'password_confirmation' => 'temporary-password',
+                'must_change_password_on_next_login' => true,
+            ])
+            ->assertForbidden();
+
+        $this->assertDatabaseMissing('users', [
+            'email' => 'blocked-user@example.com',
+        ]);
+    }
 }