Method Create

server-source-code/internal/handler/users.go:151–267

Create creates a new user.

(w http.ResponseWriter, r *http.Request)

// Create creates a new user.
func (h *UsersHandler) Create(w http.ResponseWriter, r *http.Request) {
	var req struct {
		Username  string  `json:"username"`
		Email     string  `json:"email"`
		Password  string  `json:"password"`
		FirstName *string `json:"first_name"`
		LastName  *string `json:"last_name"`
		Role      string  `json:"role"`
	}
	if err := decodeJSON(r, &req); err != nil {
		Error(w, http.StatusBadRequest, "Invalid request body")
		return
	}
	if len(req.Username) < 3 {
		Error(w, http.StatusBadRequest, "Username must be at least 3 characters")
		return
	}
	if req.Email == "" {
		Error(w, http.StatusBadRequest, "Valid email is required")
		return
	}
	if req.Password == "" {
		Error(w, http.StatusBadRequest, "Password is required")
		return
	}
	if err := ValidatePasswordPolicy(h.resolved, req.Password); err != nil {
		Error(w, http.StatusBadRequest, err.Error())
		return
	}

	role := req.Role
	if role == "" {
		s, _ := h.settings.GetFirst(r.Context())
		if s != nil && s.DefaultUserRole != "" {
			role = s.DefaultUserRole
		}
		if role == "" && h.resolved != nil {
			role = h.resolved.DefaultUserRole
		}
		if role == "" && os.Getenv("DEFAULT_USER_ROLE") != "" {
			role = strings.TrimSpace(os.Getenv("DEFAULT_USER_ROLE"))
		}
		if role == "" {
			role = "user"
		}
	}

	// Enforce role escalation protection.
	callerRole, _ := r.Context().Value(middleware.UserRoleKey).(string)
	if !h.canAssignRole(r, callerRole, role) {
		Error(w, http.StatusForbidden, "You do not have permission to assign the role: "+role)
		return
	}

	exists, err := h.users.ExistsByUsernameOrEmail(r.Context(), req.Username, req.Email, "")
	if err != nil || exists {
		Error(w, http.StatusConflict, "Username or email already exists")
		return