Method CreateUser

internal/store/users.go:85–118

CreateUser creates a new user with a hashed password.

(input models.UserCreate)

// CreateUser creates a new user with a hashed password.
func (s *Store) CreateUser(input models.UserCreate) (*models.User, error) {
	hash, err := bcrypt.GenerateFromPassword([]byte(input.Password), bcryptCost)
	if err != nil {
		return nil, fmt.Errorf("hash password: %w", err)
	}

	role := input.Role
	if role == "" {
		role = "member"
	}

	id := newID()
	ts := now()

	// Email-verification default is SAFE = verified (DR-3). Every creation path
	// yields a verified user unless it explicitly requests unverified via
	// UserCreate.Unverified. Today only the future cloud self-serve signup
	// branch (PLAN-1933 Wave 3) sets that; every current call site inherits
	// verified. A nil interface binds as a NULL column (= unverified).
	var emailVerifiedAt interface{}
	if !input.Unverified {
		emailVerifiedAt = ts
	}

	_, err = s.db.Exec(s.q(`
		INSERT INTO users (id, email, username, name, password_hash, role, password_set, email_verified_at, created_at, updated_at)
		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
	`), id, strings.ToLower(strings.TrimSpace(input.Email)), strings.TrimSpace(input.Username), strings.TrimSpace(input.Name), string(hash), role, true, emailVerifiedAt, ts, ts)
	if err != nil {
		return nil, fmt.Errorf("insert user: %w", err)
	}

	return s.GetUser(id)
}

// GetUser retrieves a user by ID.
func (s *Store) GetUser(id string) (*models.User, error) {