feat(admin/users): wire auth guards on POST /auth/user/create

Adds @require_oauth("profile") for 401 on unauthenticated requests and
an authorised_for2 check for the system:user:create-user privilege,
raising ForbiddenAccess (403) for non-admin callers.

Returns 501 for the success path until the body logic is implemented.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

1 files changed, 16 insertions, 2 deletions

diff --git a/gn_auth/auth/authorisation/users/views.py b/gn_auth/auth/authorisation/users/views.py
index da30c04..544074a 100644
--- a/gn_auth/auth/authorisation/users/views.py
+++ b/gn_auth/auth/authorisation/users/views.py
@@ -20,8 +20,11 @@ from flask import (
     Response,
     Blueprint,
     current_app,
+    make_response,
     render_template)
 
+from gn_libs.privileges.system import can_create_or_delete_user
+
 from gn_auth.smtp import send_message, build_email_message
 
 from gn_auth.auth.requests import request_json
@@ -29,7 +32,9 @@ from gn_auth.auth.requests import request_json
 from gn_auth.auth.db import sqlite3 as db
 from gn_auth.auth.db.sqlite3 import with_db_connection
 
-from gn_auth.auth.authorisation.resources.system.models import system_resource
+from gn_auth.auth.authorisation.resources.system.models import (
+    system_resource,
+    user_roles_on_system)
 
 from gn_auth.auth.authorisation.resources.checks import authorised_for2
 from gn_auth.auth.authorisation.resources.models import (
@@ -43,6 +48,7 @@ from gn_auth.auth.errors import (
     NotFoundError,
     UsernameError,
     PasswordError,
+    ForbiddenAccess,
     AuthorisationError,
     UserRegistrationError)
 
@@ -754,4 +760,12 @@ def delete_users():
 @users.route("/create", methods=["POST"])
 def create_new_user() -> Response:
     """Create a new User."""
-    return jsonify({})
+    with (require_oauth.acquire("profile") as token,
+          db.connection(current_app.config["AUTH_DB"]) as conn):
+        u_roles = user_roles_on_system(conn, token.user)
+        if not can_create_or_delete_user(tuple(
+                priv.privilege_id for role in u_roles
+                for priv in role.privileges)):
+            raise ForbiddenAccess(
+                "You need the `system:user:create-user` privilege.")
+    return make_response(jsonify({}), 501)