feat(admin/users): implement create_verified_user

Replaces the dummy stub with a real implementation that:
- calls save_user(cursor, email, name, verified=True) to create the user
  with the verified flag set, bypassing the email verification flow
- calls set_user_password to store the hashed credential in user_credentials
- returns the newly created User with no roles assigned

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reviewed-By: Frederick M. Muriithi <fredmanglis@gmail.com>

1 files changed, 20 insertions, 1 deletions

diff --git a/gn_auth/auth/authorisation/users/models.py b/gn_auth/auth/authorisation/users/models.py
index ab7a980..21a9627 100644
--- a/gn_auth/auth/authorisation/users/models.py
+++ b/gn_auth/auth/authorisation/users/models.py
@@ -9,7 +9,7 @@ from ..checks import authorised_p
 from ..privileges import Privilege
 
 from ...db import sqlite3 as db
-from ...authentication.users import User
+from ...authentication.users import User, save_user, set_user_password
 
 
 def __process_age_clause__(age_desc: str) -> tuple[str, int]:
@@ -166,3 +166,22 @@ def delete_users_by_id(
         cursor.execute(
             f"DELETE FROM users WHERE user_id IN ({_paramstr})", _ids)
         return cursor.rowcount
+
+
+def create_credentialed_user(
+        conn: db.DbConnection,
+        email: str,
+        name: str,
+        password: str,
+        *,
+        verified: bool = False
+) -> User:
+    """Create a user with stored password credentials.
+
+    Caller controls the verified flag — pass verified=True to bypass the
+    normal email-verification flow (e.g. admin provisioning).
+    """
+    with db.cursor(conn) as cursor:
+        user = save_user(cursor, email, name, verified=verified)
+        set_user_password(cursor, user, password)
+    return user