feat(user): add user creation endpoint for superusers

- Add new `/userMgr/create` endpoint for superusers to create users with specified types
- Update AddUser function to accept user type parameter
- Add documentation for the new endpoint in api.md
- Remove debug log comment in auth.go

userAct.go

@@ -18,6 +18,12 @@ type LoginRequest struct {
 	Passwd   string `json:"passwd"`
 }
 
+type CreateUserRequest struct {
+	Username string `json:"username"`
+	Passwd   string `json:"passwd"`
+	Type     string `json:"type"`
+}
+
 func RegisterHandler(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
@@ -64,7 +70,7 @@ func RegisterHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	userID, err := AddUser(req.Username, req.Passwd)
+	userID, err := AddUser(req.Username, req.Passwd, "visitor")
 	if err != nil {
 		SendErrorResponse(w, http.StatusInternalServerError, err.Error())
 		postLog.Error(fmt.Sprintf("[RegisterHandler] Failed to register user \"%s\": %v", req.Username, err))
@@ -187,4 +193,81 @@ func LogoutHandler(w http.ResponseWriter, r *http.Request) {
 
 	SendSuccessResponse(w, "Logout successful", nil)
 	postLog.Info(fmt.Sprintf("[LogoutHandler] User [%d]%s Logout successful", userID, GetUsernameByID(userID)))
+}
+
+func CreateUserHandler(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		SendErrorResponse(w, http.StatusMethodNotAllowed, "Invalid request method")
+		postLog.Warning(fmt.Sprintf("[CreateUserHandler] Invalid request method: %s", r.Method))
+		return
+	}
+
+	if !ValidateTimeStamp(r.Header) {
+		SendErrorResponse(w, http.StatusBadRequest, "Invalid or missing X-Timestamp in header")
+		return
+	}
+	userID, err := extractUserIDFromToken(r.Header.Get("X-Token"))
+	if err != nil {
+		SendErrorResponse(w, http.StatusUnauthorized, "Invalid or missing token")
+		postLog.Warning(fmt.Sprintf("[CreateUserHandler] Invalid or missing token: %v", err))
+		return
+	}
+	user, err := GetUserByID(userID)
+	if err != nil {
+		SendErrorResponse(w, http.StatusInternalServerError, "Failed to get user info")
+		postLog.Error(fmt.Sprintf("[CreateUserHandler] Failed to get user info for user [%d]%s: %v", userID, GetUsernameByID(userID), err))
+		return
+	}
+	if user.Type != "superuser" {
+		SendErrorResponse(w, http.StatusForbidden, "Permission denied")
+		postLog.Warning(fmt.Sprintf("[CreateUserHandler] Permission denied: non-superuser token for user [%d]%s", userID, GetUsernameByID(userID)))
+		return
+	}
+	
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		SendErrorResponse(w, http.StatusBadRequest, "Failed to read request body")
+		postLog.Warning(fmt.Sprintf("[CreateUserHandler] Failed to read request body: %v", err))
+		return
+	}
+	defer r.Body.Close()
+
+	var req CreateUserRequest
+	if err := json.Unmarshal(body, &req); err != nil {
+		SendErrorResponse(w, http.StatusBadRequest, "Invalid request format")
+		postLog.Warning(fmt.Sprintf("[CreateUserHandler] Invalid request format: %v", err))
+		return
+	}
+	
+	if req.Username == "" || req.Passwd == "" || req.Type == "" {
+		SendErrorResponse(w, http.StatusBadRequest, "Username, password, and type are required")
+		postLog.Warning("[CreateUserHandler] CreateUser failed: username, password, or type is empty")
+		return
+	}
+		
+	if req.Type != "admin" && req.Type != "user" && req.Type != "superuser" {
+		SendErrorResponse(w, http.StatusBadRequest, "Invalid type: must be 'admin' or 'user' or 'superuser'")
+		postLog.Warning(fmt.Sprintf("[CreateUserHandler] CreateUser failed: invalid type: %s", req.Type))
+		return
+	}
+
+	userID, err = AddUser(req.Username, req.Passwd, req.Type)
+	if err != nil {
+		SendErrorResponse(w, http.StatusInternalServerError, err.Error())
+		postLog.Error(fmt.Sprintf("[RegisterHandler] Failed to register user \"%s\": %v", req.Username, err))
+		return
+	}
+
+	user, err = GetUserByID(userID)
+	if err != nil {
+		SendErrorResponse(w, http.StatusInternalServerError, "Failed to retrieve user after creation")
+		postLog.Error(fmt.Sprintf("[CreateUserHandler] Failed to retrieve user \"%s\" after creation: %v", req.Username, err))
+		return
+	}
+
+	SendSuccessResponse(w, "User created successfully", map[string]interface{}{
+		"userID":   user.UserID,
+		"username": user.Username,
+		"type":     user.Type,
+	})
 }