[6.x] Default the create user wizard super toggle to false (#14927)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Jason Varga <jason@pixelfear.com>

Author: 3 people

resources/js/components/users/Wizard.vue

@@ -235,7 +235,7 @@ export default {
     data() {
         return {
             user: {
-                super: this.canCreateSupers,
+                super: false,
                 roles: [],
                 groups: [],
             },

tests/Feature/Users/StoreUserTest.php

@@ -35,6 +35,8 @@ public function it_creates_a_user()
             ->actingAsWithElevatedSession($me)
             ->store()
             ->assertOk();
+
+        $this->assertFalse(User::findByEmail('test@domain.com')->isSuper());
     }
 
     #[Test]
@@ -48,4 +50,32 @@ public function it_requires_an_elevated_session()
             ->store()
             ->assertElevatedSessionRequiredJsonResponse();
     }
+
+    #[Test]
+    public function super_users_can_create_a_super_user()
+    {
+        $this->setTestRoles(['test' => ['access cp', 'create users']]);
+        $me = tap(User::make()->email('admin@domain.com')->assignRole('test')->makeSuper())->save();
+
+        $this
+            ->actingAsWithElevatedSession($me)
+            ->store(['super' => true])
+            ->assertOk();
+
+        $this->assertTrue(User::findByEmail('test@domain.com')->isSuper());
+    }
+
+    #[Test]
+    public function non_super_users_cannot_create_a_super_user()
+    {
+        $this->setTestRoles(['test' => ['access cp', 'create users']]);
+        $me = tap(User::make()->email('admin@domain.com')->assignRole('test'))->save();
+
+        $this
+            ->actingAsWithElevatedSession($me)
+            ->store(['super' => true])
+            ->assertOk();
+
+        $this->assertFalse(User::findByEmail('test@domain.com')->isSuper());
+    }
 }