create_user() {
    tik_target_mount "" "required"

    tik_progress_step "Creating user account" 0

    local username="" fullname="" pw="" pw_check=""

    while true; do
        d_opt --entry --title="Create User Account" --text="Full Name (optional)"
        fullname="${result}"

        d_opt --entry --title="Create User Account" --text="Username"
        username="${result}"

        if [ -z "${username}" ]; then
            d --warning --no-wrap --title="Username required" --text="Please enter a username"
            continue
        fi
        if ! [[ "${username}" =~ ^[a-z_][a-z0-9_-]*$ ]]; then
            d --warning --no-wrap --title="Invalid username" --text="Use lowercase letters, numbers, - and _ only, starting with a letter or _"
            continue
        fi
        if [ "${username}" = "root" ] || [ "${username}" = "tik" ]; then
            d --warning --no-wrap --title="Reserved username" --text="\"${username}\" is reserved, please choose another"
            continue
        fi
        break
    done

    while true; do
        logging=false
        d_opt --password --title="Set Password for ${username}"
        pw="${result}"
        d_opt --password --title="Type Password Again"
        pw_check="${result}"
        logging=true

        if [ -z "${pw}" ]; then
            d --warning --no-wrap --title="Password required" --text="Please set a password"
            continue
        fi
        if [ "${pw}" != "${pw_check}" ]; then
            d --warning --no-wrap --title="Password did not match" --text="Please try again"
            continue
        fi
        break
    done

    tik_progress_step "Creating user ${username}" 50
    log "[create_user] creating user ${username}"

    # useradd with no password, then chpasswd fed plaintext "user:pass"
    # over stdin inside the chroot - chpasswd hashes it itself using the
    # scheme configured in /etc/login.defs, no pre-hashing needed. A prior
    # attempt at exactly this lost stdin somewhere across
    # prun -> pkexec -> chroot -> sh -c; that extra sh -c isn't present in
    # this direct invocation. Neither command's argv carries a secret this
    # way, so unlike the old useradd -p <hash> approach there's no need to
    # suppress logging around it.
    # wheel: sudo, via the sudoers.d rule below. lpadmin: printer admin -
    # cups-pk-helper's polkit rule checks isInGroup("lpadmin") specifically,
    # not wheel, and Tessa ships cups-pk-helper (patterns-tessa.spec).
    if [ -n "${fullname}" ]; then
        prun /usr/bin/chroot "${TIK_ROOT_MNT}" useradd -m -c "${fullname}" -G wheel,lpadmin -s /bin/bash "${username}"
    else
        prun /usr/bin/chroot "${TIK_ROOT_MNT}" useradd -m -G wheel,lpadmin -s /bin/bash "${username}"
    fi

    printf '%s:%s\n' "${username}" "${pw}" | prun /usr/bin/chroot "${TIK_ROOT_MNT}" chpasswd
    pw=""
    pw_check=""

    # openSUSE ships %wheel commented out in /etc/sudoers by default, so
    # membership alone doesn't grant sudo. Enable it here, same as
    # config.sh already does for the throwaway tik user's own sudoers.d
    # rule, except this one requires the account's own password - which
    # exposed a base-image default that nobody had hit before: something
    # already sets "Defaults targetpw" (confirmed via `sudo -l`), so sudo
    # asks for *root's* password instead of the caller's own. tik's own
    # sudoers.d/51-tik rule for the throwaway tik user never triggered this
    # since it's NOPASSWD and skips password checking entirely. Override it
    # for the wheel group specifically, and name the file so it sorts after
    # a plausible lower-numbered culprit.
    log "[create_user] enabling sudo for the wheel group"
    printf 'Defaults:%%wheel !targetpw\n%%wheel ALL=(ALL) ALL\n' | prun /usr/bin/tee "${TIK_ROOT_MNT}/etc/sudoers.d/90-wheel"
    prun /usr/bin/chmod 0440 "${TIK_ROOT_MNT}/etc/sudoers.d/90-wheel"

    tik_progress_step "User account created" 100
}

create_user
