MDL-85863 user: Defer new-password email until after transaction commit

user/externallib.php

@@ -150,6 +150,8 @@ class core_user_external extends \core_external\external_api {
         $transaction = $DB->start_delegated_transaction();
 
         $userids = array();
+        $newpasswordusers = [];
+
         foreach ($params['users'] as $user) {
             // Make sure that the username, firstname and lastname are not blank.
             foreach (array('username', 'firstname', 'lastname') as $fieldname) {
@@ -246,9 +248,10 @@ class core_user_external extends \core_external\external_api {
             }
 
             if ($createpassword) {
-                setnew_password_and_mail($userobject);
                 unset_user_preference('create_password', $userobject);
                 set_user_preference('auth_forcepasswordchange', 1, $userobject);
+                // Queue this user for email notification after user creation is finalized.
+                $newpasswordusers[] = $userobject;
             }
 
             // Trigger event.
@@ -268,6 +271,11 @@ class core_user_external extends \core_external\external_api {
 
         $transaction->allow_commit();
 
+        // After database commit, send password emails to queued users.
+        foreach ($newpasswordusers as $userobject) {
+            setnew_password_and_mail($userobject);
+        }
+
         return $userids;
     }