From 22c2f2455e05010265e61b53aa669fdc10fa3f78 Mon Sep 17 00:00:00 2001
From: yusufwib01 <yusuf.wibisono@moodle.com>
Date: Thu, 3 Jul 2025 23:32:50 +0700
Subject: [PATCH] MDL-85863 user: Defer new-password email until after
 transaction commit

---
 user/externallib.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/user/externallib.php b/user/externallib.php
index 6713b6324ee..07dc4f6f9d0 100644
--- a/user/externallib.php
+++ b/user/externallib.php
@@ -150,6 +150,8 @@ class core_user_external extends \core_external\external_api {
         $transaction = $DB->start_delegated_transaction();
 
         $userids = array();
+        $newpasswordusers = [];
+
         foreach ($params['users'] as $user) {
             // Make sure that the username, firstname and lastname are not blank.
             foreach (array('username', 'firstname', 'lastname') as $fieldname) {
@@ -246,9 +248,10 @@ class core_user_external extends \core_external\external_api {
             }
 
             if ($createpassword) {
-                setnew_password_and_mail($userobject);
                 unset_user_preference('create_password', $userobject);
                 set_user_preference('auth_forcepasswordchange', 1, $userobject);
+                // Queue this user for email notification after user creation is finalized.
+                $newpasswordusers[] = $userobject;
             }
 
             // Trigger event.
@@ -268,6 +271,11 @@ class core_user_external extends \core_external\external_api {
 
         $transaction->allow_commit();
 
+        // After database commit, send password emails to queued users.
+        foreach ($newpasswordusers as $userobject) {
+            setnew_password_and_mail($userobject);
+        }
+
         return $userids;
     }