Automatic Email Notification for Unconfirmed Appointments in Nextcloud Calendar

I have encountered an issue in Nextcloud Calendar where a user receives an email notification indicating that their appointment has been accepted by another user, even though the appointment has not yet been officially accepted. This issue leads to confusion and miscommunication about the status of appointments.

Steps to reproduce

1. User A books an appointment on User B's calendar.
2. User A confirms the appointment from their end.
3. Without any action from User B (i.e., User B has not yet accepted the appointment), User A receives an email notification stating that User B has accepted the appointment.

Expected behavior

User A should only receive an email notification about the appointment being accepted after User B has actually confirmed or accepted the appointment on their end.

Actual behaviour

User A receives a premature email notification indicating that User B has accepted the appointment, despite no confirmation action taken by User B.

Impact

This issue can lead to misunderstandings and scheduling conflicts, as it falsely communicates the confirmation status of an appointment.

Calendar app version

4.2.0

CalDAV-clients used

None/Browser

Browser

irrelevant

Client operating system

irrelevant

Server operating system

docker container running nextcloud

Web server

Apache

Database engine version

MariaDB

PHP engine version

PHP 8.2

Nextcloud version

27.1.4

Updated from an older installed version or fresh install

None

List of activated apps

Enabled:
  - activity: 2.19.0
  - admin_audit: 1.17.0
  - assistant: 1.0.2
  - bruteforcesettings: 2.7.0
  - calendar: 4.6.0
  - circles: 27.0.1
  - cloud_federation_api: 1.10.0
  - comments: 1.17.0
  - contacts: 5.4.2
  - contactsinteraction: 1.8.0
  - dashboard: 7.7.0
  - dav: 1.27.0
  - federatedfilesharing: 1.17.0
  - federation: 1.17.0
  - files: 1.22.0
  - files_automatedtagging: 1.17.0
  - files_pdfviewer: 2.8.0
  - files_reminders: 1.0.0
  - files_rightclick: 1.6.0
  - files_sharing: 1.19.0
  - files_trashbin: 1.17.0
  - files_versions: 1.20.0
  - firstrunwizard: 2.16.0
  - forms: 3.4.2
  - groupfolders: 15.3.1
  - integration_openai: 1.1.2
  - integration_peertube: 1.0.2
  - logreader: 2.12.0
  - lookup_server_connector: 1.15.0
  - mail: 3.4.5
  - nextcloud_announcements: 1.16.0
  - notifications: 2.15.0
  - oauth2: 1.15.1
  - password_policy: 1.17.0
  - photos: 2.3.0
  - privacy: 1.11.0
  - provisioning_api: 1.17.0
  - recognize: 5.0.3
  - recommendations: 1.6.0
  - related_resources: 1.2.0
  - richdocuments: 8.2.3
  - serverinfo: 1.17.0
  - settings: 1.9.0
  - sharebymail: 1.17.0
  - socialsharing_email: 3.0.0
  - spreed: 17.1.3
  - support: 1.10.0
  - survey_client: 1.15.0
  - systemtags: 1.17.0
  - tasks: 0.15.0
  - text: 3.8.0
  - theming: 2.2.0
  - twofactor_backupcodes: 1.16.0
  - updatenotification: 1.17.0
  - user_ldap: 1.17.0
  - user_status: 1.7.0
  - viewer: 2.1.0
  - weather_status: 1.7.0
  - workflowengine: 2.9.0
Disabled:
  - encryption: 2.15.0
  - files_external: 1.19.0
  - suspicious_login: 5.0.0
  - twofactor_totp: 9.0.0

Nextcloud configuration

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "docs.digiline.io",
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "27.1.4.1",
        "overwrite.cli.url": "https:\/\/docs.digiline.io",
        "overwriteprotocol": "https",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "app_install_overwrite": [
            "talked"
        ],
        "loglevel": 2,
        "maintenance": false,
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauth": 1,
        "mail_smtpport": "587",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***"
    }
}

Web server error log

not relevant

Log file

no relevant information in the logs

Browser log

no relevant information in the logs

Additional info

No response

No source files, tests, or entry points are named in the issue. Start by tracing the appointment confirmation and email-notification flow in the Calendar app, then reproduce the three-step scenario. Done means User A receives the acceptance email only after User B explicitly accepts the appointment.