[Bug]: automatic triggered app updates with errors can lead to an unexpected behave (Maint.Window/no login possible anymore)

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

see app bug rreport ==>

https://github.com/julien-nc/cospend-nc/issues/367

Steps to reproduce

1. automatic trigger update through " occ app:update $app"
2. if such an app gets error(s), the app sometime do not set the cloud maintenance to "OFF"
3. an upgrade app window can/will appear - available for any user in the cloud !
4. Any user can click upgrade this app, which should only be allowd through the Admin - not a normal user
5. After any user clicks upgrade, the upgrade can be successful or not, but the Maintenance page will not switch to: OFF

Expected behavior

In every case, users should NOT BE ABLE TO UPGRADE APPS !
In every case apps should not have the POWER to make users login impossible
(there should be central cloud mechanism in place, which control the proper update operations from app;
if the disturb the cloud operation at all, there should be a repair/control routine)

Nextcloud Server version

30

Operating system

RHEL/CentOS

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

Additional info

No response

Start with the linked app issue and reproduce the reported flow using occ app:update $app, including an update that returns errors. Trace how maintenance mode and the app-upgrade window behave afterward; done means failed updates cannot leave maintenance enabled or allow non-admin users to trigger app upgrades.