[Bug]: set additional_mail via Provisioning API as admin is not marked as verified

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

When an administrator sets an additional email address for a user via the OCS Provisioning API, the email address is not marked as verified, even though the code in editUserMultiValue() explicitly intends to automatically verify email addresses set by an administrator.
As a result, Nextcloud sends a verification email to the user for the newly added additional_mail address.

Steps to reproduce

1. Use Nextcloud Server 34.
2. Authenticate against the OCS Provisioning API as an administrator.
3. Set an additional email address for an existing user using a PUT request, for example:
   curl -u admin:APP_PASSWORD -X PUT -H "OCS-APIRequest: true" -d key= -d value="test@example.com" "https://cloud.example.com/ocs/v2.php/cloud/users/USERNAME/additional_mail"
4. The additional email address is added successfully.
5. Nextcloud sends a verification email to test@example.com.

Expected behavior

An email address set by an administrator through the Provisioning API should be automatically marked as verified.

This appears to be the intended behavior because editUserMultiValue() already contains the following code:

if ($isAdminOrSubadmin && $property) {
    // admin set mails are auto-verified
    $property->setLocallyVerified(IAccountManager::VERIFIED);
}

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

n/a

List of activated Apps

- activity: 7.0.0
  - admin_audit: 1.24.0
  - announcementbanner: 2.7.0
  - app_api: 34.0.0
  - appstore: 1.0.0
  - bruteforcesettings: 7.0.0
  - calendar: 6.5.4
  - circles: 34.0.0
  - cloud_federation_api: 1.18.0
  - comments: 1.24.0
  - contacts: 8.7.7
  - contactsinteraction: 1.15.0
  - dashboard: 7.14.0
  - dav: 1.40.0
  - deck: 1.18.4
  - eurooffice: 11.0.4
  - external: 9.0.1
  - federatedfilesharing: 1.24.0
  - files: 2.6.0
  - files_downloadlimit: 5.2.0
  - files_external: 1.26.0
  - files_lock: 34.0.1
  - files_pdfviewer: 7.0.0-dev.0
  - files_reminders: 1.7.0
  - files_retention: 5.0.0
  - files_sharing: 1.26.0
  - files_trashbin: 1.24.0
  - files_versions: 1.27.0
  - firstrunwizard: 7.0.0-dev.0
  - forms: 5.3.6
  - groupfolders: 22.0.6
  - logreader: 7.0.0
  - lookup_server_connector: 1.22.0
  - mail: 5.11.3
  - nextcloud_announcements: 6.0.0
  - notes: 6.0.2
  - notifications: 7.0.0-dev.1
  - notify_push: 1.4.0
  - oauth2: 1.22.0
  - office: 1.0.0
  - ownershiptransfer: 1.5.0
  - password_policy: 6.0.0-dev.0
  - polls: 9.2.1
  - privacy: 6.0.0-dev.1
  - profile: 1.3.0
  - provisioning_api: 1.24.0
  - recommendations: 7.0.0
  - related_resources: 5.0.0-dev.0
  - richdocuments: 11.1.0
  - richdocumentscode: 26.4.104
  - serverinfo: 6.0.0
  - settings: 1.17.0
  - sharebymail: 1.24.0
  - spreed: 24.0.4
  - systemtags: 1.24.0
  - tables: 2.3.0
  - tasks: 0.18.1
  - text: 8.0.0
  - theming: 2.9.0
  - theming_customcss: 1.21.0
  - twofactor_backupcodes: 1.23.0
  - twofactor_totp: 16.0.0
  - updatenotification: 1.24.0
  - user_ldap: 1.25.0
  - user_status: 1.14.0
  - viewer: 7.0.0-dev.0
  - webhook_listeners: 1.6.0
  - whiteboard: 1.5.9
  - workflowengine: 2.16.0

Nextcloud Signing status

n/a

Nextcloud Logs

Additional info

The current code in apps/provisioning_api/lib/Controller/UsersController.php is:

$mailCollection->addPropertyWithDefaults($value);
$property = $mailCollection->getPropertyByValue($key);

$value contains the newly added email address.
Therefore getPropertyByValue($key) does not find the newly added property and $property is null.

Proposed fix (tested and working):

-$property = $mailCollection->getPropertyByValue($key);
+$property = $mailCollection->getPropertyByValue($value);

Start in apps/provisioning_api/lib/Controller/UsersController.php and trace editUserMultiValue() through the additional_mail PUT request. Check how addPropertyWithDefaults() and getPropertyByValue() identify the newly added address, then verify that an administrator-set address is marked verified and does not trigger a verification email.