FOUR-32114 / FOUR-32202: Correct user signals on restore and delete

[eiresendez]

Issue & Reproduction Steps

User lifecycle actions could emit redundant user signals when package-advanced-user-manager is installed:

• FOUR-32114: Restoring a soft-deleted user emitted two user_update events because the model callback saved once and Laravel SoftDeletes saved again.
• FOUR-32202: Deleting a user emitted user_update before user_delete because the deleting callback saved status = INACTIVE with normal model events.

To reproduce the delete issue:

1. Enable user-signal.update and user-signal.delete.
2. Configure processes that listen for user_update and user_delete.
3. Delete a user through Admin > Users or DELETE /api/1.0/users/{user}.
4. Observe both signals instead of only user_delete.

Solution

• Removed the extra save() from User::restoring and let Laravel persist status = ACTIVE with deleted_at = null in its restore save.
• Changed User::deleting to saveQuietly(), preserving status = INACTIVE without emitting an updated event before deletion.
• Kept the normal deleted event so package-advanced-user-manager still emits user_delete.
• Made the core regression tests self-contained by asserting Eloquent lifecycle events instead of requiring an optional package.

No routes, payloads, configuration, database schema, or public APIs were changed.

How to Test

Automated checks run:

• php -l ProcessMaker/Models/User.php
• php -l tests/Feature/Api/UsersTest.php
• vendor/bin/phpunit tests/Feature/Api/UsersTest.php --filter=testRestoreSoftDeletedUserDispatchesOneUpdatedEvent
• vendor/bin/phpunit tests/Feature/Api/UsersTest.php --filter=testDeleteUserDispatchesDeletedWithoutUpdatedEvent
• vendor/bin/phpunit tests/Feature/Api/UsersTest.php
• git diff --check

Result: 29 tests passed with 370 assertions in UsersTest.php.

Manual QA:

1. Restore a soft-deleted user and confirm exactly one user_update.
2. Delete a user and confirm no user_update and exactly one user_delete.
3. Confirm the deleted user remains soft-deleted with status = INACTIVE and is removed from its groups.

Related Tickets & Packages

• https://processmaker.atlassian.net/browse/FOUR-32114
• https://processmaker.atlassian.net/browse/FOUR-32202
• Signal mapping remains owned by package-advanced-user-manager; no package changes are required.
• The core fix also applies to callers such as the SCIM delete endpoint in package-auth.

ci:deploy

.

[CarliPinell]

Approved.
No observations were found.

[vladyrichter]

QA server K8S was successfully deployed https://ci-e1313a8493.engk8s.processmaker.net

[eiresendez]

FOUR-32202 is now included in this PR as a separate commit. The delete path persists status = INACTIVE quietly, so it no longer emits user_update before user_delete. The core user API suite passes (29 tests, 370 assertions).

[processmaker-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[vladyrichter]

QA server K8S was successfully deployed https://ci-e1313a8493.engk8s.processmaker.net