fix: changing email to verified not working on admin > users

.changeset/bright-forks-drop.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes user email verification update not working on admin > users

apps/meteor/app/lib/server/functions/saveUser/saveUser.ts

@@ -147,8 +147,14 @@ const _saveUser = (session?: ClientSession) =>
 			}
 		}
 
-		if (typeof userData.verified === 'boolean' && !userData.email) {
-			updater.set('emails.0.verified', userData.verified);
+		if (typeof userData.verified === 'boolean') {
+			if (oldUserData && 'emails' in oldUserData && oldUserData.emails?.some(({ address }) => address === userData.email)) {
+				const index = oldUserData.emails.findIndex(({ address }) => address === userData.email);
+				updater.set(`emails.${index}.verified`, userData.verified);
+			}
+			if (!userData.email) {
+				updater.set(`emails.0.verified`, userData.verified);
+			}
 		}
 
 		if (userData.customFields) {

apps/meteor/tests/end-to-end/api/users.ts

@@ -2006,6 +2006,63 @@ describe('[Users]', () => {
 			await deleteUser(user);
 		});
 
+		describe('email verification', () => {
+			let admin: TestUser<IUser>;
+			let userToUpdate: TestUser<IUser>;
+			let userCredentials: Credentials;
+
+			beforeEach(async () => {
+				admin = await createUser({ roles: ['admin'] });
+				userToUpdate = await createUser();
+				userCredentials = await login(admin.username, password);
+			});
+
+			afterEach(async () => {
+				await deleteUser(userToUpdate);
+				await deleteUser(admin);
+			});
+
+			it("should update user's email verified correctly", async () => {
+				await request
+					.post(api('users.update'))
+					.set(userCredentials)
+					.send({
+						userId: userToUpdate._id,
+						data: {
+							verified: true,
+						},
+					})
+					.expect('Content-Type', 'application/json')
+					.expect(200)
+					.expect((res) => {
+						expect(res.body).to.have.property('success', true);
+						expect(res.body).to.have.nested.property('user.emails[0].verified', true);
+						expect(res.body).to.not.have.nested.property('user.e2e');
+					});
+			});
+
+			it("should update user's email verified even if email is not changed", (done) => {
+				void request
+					.post(api('users.update'))
+					.set(userCredentials)
+					.send({
+						userId: userToUpdate._id,
+						data: {
+							email: userToUpdate.emails[0].address,
+							verified: true,
+						},
+					})
+					.expect('Content-Type', 'application/json')
+					.expect(200)
+					.expect((res) => {
+						expect(res.body).to.have.property('success', true);
+						expect(res.body).to.have.nested.property('user.emails[0].verified', true);
+						expect(res.body).to.not.have.nested.property('user.e2e');
+					})
+					.end(done);
+			});
+		});
+
 		function failUpdateUser(name: string) {
 			it(`should not update an user if the new username is the reserved word ${name}`, (done) => {
 				void request