From 85b13df6f1a79bdcc3602474c824b2bc068dc3ce Mon Sep 17 00:00:00 2001
From: Jack S <jacopo.scotti@softwire.com>
Date: Fri, 4 Aug 2023 10:55:11 +0100
Subject: [PATCH] Send notification to old email address when changing it

---
 app/mailers/devise_notify_mailer.rb | 20 +++++++++-----------
 app/models/user.rb                  |  2 ++
 config/initializers/devise.rb       |  2 +-
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/app/mailers/devise_notify_mailer.rb b/app/mailers/devise_notify_mailer.rb
index 5560e7925..d42ff84d5 100644
--- a/app/mailers/devise_notify_mailer.rb
+++ b/app/mailers/devise_notify_mailer.rb
@@ -54,19 +54,17 @@ class DeviseNotifyMailer < Devise::Mailer
     Rails.application.credentials[:email_allowlist] || []
   end
 
-private
-
-  def email_changed(record)
-    record.confirmable_template == User::CONFIRMABLE_TEMPLATE_ID && (record.unconfirmed_email.present? && record.unconfirmed_email != record.email)
-  end
-
-  def send_confirmation_email(email, record, token, username)
-    url = "#{user_confirmation_url}?confirmation_token="
+  def email_changed(record, _opts = {})
+    # TODO: do not send if user changed own email address
+    return true if intercept_send?(email)
 
     send_email(
-      email,
-      record.confirmable_template,
-      personalisation(record, token, url, username:),
+      record.email,
+      User::FOR_OLD_EMAIL_CHANGED_BY_OTHER_USER_TEMPLATE_ID,
+      {
+        new_email: record.unconfirmed_email,
+        old_email: record.email,
+      },
     )
   end
 
diff --git a/app/models/user.rb b/app/models/user.rb
index 48177d635..3f9f20a02 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -121,6 +121,8 @@ class User < ApplicationRecord
   RECONFIRMABLE_TEMPLATE_ID = "bcdec787-f0a7-46e9-8d63-b3e0a06ee455".freeze
   BETA_ONBOARDING_TEMPLATE_ID = "b48bc2cd-5887-4611-8296-d0ab3ed0e7fd".freeze
   USER_REACTIVATED_TEMPLATE_ID = "ac45a899-490e-4f59-ae8d-1256fc0001f9".freeze
+  FOR_OLD_EMAIL_CHANGED_BY_OTHER_USER_TEMPLATE_ID = "3eb80517-1051-4dfc-b4cc-cb18228a3829".freeze
+  FOR_NEW_EMAIL_CHANGED_BY_OTHER_USER_TEMPLATE_ID = "0cdd0be1-7fa5-4808-8225-ae4c5a002352".freeze
 
   def reset_password_notify_template
     RESET_PASSWORD_TEMPLATE_ID
diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb
index 4759c94bd..7e4ad09b3 100644
--- a/config/initializers/devise.rb
+++ b/config/initializers/devise.rb
@@ -130,7 +130,7 @@ Devise.setup do |config|
   # config.pepper = '1c69067fda44e12f0ea1e8573fcdb122e5ff7e51a28cc6944c2548af7b7cbfe1400739e2d71cdf0ab53a3b60305942301d7fd7f43ff3a51316e51438145d80ad'
 
   # Send a notification to the original email when the user's email is changed.
-  # config.send_email_changed_notification = false
+  config.send_email_changed_notification = false
 
   # Send a notification email when the user's password is changed.
   # config.send_password_change_notification = false