Send notification to old email address when changing it

app/mailers/devise_notify_mailer.rb

@@ -54,19 +54,17 @@ class DeviseNotifyMailer < Devise::Mailer
     Rails.application.credentials[:email_allowlist] || []
   end
 
-private
-
-  def email_changed(record)
-    record.confirmable_template == User::CONFIRMABLE_TEMPLATE_ID && (record.unconfirmed_email.present? && record.unconfirmed_email != record.email)
-  end
-
-  def send_confirmation_email(email, record, token, username)
-    url = "#{user_confirmation_url}?confirmation_token="
+  def email_changed(record, _opts = {})
+    # TODO: do not send if user changed own email address
+    return true if intercept_send?(email)
 
     send_email(
-      email,
-      record.confirmable_template,
-      personalisation(record, token, url, username:),
+      record.email,
+      User::FOR_OLD_EMAIL_CHANGED_BY_OTHER_USER_TEMPLATE_ID,
+      {
+        new_email: record.unconfirmed_email,
+        old_email: record.email,
+      },
     )
   end
 

app/models/user.rb

@@ -121,6 +121,8 @@ class User < ApplicationRecord
   RECONFIRMABLE_TEMPLATE_ID = "bcdec787-f0a7-46e9-8d63-b3e0a06ee455".freeze
   BETA_ONBOARDING_TEMPLATE_ID = "b48bc2cd-5887-4611-8296-d0ab3ed0e7fd".freeze
   USER_REACTIVATED_TEMPLATE_ID = "ac45a899-490e-4f59-ae8d-1256fc0001f9".freeze
+  FOR_OLD_EMAIL_CHANGED_BY_OTHER_USER_TEMPLATE_ID = "3eb80517-1051-4dfc-b4cc-cb18228a3829".freeze
+  FOR_NEW_EMAIL_CHANGED_BY_OTHER_USER_TEMPLATE_ID = "0cdd0be1-7fa5-4808-8225-ae4c5a002352".freeze
 
   def reset_password_notify_template
     RESET_PASSWORD_TEMPLATE_ID

config/initializers/devise.rb

@@ -130,7 +130,7 @@ Devise.setup do |config|
   # config.pepper = '1c69067fda44e12f0ea1e8573fcdb122e5ff7e51a28cc6944c2548af7b7cbfe1400739e2d71cdf0ab53a3b60305942301d7fd7f43ff3a51316e51438145d80ad'
 
   # Send a notification to the original email when the user's email is changed.
-  # config.send_email_changed_notification = false
+  config.send_email_changed_notification = false
 
   # Send a notification email when the user's password is changed.
   # config.send_password_change_notification = false