new email flow also when updating own email

app/controllers/users_controller.rb

@@ -53,6 +53,10 @@ class UsersController < ApplicationController
       if @user == current_user
         bypass_sign_in @user
         flash[:notice] = I18n.t("devise.passwords.updated") if user_params.key?("password")
+        if user_params.key?("email") && FeatureToggle.new_email_journey?
+          flash[:notice] = I18n.t("devise.email.updated", email: @user.unconfirmed_email)
+        end
+
         redirect_to account_path
       else
         user_name = @user.name&.possessive || @user.email.possessive

app/mailers/devise_notify_mailer.rb

@@ -36,7 +36,7 @@ class DeviseNotifyMailer < Devise::Mailer
 
   def confirmation_instructions(record, token, _opts = {})
     if email_changed?(record)
-      if someone_else_changed_email?(record)
+      if new_email_journey?
         send_email_changed_to_old_email(record)
         send_email_changed_to_new_email(record, token)
       else
@@ -59,11 +59,6 @@ class DeviseNotifyMailer < Devise::Mailer
     Rails.application.credentials[:email_allowlist] || []
   end
 
-  def someone_else_changed_email?(record)
-    # Do not send if user changed own email
-    FeatureToggle.new_email_journey? && record.versions.last.actor != record && record.versions.last.changeset.key?("unconfirmed_email")
-  end
-
   def send_email_changed_to_old_email(record)
     return true if intercept_send?(record.email)
 
@@ -94,7 +89,18 @@ class DeviseNotifyMailer < Devise::Mailer
   end
 
   def email_changed?(record)
-    record.confirmable_template == User::CONFIRMABLE_TEMPLATE_ID && (record.unconfirmed_email.present? && record.unconfirmed_email != record.email)
+    (
+      record.confirmable_template == User::CONFIRMABLE_TEMPLATE_ID && (
+        record.unconfirmed_email.present? && record.unconfirmed_email != record.email)
+    ) || (
+      new_email_journey? &&
+        record.versions.last.changeset.key?("unconfirmed_email") &&
+        record.confirmed?
+    )
+  end
+
+  def new_email_journey?
+    FeatureToggle.new_email_journey?
   end
 
   def send_confirmation_email(email, record, token, username)

spec/requests/users_controller_spec.rb

@@ -1538,7 +1538,7 @@ RSpec.describe UsersController, type: :request do
           expect(whodunnit_actor.id).to eq(user.id)
         end
 
-        context "when user changes email, dpo and key contact" do
+        context "when user changes email, dpo and key contact", :aggregate_failures do
           let(:params) { { id: user.id, user: { name: new_name, email: new_email, is_dpo: "true", is_key_contact: "true" } } }
           let(:personalisation) do
             {
@@ -1551,6 +1551,8 @@ RSpec.describe UsersController, type: :request do
 
           before do
             user.legacy_users.destroy_all
+
+            allow(FeatureToggle).to receive(:new_email_journey?).and_return(false)
           end
 
           it "allows changing email and dpo" do
@@ -1566,6 +1568,43 @@ RSpec.describe UsersController, type: :request do
             expect(notify_client).to receive(:send_email).with(email_address: user.email, template_id: User::CONFIRMABLE_TEMPLATE_ID, personalisation:).once
             request
           end
+
+          context "with new email journy enabled" do
+            before do
+              allow(FeatureToggle).to receive(:new_email_journey?).and_return(true)
+            end
+
+            it "shows flash notice" do
+              patch("/users/#{other_user.id}", headers:, params:)
+
+              expect(flash[:notice]).to eq("An email has been sent to #{new_email} to confirm this change.")
+            end
+
+            it "sends new flow emails" do
+              expect(notify_client).to receive(:send_email).with(
+                email_address: other_user.email,
+                template_id: User::FOR_OLD_EMAIL_CHANGED_BY_OTHER_USER_TEMPLATE_ID,
+                personalisation: {
+                  new_email:,
+                  old_email: other_user.email,
+                },
+              ).once
+
+              expect(notify_client).to receive(:send_email).with(
+                email_address: new_email,
+                template_id: User::FOR_NEW_EMAIL_CHANGED_BY_OTHER_USER_TEMPLATE_ID,
+                personalisation: {
+                  new_email:,
+                  old_email: other_user.email,
+                  link: include("/account/confirmation?confirmation_token="),
+                },
+              ).once
+
+              expect(notify_client).not_to receive(:send_email)
+
+              patch "/users/#{other_user.id}", headers:, params:
+            end
+          end
         end
 
         context "when we update the user password" do
@@ -1736,7 +1775,7 @@ RSpec.describe UsersController, type: :request do
                   expect(flash[:notice]).to eq("An email has been sent to #{new_email} to confirm this change.")
                 end
 
-                it "sends a new flow emails" do
+                it "sends new flow emails" do
                   expect(notify_client).to receive(:send_email).with(
                     email_address: other_user.email,
                     template_id: User::FOR_OLD_EMAIL_CHANGED_BY_OTHER_USER_TEMPLATE_ID,