Send confirmation email to pending email with appropriate copy

[maebeale]

Summary

• Confirmation emails now send to the pending email address (not the current one) when a user changes their email
• Email copy distinguishes between new account confirmation and email change confirmation
• Fixed test failures from factory triggering on-create confirmation with Devise 5

Test plan

• Mailer specs pass
• Model specs pass
• Service specs pass

🤖 Generated with Claude Code

[jmilljr24]

Do we actually need to override this method at all? The only thing unique I see in it is the ahoy stuff but from the ahoy docs:

Users

Ahoy automatically attaches the current_user to the visit. With [Devise](https://github.com/heartcombo/devise), it attaches the user even if they sign in after the visit starts.

With other authentication frameworks, add this to the end of your sign in method:

ahoy.authenticate(user)

Ahoy

I don't have the full context on ahoy though, just point out what I found.

[maebeale]

we're using it for more than just visits and normal "events" -- it's also for model lifecycle tracking incl w callbacks and i couldn't figure out a different way to make sure it always had current_user in those situations.

[maebeale]

we prob should consider the papertrail gem or something like that instead, but it's a small enough app that this ahoy adaptation seemed worth it for all analytics data to end up in the same tables.

[jmilljr24]

I understand that ahoy needs the current user but I don't understand why we need ahoy.authenticate explicitly.

In a normal devise setup we would keep our before_action authenticate_user and that would use the devise method. The ahoy documents also say if you are using devise it automatically attaches the current_user to the visit.

It goes on to say for other frameworks you would call ahoy.authenticate.

Here is our overriding method

  def authenticate_user!
    return super if devise_controller?

    if user_signed_in?
      ahoy.authenticate(current_user)
    else
      redirect_to root_path
    end
  end

The only thing in it ahoy.authenticate. I guess I don't understand why we need to override it if devise and ahoy already work together. We also lose the devise redirect behave when we just redirect to the root_path.

[jmilljr24]

If i'm missing something regarding the ahoy flow, maybe pulling out the ahoy stuff to its own method would work instead of overriding authenticate_user

before_action :authenticate_user!
before_action :track_user_with_ahoy

def track_user_with_ahoy
  ahoy.authenticate(current_user) if user_signed_in?
end

[maebeale]

oooo! love this suggestion!

[maebeale]

thought it needs to also guard for if devise_controller, bc we don't want to run the ahoy thing in that case

[maebeale]

def authenticate_user! by default goes to new_session_path, so we need that override to send them to root_path. still, separating the concerns is a solid idea.