From cd2fe857ed773316ba60f3360aa7115eee14f5a7 Mon Sep 17 00:00:00 2001
From: roo hutton <roo.hutton@overleaf.com>
Date: Tue, 12 Aug 2025 13:12:35 +0100
Subject: [PATCH] Merge pull request #27757 from
 overleaf/rh-secondary-email-alert

Only send security alert email after successful addEmailAddress call

GitOrigin-RevId: 391e613b0f855a5d2187b1da87355e0dbb10044d
---
 services/web/app/src/Features/User/UserEmailsController.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/web/app/src/Features/User/UserEmailsController.js b/services/web/app/src/Features/User/UserEmailsController.js
index 32f64023e8..99e5684b70 100644
--- a/services/web/app/src/Features/User/UserEmailsController.js
+++ b/services/web/app/src/Features/User/UserEmailsController.js
@@ -301,7 +301,6 @@ const checkNewSecondaryEmailConfirmationCode = _checkConfirmationCode(
       req.ip,
       { newSecondaryEmail: email }
     )
-    await _sendSecurityAlertEmail(user, email)
     await UserUpdater.promises.addEmailAddress(
       user._id,
       email,
@@ -311,6 +310,7 @@ const checkNewSecondaryEmailConfirmationCode = _checkConfirmationCode(
         ipAddress: req.ip,
       }
     )
+    await _sendSecurityAlertEmail(user, email)
   }
 )