-
One easy additional security step that we can take for our users is sending them an email notification to their old account email anytime that their email is changed inside of our application.
-
So within our text editor here, inside of our update user email, let's create a new function. So static async send email notification.
-
And we want to take the user in using our user model as the type, and we want to grab that email old, which will be a type string. The email old is the actual email we'll be sending this to.
-
And then the user is what we'll use to fill out some additional information inside of the email itself. So we will await mail, and we should have already set this up whenever we did our password reset.
-
So we should be able to just import that and call send later to queue this up, grabbing the message builder. Using the message builder, we want to send this email to that email old,
-
which is the user's old email with a subject. Your email has been successfully changed or something of the sort.
-
And then we can use an HTML view pointing to our email's email underscore change file that we'll create here momentarily, passing that user in.
-
You can also put this inside of an event, but seeing how as we have this one action meant to handle this operation, we can go ahead and just leave this directly inside of the action.
-
After our database transaction has committed and completed successfully is where we'll want to send this email notification.
-
So we'll add in a wait this and call our send email notification, providing the user and the email old into it. That then leaves us with just needing to add our email template in.
-
So within our resources views, we have this emails folder with our forgot password email from when we did our password resets. We can go ahead and right click on this email folder, hit new file and add our
-
email underscore change dot edge file. And if I'm remembering correctly, whenever we did the forgot password, I plopped the HTML directly in.
-
But in case you were curious where that HTML came from, let's jump back into the browser here. There is a website called Maily.2. So that's just Maily.2 there.
-
That's a notion style WYSIWYG that allows you to just build out emails in a kind of GUI style fashion. So for example, here's our one from our password reset.
-
I also have a template for our email change. It's going to say hi, and then we can replace name with the user's full name. Your plot my course account email was recently changed and this email we're
-
writing you today is no longer the email in use. If this is incorrect, please respond directly to this email to contact support or whatever you need that text there to say for your application.
-
And if the user should ever respond back and say, hey, I didn't actually make this change, we have that emails history table that we committed to change into that
-
we'll be able to look up and see if they're actually telling the truth and whether or not they've used the previous email they're trying to refer back to. So we can go ahead and grab the HTML directly for this template that I have.
-
I'm not sure if I can actually share this template, but the HTML will be provided nonetheless. I'm just going to copy HTML there, jump back into our text editor and give it a pace.
-
And I think the only change that we want to make is replacing name here with our user dot full name. Should we have to give that a save? And that should do so. We can close that file out.
-
And now after our email has changed for the user, we will send that email notification to them via their old email. And then again, we have that email histories table that we can use to look
-
up their new and old email history. Should they ever contact us with an issue. So let's jump back into our browser over into our application and let's give this a go.
-
So test user one hyphen edit at test dot com and type in our password there. Update email. And there we go. Your email has been updated.
-
We should be using MailTrap, which we set up whenever we were doing our password reset flow to capture these emails here in development. So we can go to MailTrap dot IO. Looks like I'm already logged in. So I'm going to dive into my account.
-
Let's go into our inbox. And sure enough, right here we can see your email has been successfully changed. And we got hi test user hyphen one, which is what I currently have as this user's full name.
-
Your plot my course account email was recently changed, which matches exactly what our template says. Awesome. If we jump back into our application, revert this.
-
So test user one at test dot com. Put our password back in there. Update email. Jump back over to MailTrap.
-
There's our brand new email notifying us once again that this change was made. If we click on the original email that we got, we'll see that the two is to our test
-
user one at test dot com, which is our old email that we were changing from. And then if we click on this new one, you'll see that it's the one hyphen edit that we just changed from a moment ago.
-
So everything there seems to be working a-OK, which is awesome. I'm going to close both of these out and I'll have links to both of those resources down below.
