Merge pull request #27757 from overleaf/rh-secondary-email-alert

Only send security alert email after successful addEmailAddress call

GitOrigin-RevId: 391e613b0f855a5d2187b1da87355e0dbb10044d

services/web/app/src/Features/User/UserEmailsController.js

@@ -301,7 +301,6 @@ const checkNewSecondaryEmailConfirmationCode = _checkConfirmationCode(
       req.ip,
       { newSecondaryEmail: email }
     )
-    await _sendSecurityAlertEmail(user, email)
     await UserUpdater.promises.addEmailAddress(
       user._id,
       email,
@@ -311,6 +310,7 @@ const checkNewSecondaryEmailConfirmationCode = _checkConfirmationCode(
         ipAddress: req.ip,
       }
     )
+    await _sendSecurityAlertEmail(user, email)
   }
 )