From 6f21781e6bedb15c9681737d0c2a6ab262f8fae0 Mon Sep 17 00:00:00 2001 From: Sonarly Claude Code Date: Tue, 28 Apr 2026 18:09:54 +0000 Subject: [PATCH] fix(email): send verification email for email updates regardless of IS_EMAIL_VERIFICATION_REQUIRED MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://sonarly.com/issue/32182?type=bug The email change flow reuses the sign-up email verification method which has a guard that silently skips sending when `IS_EMAIL_VERIFICATION_REQUIRED` is `false` (the default). The mutation returns success to the frontend, which displays "Check your inbox" — but no email is ever sent, permanently blocking email changes on self-hosted instances. Fix: Modified `sendVerificationEmail` in `email-verification.service.ts` to bypass the `IS_EMAIL_VERIFICATION_REQUIRED` guard when the verification trigger is `EMAIL_UPDATE`. **Before:** The method checked `IS_EMAIL_VERIFICATION_REQUIRED` and returned `{ success: false }` unconditionally when it was `false` (the default). This meant email-update verification emails were silently suppressed. **After:** The early return only applies when `IS_EMAIL_VERIFICATION_REQUIRED` is `false` AND the trigger is NOT `EMAIL_UPDATE`. For email updates, the verification email is always sent regardless of the config flag, because verifying ownership of the new email address is mandatory to complete the change (unlike sign-up verification, which is an optional security setting). This is a one-line logical change — adding `&& verificationTrigger !== EmailVerificationTrigger.EMAIL_UPDATE` to the existing guard condition. All sign-up paths (which use the default `SIGN_UP` trigger) continue to respect the `IS_EMAIL_VERIFICATION_REQUIRED` config flag as before. --- .../services/email-verification.service.ts | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/packages/twenty-server/src/engine/core-modules/email-verification/services/email-verification.service.ts b/packages/twenty-server/src/engine/core-modules/email-verification/services/email-verification.service.ts index 09694fa6602..c97ae0a16e0 100644 --- a/packages/twenty-server/src/engine/core-modules/email-verification/services/email-verification.service.ts +++ b/packages/twenty-server/src/engine/core-modules/email-verification/services/email-verification.service.ts @@ -59,7 +59,14 @@ export class EmailVerificationService { verifyEmailRedirectPath?: string; verificationTrigger?: EmailVerificationTrigger; }) { - if (!this.twentyConfigService.get('IS_EMAIL_VERIFICATION_REQUIRED')) { + const isEmailVerificationRequired = this.twentyConfigService.get( + 'IS_EMAIL_VERIFICATION_REQUIRED', + ); + + if ( + !isEmailVerificationRequired && + verificationTrigger !== EmailVerificationTrigger.EMAIL_UPDATE + ) { return { success: false }; }