[PM-36011] feat: add member email change notification email

[jrmccannon]

PM-36011

📔 Objective

Adds the "Your Bitwarden account email was updated" notification email (part of PM-28365), built with the IMailer / MJML pipeline: view model, mail class, MJML source, compiled templates, and a render test.

Screenshot

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the new "member email changed" notification email: the view/mail model, MJML source and compiled Handlebars templates, the render test, and the wiring into UpdateOrganizationUserCommand. Notifying the previous email address that its account email was changed is the correct security behavior, and the command's test coverage exercises both the notification and no-notification paths. One correctness concern about error handling around the notification send is noted inline.

Code Review Details

• ⚠️ : Notification-email delivery failure fails the whole update after the email change is already committed (only BadRequestException is caught).
  • src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/UpdateUser/v2/UpdateOrganizationUserCommand.cs:118

[claude]

⚠️ IMPORTANT: A notification-email delivery failure will fail the whole update after the email change is already committed.

Details and fix

SendEmailChangedNotificationAsync runs inside TryApplyAccountChangesAsync, whose only catch is BadRequestException (mapped by MapEmailChangeError). Mail delivery services (SendGridMailDeliveryService, AmazonSesMailDeliveryService, MailKitSmtpMailDeliveryService) throw HTTP/SMTP/network exceptions, not BadRequestException.

Because ChangeEmailAsync has already persisted the account change and synced Stripe (per the comment on line 115), a transient send failure would throw an unhandled exception out of UpdateUserAsync and surface to the admin as a failed update — even though the email change actually succeeded. The notification is a best-effort side effect and should not be able to fail the primary operation.

The sibling OrganizationAutoConfirmEnabledNotificationCommand already guards its mailer.SendEmail call in a try/catch that logs and continues. Consider the same here, e.g.:

try
{
    await SendEmailChangedNotificationAsync(previousEmail, request.NewEmail!);
}
catch (Exception ex)
{
    logger.LogError(ex, "Failed to send member email-change notification for organization user {OrganizationUserId}.", request.OrganizationUserToUpdate.Id);
}

(logging without the recipient address to avoid PII in logs).

[eliykat]

I agree with this Claude feedback.

[eliykat]

I agree with this Claude feedback.

[codecov]

Codecov Report

❌ Patch coverage is 80.00000% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.62%. Comparing base (98a4e35) to head (b628a98).

Files with missing lines	Patch %	Lines
...ers/UpdateUser/v2/UpdateOrganizationUserCommand.cs	77.77%	4 Missing ⚠️

Additional details and impacted files

@@                            Coverage Diff                            @@
##           jmccannon/ac/pm-38926-admin-change-email    #8044   +/-   ##
=========================================================================
  Coverage                                     62.61%   62.62%           
=========================================================================
  Files                                          2305     2306    +1     
  Lines                                        100355   100371   +16     
  Branches                                       9046     9046           
=========================================================================
+ Hits                                          62839    62854   +15     
- Misses                                        35337    35338    +1     
  Partials                                       2179     2179           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.