Ensure email belongs to account when resending email confirmation email

app/controllers/users/emails_controller.rb

@@ -13,6 +13,7 @@ def add
       @add_user_email_form = AddUserEmailForm.new
 
       result = @add_user_email_form.submit(current_user, permitted_params)
+      analytics.add_email_request(**result.to_h)
 
       if result.success?
         process_successful_creation
@@ -25,13 +26,15 @@ def add
     end
 
     def resend
-      email_address = EmailAddress.find_with_email(session_email)
+      email_address = EmailAddress.where(user_id: current_user.id).find_with_email(session_email)
 
       if email_address && !email_address.confirmed?
+        analytics.resend_add_email_request(success: true)
         SendAddEmailConfirmation.new(current_user).call(email_address)
         flash[:success] = t('notices.resend_confirmation_email.success')
         redirect_to add_email_verify_email_url
       else
+        analytics.resend_add_email_request(success: false)
         flash[:error] = t('errors.general')
         redirect_to add_email_url
       end

app/services/analytics_events.rb

@@ -266,6 +266,28 @@ def email_deletion_request(success:, errors:, **extra)
     )
   end
 
+  # @param [Boolean] success
+  # @param [Hash] errors
+  # Tracks request for adding new emails to an account
+  def add_email_request(success:, errors:, **extra)
+    track_event(
+      'Add Email Requested',
+      success: success,
+      errors: errors,
+      **extra,
+    )
+  end
+
+  # @param [Boolean] success
+  # Tracks request for resending confirmation for new emails to an account
+  def resend_add_email_request(success:, **extra)
+    track_event(
+      'Resend Add Email Requested',
+      success: success,
+      **extra,
+    )
+  end
+
   # Tracks if Email Language is visited
   def email_language_visited
     track_event('Email Language: Visited')

spec/controllers/users/emails_controller_spec.rb

@@ -35,12 +35,24 @@
     let(:user) { create(:user) }
     before do
       stub_sign_in(user)
+      stub_analytics
+      allow(@analytics).to receive(:track_event)
     end
 
     context 'valid email exists in session' do
       it 'sends email' do
         email = Faker::Internet.safe_email
 
+        expect(@analytics).to receive(:track_event).with(
+          'Add Email Requested',
+          { success: true, errors: {}, user_id: user.uuid, domain_name: email.split('@').last },
+        )
+
+        expect(@analytics).to receive(:track_event).with(
+          'Resend Add Email Requested',
+          { success: true },
+        )
+
         post :add, params: { user: { email: email } }
         expect(last_email_sent).to have_subject(
           t('user_mailer.email_confirmation_instructions.subject'),
@@ -57,6 +69,11 @@
 
     context 'no valid email exists in session' do
       it 'shows an error and redirects to add email page' do
+        expect(@analytics).to receive(:track_event).with(
+          'Resend Add Email Requested',
+          { success: false },
+        )
+
         post :resend
         expect(flash[:error]).to eq t('errors.general')
         expect(response).to redirect_to(add_email_url)