rodrigo/iachat
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
0d3b59fd9c
iachat/enterprise/app/models
History
Vishnu Narayanan c884cdefde
feat: add per-account daily rate limit for outbound emails (#13411) 
Introduce a daily cap on non-channel outbound emails to prevent abuse.

Fixes https://linear.app/chatwoot/issue/CW-6418/ses-incident-jan-28

## Type of change

- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality not to work as expected)

## Summary
- Adds a Redis-based daily counter to rate limit outbound emails per
account, preventing email abuse
- Covers continuity emails (WebWidget/API), conversation transcripts,
and agent notifications
  - Email channel replies are excluded (paid feature, not abusable)
- Adds account suspension check in `ConversationReplyMailer` to block
already-queued emails for suspended accounts

  ## Limit Resolution Hierarchy
1. Per-account override (`account.limits['emails']`) — SuperAdmin
configurable
2. Enterprise plan-based (`ACCOUNT_EMAILS_PLAN_LIMITS`
InstallationConfig)
3. Global default (`ACCOUNT_EMAILS_LIMIT` InstallationConfig, default:
100)
  4. Fallback (`ChatwootApp.max_limit` — effectively unlimited)

  ## Enforcement Points
  | Path | Where | Behavior |
  |------|-------|----------|
| WebWidget/API continuity |
`SendEmailNotificationService#should_send_email_notification?` |
Silently skipped |
| Widget transcript | `Widget::ConversationsController#transcript` |
Returns 429 |
| API transcript | `ConversationsController#transcript` | Returns 429 |
| Agent notifications | `Notification::EmailNotificationService#perform`
| Silently skipped |
  | Email channel replies | Not rate limited | Paid feature |
| Suspended accounts | `ConversationReplyMailer` | Blocked at mailer
level |
2026-02-03 02:06:51 +05:30
..
captain feat: legacy features to ruby llm (#12994) 2025-12-11 14:17:28 +05:30
channel feat(enterprise): add voice conference API (#13064) 2025-12-15 15:11:59 -08:00
concerns feat: legacy features to ruby llm (#12994) 2025-12-11 14:17:28 +05:30
enterprise feat: add per-account daily rate limit for outbound emails (#13411) 2026-02-03 02:06:51 +05:30
account_saml_settings.rb feat: update users on SAML setup and destroy [CW-2958][CW-5612] (#12346) 2025-09-15 21:20:22 +05:30
agent_capacity_policy.rb feat: Add agent capacity controllers (#12200) 2025-08-26 19:12:58 -07:00
applied_sla.rb chore: Add dependant destroy_async for sla events (#12774) 2025-10-31 09:19:56 +05:30
article_embedding.rb feat: legacy features to ruby llm (#12994) 2025-12-11 14:17:28 +05:30
captain_inbox.rb feat(ee): Add Captain features (#10665) 2025-01-14 16:15:47 -08:00
company.rb feat: Add sorting by contacts count to companies list (#13012) 2026-01-09 15:20:08 -08:00
copilot_message.rb feat: Update UI for Copilot (#11561) 2025-06-02 22:02:03 -05:00
copilot_thread.rb feat: Add support for more tool, standardize copilot chat service (#11560) 2025-05-23 01:07:07 -07:00
custom_role.rb feat: Add APIs to manage custom roles in Chatwoot (#9995) 2024-08-23 17:18:28 +05:30
inbox_capacity_limit.rb feat: Add agent capacity controllers (#12200) 2025-08-26 19:12:58 -07:00
sla_event.rb feat: Conversation API to return applied_sla and sla_events (#9174) 2024-04-01 23:30:07 +05:30
sla_policy.rb fix: Prevent SLA deletion timeouts by moving to async job (#12944) 2025-12-10 12:28:47 +05:30