rodrigo/iachat
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
9eb3ee44a8
iachat/spec/models/concerns
History
Vishnu Narayanan c884cdefde
feat: add per-account daily rate limit for outbound emails (#13411) 
Introduce a daily cap on non-channel outbound emails to prevent abuse.

Fixes https://linear.app/chatwoot/issue/CW-6418/ses-incident-jan-28

## Type of change

- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality not to work as expected)

## Summary
- Adds a Redis-based daily counter to rate limit outbound emails per
account, preventing email abuse
- Covers continuity emails (WebWidget/API), conversation transcripts,
and agent notifications
  - Email channel replies are excluded (paid feature, not abusable)
- Adds account suspension check in `ConversationReplyMailer` to block
already-queued emails for suspended accounts

  ## Limit Resolution Hierarchy
1. Per-account override (`account.limits['emails']`) — SuperAdmin
configurable
2. Enterprise plan-based (`ACCOUNT_EMAILS_PLAN_LIMITS`
InstallationConfig)
3. Global default (`ACCOUNT_EMAILS_LIMIT` InstallationConfig, default:
100)
  4. Fallback (`ChatwootApp.max_limit` — effectively unlimited)

  ## Enforcement Points
  | Path | Where | Behavior |
  |------|-------|----------|
| WebWidget/API continuity |
`SendEmailNotificationService#should_send_email_notification?` |
Silently skipped |
| Widget transcript | `Widget::ConversationsController#transcript` |
Returns 429 |
| API transcript | `ConversationsController#transcript` | Returns 429 |
| Agent notifications | `Notification::EmailNotificationService#perform`
| Silently skipped |
  | Email channel replies | Not rate limited | Paid feature |
| Suspended accounts | `ConversationReplyMailer` | Blocked at mailer
level |
2026-02-03 02:06:51 +05:30
..
access_tokenable_shared.rb chore: Update dependencies to the latest versions (#5033) 2022-07-15 09:51:59 +07:00
account_email_rate_limitable_spec.rb feat: add per-account daily rate limit for outbound emails (#13411) 2026-02-03 02:06:51 +05:30
assignment_handler_shared.rb feat(perf): Cache labels on the conversation model (#8527) 2023-12-11 18:27:55 -08:00
auto_assignment_handler_shared.rb fix: assignee_changed callback not getting triggered during conversation creation (#9334) 2024-05-06 11:48:17 -07:00
avatarable_shared.rb feat: speed up circleci and github actions (#12849) 2025-11-19 15:32:48 +05:30
cache_keys_spec.rb feat: expiry for cache keys [CW-3038] (#8793) 2024-01-29 15:27:26 +05:30
captain_featurable_spec.rb feat: add global config for captain settings (#13141) 2026-01-12 19:54:19 +05:30
json_schema_validator_spec.rb feat: Add support for minutes in auto resolve feature (#11269) 2025-05-07 00:36:15 -07:00
liquidable_shared.rb feat: Add liquid template support for WhatsApp template parameters (#12227) 2025-08-21 16:44:51 +05:30
out_of_offisable_shared.rb chore: Limit objects returned by conversation API (#2721) 2021-07-31 21:19:42 +05:30
reauthorizable_shared.rb feat: Instagram reauthorization (#11221) 2025-04-03 14:30:48 +05:30
switch_locale_spec.rb fix: test failures due to parallelisation in ci (#12924) 2025-11-21 16:33:29 +05:30