iachat/app/controllers/api/v1/accounts
Vishnu Narayanan c884cdefde
feat: add per-account daily rate limit for outbound emails (#13411)
Introduce a daily cap on non-channel outbound emails to prevent abuse.

Fixes https://linear.app/chatwoot/issue/CW-6418/ses-incident-jan-28

## Type of change

- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality not to work as expected)

## Summary
- Adds a Redis-based daily counter to rate limit outbound emails per
account, preventing email abuse
- Covers continuity emails (WebWidget/API), conversation transcripts,
and agent notifications
  - Email channel replies are excluded (paid feature, not abusable)
- Adds account suspension check in `ConversationReplyMailer` to block
already-queued emails for suspended accounts

  ## Limit Resolution Hierarchy
1. Per-account override (`account.limits['emails']`) — SuperAdmin
configurable
2. Enterprise plan-based (`ACCOUNT_EMAILS_PLAN_LIMITS`
InstallationConfig)
3. Global default (`ACCOUNT_EMAILS_LIMIT` InstallationConfig, default:
100)
  4. Fallback (`ChatwootApp.max_limit` — effectively unlimited)

  ## Enforcement Points
  | Path | Where | Behavior |
  |------|-------|----------|
| WebWidget/API continuity |
`SendEmailNotificationService#should_send_email_notification?` |
Silently skipped |
| Widget transcript | `Widget::ConversationsController#transcript` |
Returns 429 |
| API transcript | `ConversationsController#transcript` | Returns 429 |
| Agent notifications | `Notification::EmailNotificationService#perform`
| Silently skipped |
  | Email channel replies | Not rate limited | Paid feature |
| Suspended accounts | `ConversationReplyMailer` | Blocked at mailer
level |
2026-02-03 02:06:51 +05:30
..
actions feat: Reverse the contact merge (#8057) 2023-10-10 08:20:48 +05:30
assignment_policies feat: Add assignment policies controllers with jbuilder views (#12199) 2025-08-18 19:15:21 -07:00
captain feat: add global config for captain settings (#13141) 2026-01-12 19:54:19 +05:30
channels fix: Remove account_id from params since it is not used (#13116) 2025-12-19 17:07:53 -08:00
contacts feat: Add support for search_conversations in copilot (#11520) 2025-05-20 19:22:17 -07:00
conversations feat: APIs to assign agents_bots as assignee in conversations (#12836) 2025-11-18 18:20:58 -08:00
google refactor: use state-based authentication (#11690) 2025-06-18 17:39:06 +05:30
inboxes feat: Add assignment policies controllers with jbuilder views (#12199) 2025-08-18 19:15:21 -07:00
instagram refactor: use state-based authentication (#11690) 2025-06-18 17:39:06 +05:30
integrations chore: Enforce custom role permissions on conversation access (#12583) 2025-10-22 20:23:37 -07:00
microsoft refactor: use state-based authentication (#11690) 2025-06-18 17:39:06 +05:30
notion feat: Whatsapp embedded signup (#11612) 2025-07-14 21:37:06 -07:00
tiktok feat: TikTok channel (#12741) 2025-12-17 07:54:50 -08:00
twitter fix: Twitter inbox creation error (#1783) 2021-02-16 19:35:10 +05:30
whatsapp chore: Enable flexible whatsapp onboarding (Manual + Embedded Signup) options (#12344) 2025-09-15 19:59:56 +05:30
agent_bots_controller.rb feat: APIs to assign agents_bots as assignee in conversations (#12836) 2025-11-18 18:20:58 -08:00
agents_controller.rb fix: Removing repetitive name parameter in AgentsController (#11259) 2025-04-09 08:53:13 +05:30
articles_controller.rb fix: respect status parameter when creating articles via API (#12846) 2025-11-13 12:07:24 +05:30
assignable_agents_controller.rb chore: Add Assignable Agents API (#4722) 2022-05-23 19:24:07 +05:30
assignment_policies_controller.rb feat: Add assignment policies controllers with jbuilder views (#12199) 2025-08-18 19:15:21 -07:00
automation_rules_controller.rb fix: Validate blob before attaching it to a record (#13115) 2025-12-19 19:02:21 -08:00
base_controller.rb Feat: authenticate direct upload (#4160) 2022-03-16 13:54:18 +05:30
bulk_actions_controller.rb feat: Bulk delete for contacts (#12778) 2025-11-04 17:47:53 -08:00
callbacks_controller.rb fix: Fetch all facebook pages during inbox creation (#11956) 2025-07-17 18:32:12 +05:30
campaigns_controller.rb feat: WhatsApp campaigns (#11910) 2025-07-16 09:04:02 +05:30
canned_responses_controller.rb fix: order for canned response (#6400) 2023-02-06 12:53:48 -08:00
categories_controller.rb feat: Adds the ability to set an emoji for help center category (#8111) 2023-10-20 13:52:30 +05:30
contact_inboxes_controller.rb chore: Add an API to find the contacts using contact inbox sourceId (#8012) 2023-09-28 15:26:28 -07:00
contacts_controller.rb feat: Add infinite scroll to contacts search page (#13376) 2026-01-27 18:55:19 -08:00
conversations_controller.rb feat: add per-account daily rate limit for outbound emails (#13411) 2026-02-03 02:06:51 +05:30
csat_survey_responses_controller.rb feat(ee): Review Notes for CSAT Reports (#13289) 2026-01-15 19:53:57 -08:00
custom_attribute_definitions_controller.rb feat: Support Regex validation for custom attributes (#7856) 2024-01-23 18:01:57 +04:00
custom_filters_controller.rb fix: Allow resource access without filter type in custom_filters API (#11445) 2025-05-08 20:12:05 -07:00
dashboard_apps_controller.rb feat: Allow users to create dashboard apps to give agents more context (#4761) 2022-06-01 11:13:10 +05:30
inbox_csat_templates_controller.rb feat: Add support for sending CSAT surveys via templates (Whatsapp Twilio) (#13143) 2026-01-13 16:32:02 +04:00
inbox_members_controller.rb feat: invalidate cache after inbox members or team members update (#10869) 2025-02-20 21:28:38 -08:00
inboxes_controller.rb feat: Add support for sending CSAT surveys via templates (Whatsapp Twilio) (#13143) 2026-01-13 16:32:02 +04:00
labels_controller.rb chore: Use "destroy!" instead of "destroy" when not checking the return value (#4259) 2022-03-24 13:28:25 +05:30
macros_controller.rb fix: Validate blob before attaching it to a record (#13115) 2025-12-19 19:02:21 -08:00
notification_settings_controller.rb Chore: Code Cleanup in API controllers (#932) 2020-06-07 13:58:05 +05:30
notifications_controller.rb feat: Update last_snoozed_at after the un-snooze notification (#8943) 2024-02-20 18:55:39 +05:30
oauth_authorization_controller.rb refactor: use state-based authentication (#11690) 2025-06-18 17:39:06 +05:30
portals_controller.rb fix: Validate blob before attaching it to a record (#13115) 2025-12-19 19:02:21 -08:00
search_controller.rb feat: Advanced Search Backend (#12917) 2026-01-07 15:30:49 +05:30
team_members_controller.rb feat: invalidate cache after inbox members or team members update (#10869) 2025-02-20 21:28:38 -08:00
teams_controller.rb chore: Use "destroy!" instead of "destroy" when not checking the return value (#4259) 2022-03-24 13:28:25 +05:30
upload_controller.rb fix: Validate blob before attaching it to a record (#13115) 2025-12-19 19:02:21 -08:00
webhooks_controller.rb feat(webhooks): add name to webhook (#12641) 2025-11-13 13:28:15 +05:30
working_hours_controller.rb feat: Business hours 2020-11-01 00:14:33 +05:30