rodrigo/iachat
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
c884cdefde
iachat/config
History
Vishnu Narayanan c884cdefde
feat: add per-account daily rate limit for outbound emails (#13411) 
Introduce a daily cap on non-channel outbound emails to prevent abuse.

Fixes https://linear.app/chatwoot/issue/CW-6418/ses-incident-jan-28

## Type of change

- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality not to work as expected)

## Summary
- Adds a Redis-based daily counter to rate limit outbound emails per
account, preventing email abuse
- Covers continuity emails (WebWidget/API), conversation transcripts,
and agent notifications
  - Email channel replies are excluded (paid feature, not abusable)
- Adds account suspension check in `ConversationReplyMailer` to block
already-queued emails for suspended accounts

  ## Limit Resolution Hierarchy
1. Per-account override (`account.limits['emails']`) — SuperAdmin
configurable
2. Enterprise plan-based (`ACCOUNT_EMAILS_PLAN_LIMITS`
InstallationConfig)
3. Global default (`ACCOUNT_EMAILS_LIMIT` InstallationConfig, default:
100)
  4. Fallback (`ChatwootApp.max_limit` — effectively unlimited)

  ## Enforcement Points
  | Path | Where | Behavior |
  |------|-------|----------|
| WebWidget/API continuity |
`SendEmailNotificationService#should_send_email_notification?` |
Silently skipped |
| Widget transcript | `Widget::ConversationsController#transcript` |
Returns 429 |
| API transcript | `ConversationsController#transcript` | Returns 429 |
| Agent notifications | `Notification::EmailNotificationService#perform`
| Silently skipped |
  | Email channel replies | Not rate limited | Paid feature |
| Suspended accounts | `ConversationReplyMailer` | Blocked at mailer
level |
2026-02-03 02:06:51 +05:30
..
agents feat: add more tools (#12116) 2025-08-08 17:57:30 +05:30
environments chore: Improvements to codespaces (#11635) 2025-05-29 21:18:02 -06:00
initializers fix: velma connection limit (#13395) 2026-01-29 20:53:41 +05:30
integration feat: notion OAuth setup (#11765) 2025-06-26 19:16:06 +05:30
languages feat: Updated public portal header design (#8089) 2023-11-08 17:56:59 -08:00
locales feat: new Captain Editor (#13235) 2026-01-21 13:39:07 +05:30
app.yml Bump version to 4.10.1 2026-01-20 08:43:11 -08:00
application.rb feat: Secure external credentials with database encryption (#12648) 2025-10-13 18:05:12 +05:30
boot.rb Upgrade to rails 6 💎 (#11) 2019-08-19 13:49:57 +05:30
cable.yml fix: Redis 6 on Heroku breaks ActionCable config (#4269) 2022-03-24 19:25:07 +05:30
database.yml perf: enable active record connection pool reaper (#10866) 2025-03-17 19:27:05 -07:00
elastic_apm.yml chore: Support for Elastic APM (#5004) 2022-07-22 11:39:37 +02:00
environment.rb Initial Commit 2019-08-14 15:18:44 +05:30
features.yml feat: Conversation workflows(EE) (#13040) 2026-01-27 11:36:20 +04:00
installation_config.yml feat: add per-account daily rate limit for outbound emails (#13411) 2026-02-03 02:06:51 +05:30
llm.yml feat: add global config for captain settings (#13141) 2026-01-12 19:54:19 +05:30
markdown_embeds.yml fix: Update Arcade embed aspect ratio (#12923) 2025-11-24 20:22:27 +05:30
newrelic.yml fix: logic error when setting new relic logging forwarding (#8687) 2024-01-11 21:05:04 +05:30
puma.rb chore: Fix puma configuration (#5023) 2022-07-12 12:27:33 +02:00
rds-ca-2019-root.pem chore: add aws rds root cert for tls connection (#3812) 2022-02-01 16:01:25 +05:30
routes.rb feat: Add first response time distribution report endpoint (#13400) 2026-01-30 22:22:27 +04:00
schedule.yml feat: add cron job to remove orphan conversations (#13335) 2026-01-28 19:25:20 +05:30
scout_apm.yml chore: Load only required APMs (#6497) 2023-03-01 14:31:51 +05:30
secrets.yml Use secret_key_base from env 2019-08-15 23:08:36 +05:30
sidekiq.yml chore: add script to throttle bulkreindex job creation and increase meta timeouts(#12626) 2025-10-13 16:21:45 +05:30
spring.rb 🚨Fix Rubocop lint errors 2019-10-20 14:17:26 +05:30
storage.yml fix: GCS credentials dont need to be parsed as JSON (#1429) 2020-11-27 14:39:25 +05:30
vite.json feat: Vite + vue 3 💚 (#10047) 2024-10-02 00:36:30 -07:00