rodrigo/iachat
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity
ef6ba8aabd
iachat/enterprise/app
History
Vishnu Narayanan c884cdefde
feat: add per-account daily rate limit for outbound emails (#13411) 
Introduce a daily cap on non-channel outbound emails to prevent abuse.

Fixes https://linear.app/chatwoot/issue/CW-6418/ses-incident-jan-28

## Type of change

- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality not to work as expected)

## Summary
- Adds a Redis-based daily counter to rate limit outbound emails per
account, preventing email abuse
- Covers continuity emails (WebWidget/API), conversation transcripts,
and agent notifications
  - Email channel replies are excluded (paid feature, not abusable)
- Adds account suspension check in `ConversationReplyMailer` to block
already-queued emails for suspended accounts

  ## Limit Resolution Hierarchy
1. Per-account override (`account.limits['emails']`) — SuperAdmin
configurable
2. Enterprise plan-based (`ACCOUNT_EMAILS_PLAN_LIMITS`
InstallationConfig)
3. Global default (`ACCOUNT_EMAILS_LIMIT` InstallationConfig, default:
100)
  4. Fallback (`ChatwootApp.max_limit` — effectively unlimited)

  ## Enforcement Points
  | Path | Where | Behavior |
  |------|-------|----------|
| WebWidget/API continuity |
`SendEmailNotificationService#should_send_email_notification?` |
Silently skipped |
| Widget transcript | `Widget::ConversationsController#transcript` |
Returns 429 |
| API transcript | `ConversationsController#transcript` | Returns 429 |
| Agent notifications | `Notification::EmailNotificationService#perform`
| Silently skipped |
  | Email channel replies | Not rate limited | Paid feature |
| Suspended accounts | `ConversationReplyMailer` | Blocked at mailer
level |
2026-02-03 02:06:51 +05:30
..
builders feat: outbound voice call essentials (#12782) 2025-11-24 17:47:00 -08:00
controllers feat: Conversation workflows(EE) (#13040) 2026-01-27 11:36:20 +04:00
dispatchers/enterprise feat(ee): Add Captain features (#10665) 2025-01-14 16:15:47 -08:00
drops feat: Add push/email notification support for SLA (#9140) 2024-03-29 20:27:21 +11:00
fields feat: add per-account daily rate limit for outbound emails (#13411) 2026-02-03 02:06:51 +05:30
finders/enterprise feat: Conversation API to return applied_sla and sla_events (#9174) 2024-04-01 23:30:07 +05:30
helpers fix: captain assistant image comprehension (#13390) 2026-01-28 16:07:13 -08:00
jobs fix: consistent instrumentation with conversation.display_id (#13194) 2026-01-08 12:27:44 +05:30
listeners feat: Add support for realtime-events in copilot-threads and copilot-messages (#11557) 2025-05-22 22:25:05 -07:00
mailers/enterprise/agent_notifications chore: fix sla email notifications (#9192) 2024-04-04 21:16:49 +05:30
models feat: add per-account daily rate limit for outbound emails (#13411) 2026-02-03 02:06:51 +05:30
policies feat(ee): Review Notes for CSAT Reports (#13289) 2026-01-15 19:53:57 -08:00
presenters/enterprise/conversations feat: UI to show the SLA threshold in chat screen (#9146) 2024-04-04 15:46:46 +05:30
services feat: search documentation tool for reply suggestions (#13340) 2026-01-30 16:18:33 +05:30
views feat: Backend - Companies API endpoint with pagination and search (#12840) 2025-11-18 14:28:56 +05:30