c884cdefde
Introduce a daily cap on non-channel outbound emails to prevent abuse. Fixes https://linear.app/chatwoot/issue/CW-6418/ses-incident-jan-28 ## Type of change - [x] New feature (non-breaking change which adds functionality) - [x] Breaking change (fix or feature that would cause existing functionality not to work as expected) ## Summary - Adds a Redis-based daily counter to rate limit outbound emails per account, preventing email abuse - Covers continuity emails (WebWidget/API), conversation transcripts, and agent notifications - Email channel replies are excluded (paid feature, not abusable) - Adds account suspension check in `ConversationReplyMailer` to block already-queued emails for suspended accounts ## Limit Resolution Hierarchy 1. Per-account override (`account.limits['emails']`) — SuperAdmin configurable 2. Enterprise plan-based (`ACCOUNT_EMAILS_PLAN_LIMITS` InstallationConfig) 3. Global default (`ACCOUNT_EMAILS_LIMIT` InstallationConfig, default: 100) 4. Fallback (`ChatwootApp.max_limit` — effectively unlimited) ## Enforcement Points | Path | Where | Behavior | |------|-------|----------| | WebWidget/API continuity | `SendEmailNotificationService#should_send_email_notification?` | Silently skipped | | Widget transcript | `Widget::ConversationsController#transcript` | Returns 429 | | API transcript | `ConversationsController#transcript` | Returns 429 | | Agent notifications | `Notification::EmailNotificationService#perform` | Silently skipped | | Email channel replies | Not rate limited | Paid feature | | Suspended accounts | `ConversationReplyMailer` | Blocked at mailer level |
41 lines
1.3 KiB
Ruby
41 lines
1.3 KiB
Ruby
class Messages::SendEmailNotificationService
|
|
pattr_initialize [:message!]
|
|
|
|
def perform
|
|
return unless should_send_email_notification?
|
|
|
|
conversation = message.conversation
|
|
conversation_mail_key = format(::Redis::Alfred::CONVERSATION_MAILER_KEY, conversation_id: conversation.id)
|
|
|
|
# Atomically set redis key to prevent duplicate email workers. Keep the key alive longer than
|
|
# the worker delay (1 hour) so slow queues don't enqueue duplicate jobs, but let it expire if
|
|
# the worker never manages to clean up.
|
|
return unless Redis::Alfred.set(conversation_mail_key, message.id, nx: true, ex: 1.hour.to_i)
|
|
|
|
ConversationReplyEmailJob.set(wait: 2.minutes).perform_later(conversation.id, message.id)
|
|
message.account.increment_email_sent_count
|
|
end
|
|
|
|
private
|
|
|
|
def should_send_email_notification?
|
|
return false unless message.email_notifiable_message?
|
|
return false if message.conversation.contact.email.blank?
|
|
return false unless message.account.within_email_rate_limit?
|
|
|
|
email_reply_enabled?
|
|
end
|
|
|
|
def email_reply_enabled?
|
|
inbox = message.inbox
|
|
case inbox.channel.class.to_s
|
|
when 'Channel::WebWidget'
|
|
inbox.channel.continuity_via_email
|
|
when 'Channel::Api'
|
|
inbox.account.feature_enabled?('email_continuity_on_api_channel')
|
|
else
|
|
false
|
|
end
|
|
end
|
|
end
|