Vishnu Narayanan c884cdefde feat: add per-account daily rate limit for outbound emails (#13411) ...

Introduce a daily cap on non-channel outbound emails to prevent abuse.

Fixes https://linear.app/chatwoot/issue/CW-6418/ses-incident-jan-28

## Type of change

- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality not to work as expected)

## Summary
- Adds a Redis-based daily counter to rate limit outbound emails per
account, preventing email abuse
- Covers continuity emails (WebWidget/API), conversation transcripts,
and agent notifications
  - Email channel replies are excluded (paid feature, not abusable)
- Adds account suspension check in `ConversationReplyMailer` to block
already-queued emails for suspended accounts

  ## Limit Resolution Hierarchy
1. Per-account override (`account.limits['emails']`) — SuperAdmin
configurable
2. Enterprise plan-based (`ACCOUNT_EMAILS_PLAN_LIMITS`
InstallationConfig)
3. Global default (`ACCOUNT_EMAILS_LIMIT` InstallationConfig, default:
100)
  4. Fallback (`ChatwootApp.max_limit` — effectively unlimited)

  ## Enforcement Points
  | Path | Where | Behavior |
  |------|-------|----------|
| WebWidget/API continuity |
`SendEmailNotificationService#should_send_email_notification?` |
Silently skipped |
| Widget transcript | `Widget::ConversationsController#transcript` |
Returns 429 |
| API transcript | `ConversationsController#transcript` | Returns 429 |
| Agent notifications | `Notification::EmailNotificationService#perform`
| Silently skipped |
  | Email channel replies | Not rate limited | Paid feature |
| Suspended accounts | `ConversationReplyMailer` | Blocked at mailer
level |

2026-02-03 02:06:51 +05:30

..

api

feat: add per-account daily rate limit for outbound emails (#13411)

2026-02-03 02:06:51 +05:30

concerns

fix: Validate blob before attaching it to a record (#13115)

2025-12-19 19:02:21 -08:00

devise_overrides

feat: Add relay state for SAML SSO (#12597)

2025-10-07 20:32:29 +05:30

google

feat: use of imap login as default if present (#10249)

2024-10-09 15:01:11 +05:30

instagram

feat: Instagram reauthorization (#11221)

2025-04-03 14:30:48 +05:30

installation

feat: Unify user and super admin credentials (#3830)

2022-01-25 16:58:49 -08:00

linear

feat: move Linear config to installation_config (#10999)

2025-02-28 14:20:27 +05:30

microsoft

feat: add Google login flow and inbox creation (#9580)

2024-06-07 16:37:46 +05:30

notion

feat: Whatsapp embedded signup (#11612)

2025-07-14 21:37:06 -07:00

platform/api/v1

feat: Add route to list accounts that belongs to a platform_app (#12140)

2025-08-11 21:23:05 +02:00

public/api/v1

fix: Incorrect contact access in conversations listing (#11797)

2025-09-22 17:05:11 +05:30

shopify

feat(apps): Shopify Integration (#11101)

2025-03-19 15:37:55 -07:00

super_admin

feat: add per-account daily rate limit for outbound emails (#13411)

2026-02-03 02:06:51 +05:30

survey

feat: Add INSTALLATION_NAME to global config (#12376)

2025-09-09 12:13:35 +05:30

tiktok

feat: TikTok channel (#12741)

2025-12-17 07:54:50 -08:00

twilio

feat: Integrate Twilio WhatsApp ProfileName for contact name resolution (#12122)

2025-08-07 12:53:39 +05:30

twitter

fix: response body in twitter callback (#6907)

2023-04-14 16:48:28 +05:30

webhooks

feat: TikTok channel (#12741)

2025-12-17 07:54:50 -08:00

android_app_controller.rb

chore: Universal Linking for Android (#2324)

2021-06-02 08:46:45 -07:00

api_controller.rb

chore: Upgrade to Rails 7 (#6719)

2023-05-06 10:44:52 +05:30

apple_app_controller.rb

Chore: Apple site association file for deep linking (#805)

2020-05-03 12:16:11 +05:30

application_controller.rb

feat: Conversation API to return applied_sla and sla_events (#9174)

2024-04-01 23:30:07 +05:30

dashboard_controller.rb

feat: Use amplitude for Cloud Analytics (#13217)

2026-01-09 09:32:09 -08:00

health_controller.rb

feat: add lightweight /health endpoint (#13386)

2026-01-29 00:24:01 +05:30

microsoft_controller.rb

chore: Automate SSL with Cloudflare (#12021)

2025-07-24 13:09:06 +04:00

oauth_callback_controller.rb

refactor: use state-based authentication (#11690)

2025-06-18 17:39:06 +05:30

platform_controller.rb

Chore: Inbox Members API improvements (#3008)

2021-09-14 11:55:02 +05:30

public_controller.rb

fix: Locale not correct in root url when accessing help center with custom domain (#9110)

2024-03-19 18:48:59 +05:30

slack_uploads_controller.rb

fix: handle active storage preview error for password protected pdfs (#11888)

2025-08-11 12:41:37 +05:30

swagger_controller.rb

chore: Enable the new Rubocop rules (#7122)

2023-05-19 14:37:10 +05:30

widget_tests_controller.rb

feat: Support Dark mode for the widget (#4137)

2022-04-01 20:59:03 +05:30

widgets_controller.rb

feat: allow configuring attachment upload limit (#12835)

2025-11-17 14:03:08 -08:00