Vishnu Narayanan c884cdefde feat: add per-account daily rate limit for outbound emails (#13411) ...

Introduce a daily cap on non-channel outbound emails to prevent abuse.

Fixes https://linear.app/chatwoot/issue/CW-6418/ses-incident-jan-28

## Type of change

- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality not to work as expected)

## Summary
- Adds a Redis-based daily counter to rate limit outbound emails per
account, preventing email abuse
- Covers continuity emails (WebWidget/API), conversation transcripts,
and agent notifications
  - Email channel replies are excluded (paid feature, not abusable)
- Adds account suspension check in `ConversationReplyMailer` to block
already-queued emails for suspended accounts

  ## Limit Resolution Hierarchy
1. Per-account override (`account.limits['emails']`) — SuperAdmin
configurable
2. Enterprise plan-based (`ACCOUNT_EMAILS_PLAN_LIMITS`
InstallationConfig)
3. Global default (`ACCOUNT_EMAILS_LIMIT` InstallationConfig, default:
100)
  4. Fallback (`ChatwootApp.max_limit` — effectively unlimited)

  ## Enforcement Points
  | Path | Where | Behavior |
  |------|-------|----------|
| WebWidget/API continuity |
`SendEmailNotificationService#should_send_email_notification?` |
Silently skipped |
| Widget transcript | `Widget::ConversationsController#transcript` |
Returns 429 |
| API transcript | `ConversationsController#transcript` | Returns 429 |
| Agent notifications | `Notification::EmailNotificationService#perform`
| Silently skipped |
  | Email channel replies | Not rate limited | Paid feature |
| Suspended accounts | `ConversationReplyMailer` | Blocked at mailer
level |

2026-02-03 02:06:51 +05:30

..

account

fix: account email validation during signup (#11307)

2025-05-20 20:45:39 -07:00

auto_assignment

feat: Assignment service (v2) (#12320)

2025-11-17 10:08:25 +05:30

automation_rules

feat: Add support for labels in automations (#11658)

2025-09-18 14:17:54 +05:30

base

chore: Add cache to improve widget performance (#11163)

2025-03-24 16:04:49 -07:00

contacts

feat: outbound voice call essentials (#12782)

2025-11-24 17:47:00 -08:00

conversations

fix: Force account_id in the query (#13388)

2026-01-28 14:51:24 -08:00

crm

feat: save timezone from leadsquared API (#11583)

2025-05-28 09:46:59 +05:30

data_import

fix: downcase email before finding (#8921)

2024-02-21 18:51:00 +05:30

email

chore: Migrate mailers from the worker to jobs (#12331)

2025-10-21 16:36:37 -07:00

email_templates

chore: Fix emails being sent with the wrong translations (#2236)

2021-06-08 22:45:01 +05:30

facebook

feat: hide CSAT survey URLs from agents in dashboard (#11622)

2025-06-11 23:39:47 +05:30

geocoder

fix: ip-lookup database lazy loading for all environments (#8052)

2024-10-22 23:18:30 -07:00

google

feat: add Google Email fetch and OAuth token refresh service (#9603)

2024-06-11 14:22:03 +05:30

imap

feat: add Google Email fetch and OAuth token refresh service (#9603)

2024-06-11 14:22:03 +05:30

instagram

fix: Handle Instagram API error codes properly in message processing (#13002)

2025-12-04 18:53:50 +05:30

internal

feat: add cron job to remove orphan conversations (#13335)

2026-01-28 19:25:20 +05:30

labels

fix: Update associations when a label is updated (#3046)

2021-09-21 10:16:32 +05:30

line

fix: Ensure messages go to correct conversation when receive multi user in 1 LINE webhook (#12322)

2025-09-22 17:05:25 +05:30

linear

feat: Add activity messages for linear actions (#11654)

2025-06-13 11:57:11 +05:30

liquid

feat: Add liquid processing for SMS campaigns (#10981)

2025-06-11 13:16:44 -04:00

llm_formatter

feat: new Captain Editor (#13235)

2026-01-21 13:39:07 +05:30

macros

feat: Add webhook event support for macros (#11235)

2025-04-02 20:26:55 -07:00

mailbox

refactor: strategy pattern for mailbox conversation finding (#12766)

2025-11-10 20:47:18 +05:30

message_templates

fix: Respect survey label rules for WhatsApp CSAT template (#13285)

2026-01-15 22:16:00 -08:00

messages

feat: add per-account daily rate limit for outbound emails (#13411)

2026-02-03 02:06:51 +05:30

mfa

feat: MFA (#12290)

2025-09-18 20:19:24 +05:30

microsoft

feat: add Google Email fetch and OAuth token refresh service (#9603)

2024-06-11 14:22:03 +05:30

notification

feat: add per-account daily rate limit for outbound emails (#13411)

2026-02-03 02:06:51 +05:30

sms

fix: Error shouldn't halt the campaign for entire audience (#11980)

2025-08-11 12:03:48 +05:30

telegram

fix: stream attachment handling in workers (#12870)

2025-12-05 13:02:53 -08:00

tiktok

feat: Handle external echo messages from native apps (#13371)

2026-02-02 15:52:53 +05:30

twilio

feat: Add support for sending CSAT surveys via templates (Whatsapp Twilio) (#13143)

2026-01-13 16:32:02 +04:00

twitter

feat: hide CSAT survey URLs from agents in dashboard (#11622)

2025-06-11 23:39:47 +05:30

whatsapp

fix: Subscribe app to WABA before overriding webhook callback URL (#13279)

2026-02-02 16:50:35 +05:30

widget

feat: MFA (#12290)

2025-09-18 20:19:24 +05:30

account_deletion_service.rb

feat: automate account deletion (#11406)

2025-05-23 12:58:13 +05:30

action_service.rb

feat: add mark pending action to automation (#13378)

2026-02-02 11:59:51 +05:30

base_refresh_oauth_token_service.rb

feat: add Google Email fetch and OAuth token refresh service (#9603)

2024-06-11 14:22:03 +05:30

base_token_service.rb

feat: MFA (#12290)

2025-09-18 20:19:24 +05:30

csat_survey_service.rb

fix: Respect survey label rules for WhatsApp CSAT template (#13285)

2026-01-15 22:16:00 -08:00

csat_template_management_service.rb

feat: Add support for sending CSAT surveys via templates (Whatsapp Twilio) (#13143)

2026-01-13 16:32:02 +04:00

csat_template_name_service.rb

feat: Add support for sending CSAT surveys via templates (Whatsapp Twilio) (#13143)

2026-01-13 16:32:02 +04:00

filter_service.rb

chore: Ability to filter conversations with priority (#10967)

2025-03-03 16:38:22 +05:30

ip_lookup_service.rb

feat(poc): Disable widget based on country (#6658)

2023-03-14 09:09:57 -07:00

search_service.rb

feat: Advanced Search Backend (#12917)

2026-01-07 15:30:49 +05:30