Vishnu Narayanan c884cdefde feat: add per-account daily rate limit for outbound emails (#13411) ...

Introduce a daily cap on non-channel outbound emails to prevent abuse.

Fixes https://linear.app/chatwoot/issue/CW-6418/ses-incident-jan-28

## Type of change

- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality not to work as expected)

## Summary
- Adds a Redis-based daily counter to rate limit outbound emails per
account, preventing email abuse
- Covers continuity emails (WebWidget/API), conversation transcripts,
and agent notifications
  - Email channel replies are excluded (paid feature, not abusable)
- Adds account suspension check in `ConversationReplyMailer` to block
already-queued emails for suspended accounts

  ## Limit Resolution Hierarchy
1. Per-account override (`account.limits['emails']`) — SuperAdmin
configurable
2. Enterprise plan-based (`ACCOUNT_EMAILS_PLAN_LIMITS`
InstallationConfig)
3. Global default (`ACCOUNT_EMAILS_LIMIT` InstallationConfig, default:
100)
  4. Fallback (`ChatwootApp.max_limit` — effectively unlimited)

  ## Enforcement Points
  | Path | Where | Behavior |
  |------|-------|----------|
| WebWidget/API continuity |
`SendEmailNotificationService#should_send_email_notification?` |
Silently skipped |
| Widget transcript | `Widget::ConversationsController#transcript` |
Returns 429 |
| API transcript | `ConversationsController#transcript` | Returns 429 |
| Agent notifications | `Notification::EmailNotificationService#perform`
| Silently skipped |
  | Email channel replies | Not rate limited | Paid feature |
| Suspended accounts | `ConversationReplyMailer` | Blocked at mailer
level |

2026-02-03 02:06:51 +05:30

..

agents

feat: add more tools (#12116)

2025-08-08 17:57:30 +05:30

environments

chore: Improvements to codespaces (#11635)

2025-05-29 21:18:02 -06:00

initializers

fix: velma connection limit (#13395)

2026-01-29 20:53:41 +05:30

integration

feat: notion OAuth setup (#11765)

2025-06-26 19:16:06 +05:30

languages

feat: Updated public portal header design (#8089)

2023-11-08 17:56:59 -08:00

locales

feat: new Captain Editor (#13235)

2026-01-21 13:39:07 +05:30

app.yml

Bump version to 4.10.1

2026-01-20 08:43:11 -08:00

application.rb

feat: Secure external credentials with database encryption (#12648)

2025-10-13 18:05:12 +05:30

boot.rb

Upgrade to rails 6 💎 (#11)

2019-08-19 13:49:57 +05:30

cable.yml

fix: Redis 6 on Heroku breaks ActionCable config (#4269)

2022-03-24 19:25:07 +05:30

database.yml

perf: enable active record connection pool reaper (#10866)

2025-03-17 19:27:05 -07:00

elastic_apm.yml

chore: Support for Elastic APM (#5004)

2022-07-22 11:39:37 +02:00

environment.rb

Initial Commit

2019-08-14 15:18:44 +05:30

features.yml

feat: Conversation workflows(EE) (#13040)

2026-01-27 11:36:20 +04:00

installation_config.yml

feat: add per-account daily rate limit for outbound emails (#13411)

2026-02-03 02:06:51 +05:30

llm.yml

feat: add global config for captain settings (#13141)

2026-01-12 19:54:19 +05:30

markdown_embeds.yml

fix: Update Arcade embed aspect ratio (#12923)

2025-11-24 20:22:27 +05:30

newrelic.yml

fix: logic error when setting new relic logging forwarding (#8687)

2024-01-11 21:05:04 +05:30

puma.rb

chore: Fix puma configuration (#5023)

2022-07-12 12:27:33 +02:00

rds-ca-2019-root.pem

chore: add aws rds root cert for tls connection (#3812)

2022-02-01 16:01:25 +05:30

routes.rb

feat: Add first response time distribution report endpoint (#13400)

2026-01-30 22:22:27 +04:00

schedule.yml

feat: add cron job to remove orphan conversations (#13335)

2026-01-28 19:25:20 +05:30

scout_apm.yml

chore: Load only required APMs (#6497)

2023-03-01 14:31:51 +05:30

secrets.yml

Use secret_key_base from env

2019-08-15 23:08:36 +05:30

sidekiq.yml

chore: add script to throttle bulkreindex job creation and increase meta timeouts(#12626)

2025-10-13 16:21:45 +05:30

spring.rb

🚨Fix Rubocop lint errors

2019-10-20 14:17:26 +05:30

storage.yml

fix: GCS credentials dont need to be parsed as JSON (#1429)

2020-11-27 14:39:25 +05:30

vite.json

feat: Vite + vue 3 💚 (#10047)

2024-10-02 00:36:30 -07:00