Vishnu Narayanan c884cdefde feat: add per-account daily rate limit for outbound emails (#13411) ...

Introduce a daily cap on non-channel outbound emails to prevent abuse.

Fixes https://linear.app/chatwoot/issue/CW-6418/ses-incident-jan-28

## Type of change

- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality not to work as expected)

## Summary
- Adds a Redis-based daily counter to rate limit outbound emails per
account, preventing email abuse
- Covers continuity emails (WebWidget/API), conversation transcripts,
and agent notifications
  - Email channel replies are excluded (paid feature, not abusable)
- Adds account suspension check in `ConversationReplyMailer` to block
already-queued emails for suspended accounts

  ## Limit Resolution Hierarchy
1. Per-account override (`account.limits['emails']`) — SuperAdmin
configurable
2. Enterprise plan-based (`ACCOUNT_EMAILS_PLAN_LIMITS`
InstallationConfig)
3. Global default (`ACCOUNT_EMAILS_LIMIT` InstallationConfig, default:
100)
  4. Fallback (`ChatwootApp.max_limit` — effectively unlimited)

  ## Enforcement Points
  | Path | Where | Behavior |
  |------|-------|----------|
| WebWidget/API continuity |
`SendEmailNotificationService#should_send_email_notification?` |
Silently skipped |
| Widget transcript | `Widget::ConversationsController#transcript` |
Returns 429 |
| API transcript | `ConversationsController#transcript` | Returns 429 |
| Agent notifications | `Notification::EmailNotificationService#perform`
| Silently skipped |
  | Email channel replies | Not rate limited | Paid feature |
| Suspended accounts | `ConversationReplyMailer` | Blocked at mailer
level |

2026-02-03 02:06:51 +05:30

..

actions

fix: Disable enqueueing Avatar jobs if the URL is invalid (#12035)

2025-07-24 12:56:39 +04:00

assets

feat: Move email attachments from links to file attachments (#11304)

2025-04-15 23:43:12 -07:00

builders

feat: Add first response time distribution report endpoint (#13400)

2026-01-30 22:22:27 +04:00

channels

fix: Move contact events to account stream rather than individual user stream (#11082)

2025-03-13 17:46:48 -07:00

config

fix: Update Arcade embed aspect ratio (#12923)

2025-11-24 20:22:27 +05:30

configs

chore: Enable the new Rubocop rules (#7122)

2023-05-19 14:37:10 +05:30

controllers

feat: Add first response time distribution report endpoint (#13400)

2026-01-30 22:22:27 +04:00

dispatchers

Non blocking event dispatch (#652)

2020-03-29 19:18:30 +05:30

drops

feat: Add the support for custom attributes in message variables (#8511)

2023-12-08 14:13:35 -08:00

enterprise

fix: Increase the parallelism config to fix flaky tests, revert bad commits (#13410)

2026-01-30 12:49:31 -08:00

factories

fix: Setup webhooks for manual WhatsApp Cloud channel creation (#13278)

2026-01-19 14:12:36 +04:00

finders

feat: add SKIP_INCOMING_BCC_PROCESSING as internal config (#12484)

2025-09-22 17:52:56 +05:30

fixtures

feat: Add BE changes for captain pdf support for faq generation (#12113)

2025-08-27 20:31:22 +05:30

helpers

chore: Refactor UTM params to stay compliant with standards (#12312)

2025-08-29 11:46:52 -07:00

integration

Fix url in emails, add frontendURL helper (#19)

2019-08-25 19:59:28 +05:30

jobs

fix: Increase the parallelism config to fix flaky tests, revert bad commits (#13410)

2026-01-30 12:49:31 -08:00

lib

feat: search documentation tool for reply suggestions (#13340)

2026-01-30 16:18:33 +05:30

listeners

fix: prevent deserialization error on deletion (#13264)

2026-01-14 18:00:12 +05:30

mailboxes

feat(CW-6187): include headers from incoming emails (#13139)

2026-01-07 12:45:54 +05:30

mailers

feat: speed up circleci and github actions (#12849)

2025-11-19 15:32:48 +05:30

models

feat: add per-account daily rate limit for outbound emails (#13411)

2026-02-03 02:06:51 +05:30

policies

chore: Enforce custom role permissions on conversation access (#12583)

2025-10-22 20:23:37 -07:00

presenters

fix: sanitize integer fields to prevent Elasticsearch mapping errors (#13276)

2026-01-22 18:29:49 +05:30

requests/api/v1

feat: APIs to assign agents_bots as assignee in conversations (#12836)

2025-11-18 18:20:58 -08:00

services

feat: add per-account daily rate limit for outbound emails (#13411)

2026-02-03 02:06:51 +05:30

support

feat: Advanced Search Backend (#12917)

2026-01-07 15:30:49 +05:30

coverage_helper.rb

ci(circleci): switch coverage reporting to Qlty orb (#12337)

2025-08-31 00:39:34 +05:30

rails_helper.rb

fix: resolve mutex conflicts in Instagram webhook specs (#12154)

2025-08-11 23:31:25 +05:30

spec_helper.rb

ci(circleci): switch coverage reporting to Qlty orb (#12337)

2025-08-31 00:39:34 +05:30

test_helper.rb

ci(circleci): switch coverage reporting to Qlty orb (#12337)

2025-08-31 00:39:34 +05:30