chatwoot/app/controllers/api/v1/accounts at summaries - chatwoot - Leal Cyber Git

akadmin/chatwoot

Files

T

History

Vishnu NarayananandGitHub c884cdefde feat: add per-account daily rate limit for outbound emails (#13411 )

Introduce a daily cap on non-channel outbound emails to prevent abuse.

Fixes https://linear.app/chatwoot/issue/CW-6418/ses-incident-jan-28

## Type of change

- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality not to work as expected)

## Summary
- Adds a Redis-based daily counter to rate limit outbound emails per
account, preventing email abuse
- Covers continuity emails (WebWidget/API), conversation transcripts,
and agent notifications
  - Email channel replies are excluded (paid feature, not abusable)
- Adds account suspension check in `ConversationReplyMailer` to block
already-queued emails for suspended accounts

  ## Limit Resolution Hierarchy
1. Per-account override (`account.limits['emails']`) — SuperAdmin
configurable
2. Enterprise plan-based (`ACCOUNT_EMAILS_PLAN_LIMITS`
InstallationConfig)
3. Global default (`ACCOUNT_EMAILS_LIMIT` InstallationConfig, default:
100)
  4. Fallback (`ChatwootApp.max_limit` — effectively unlimited)

  ## Enforcement Points
  | Path | Where | Behavior |
  |------|-------|----------|
| WebWidget/API continuity |
`SendEmailNotificationService#should_send_email_notification?` |
Silently skipped |
| Widget transcript | `Widget::ConversationsController#transcript` |
Returns 429 |
| API transcript | `ConversationsController#transcript` | Returns 429 |
| Agent notifications | `Notification::EmailNotificationService#perform`
| Silently skipped |
  | Email channel replies | Not rate limited | Paid feature |
| Suspended accounts | `ConversationReplyMailer` | Blocked at mailer
level |

2026-02-03 02:06:51 +05:30

..

feat: Reverse the contact merge (#8057 )

2023-10-10 08:20:48 +05:30

assignment_policies

feat: Add assignment policies controllers with jbuilder views (#12199 )

2025-08-18 19:15:21 -07:00

feat: add global config for captain settings (#13141 )

2026-01-12 19:54:19 +05:30

fix: Remove account_id from params since it is not used (#13116 )

2025-12-19 17:07:53 -08:00

feat: Add support for search_conversations in copilot (#11520 )

2025-05-20 19:22:17 -07:00

feat: APIs to assign agents_bots as assignee in conversations (#12836 )

2025-11-18 18:20:58 -08:00

refactor: use state-based authentication (#11690 )

2025-06-18 17:39:06 +05:30

feat: Add assignment policies controllers with jbuilder views (#12199 )

2025-08-18 19:15:21 -07:00

refactor: use state-based authentication (#11690 )

2025-06-18 17:39:06 +05:30

chore: Enforce custom role permissions on conversation access (#12583 )

2025-10-22 20:23:37 -07:00

refactor: use state-based authentication (#11690 )

2025-06-18 17:39:06 +05:30

feat: Whatsapp embedded signup (#11612 )

2025-07-14 21:37:06 -07:00

feat: TikTok channel (#12741 )

2025-12-17 07:54:50 -08:00

fix: Twitter inbox creation error (#1783 )

2021-02-16 19:35:10 +05:30

chore: Enable flexible whatsapp onboarding (Manual + Embedded Signup) options (#12344 )

2025-09-15 19:59:56 +05:30

agent_bots_controller.rb

feat: APIs to assign agents_bots as assignee in conversations (#12836 )

2025-11-18 18:20:58 -08:00

agents_controller.rb

fix: Removing repetitive name parameter in AgentsController (#11259 )

2025-04-09 08:53:13 +05:30

articles_controller.rb

fix: respect status parameter when creating articles via API (#12846 )

2025-11-13 12:07:24 +05:30

assignable_agents_controller.rb

chore: Add Assignable Agents API (#4722 )

2022-05-23 19:24:07 +05:30

assignment_policies_controller.rb

feat: Add assignment policies controllers with jbuilder views (#12199 )

2025-08-18 19:15:21 -07:00

automation_rules_controller.rb

fix: Validate blob before attaching it to a record (#13115 )

2025-12-19 19:02:21 -08:00

base_controller.rb

Feat: authenticate direct upload (#4160 )

2022-03-16 13:54:18 +05:30

bulk_actions_controller.rb

feat: Bulk delete for contacts (#12778 )

2025-11-04 17:47:53 -08:00

callbacks_controller.rb

fix: Fetch all facebook pages during inbox creation (#11956 )

2025-07-17 18:32:12 +05:30

campaigns_controller.rb

feat: WhatsApp campaigns (#11910 )

2025-07-16 09:04:02 +05:30

canned_responses_controller.rb

fix: order for canned response (#6400 )

2023-02-06 12:53:48 -08:00

categories_controller.rb

feat: Adds the ability to set an emoji for help center category (#8111 )

2023-10-20 13:52:30 +05:30

contact_inboxes_controller.rb

chore: Add an API to find the contacts using contact inbox sourceId (#8012 )

2023-09-28 15:26:28 -07:00

contacts_controller.rb

feat: Add infinite scroll to contacts search page (#13376 )

2026-01-27 18:55:19 -08:00

conversations_controller.rb

feat: add per-account daily rate limit for outbound emails (#13411 )

2026-02-03 02:06:51 +05:30

csat_survey_responses_controller.rb

feat(ee): Review Notes for CSAT Reports (#13289 )

2026-01-15 19:53:57 -08:00

custom_attribute_definitions_controller.rb

feat: Support Regex validation for custom attributes (#7856 )

2024-01-23 18:01:57 +04:00

custom_filters_controller.rb

fix: Allow resource access without filter type in custom_filters API (#11445 )

2025-05-08 20:12:05 -07:00

dashboard_apps_controller.rb

feat: Allow users to create dashboard apps to give agents more context (#4761 )

2022-06-01 11:13:10 +05:30

inbox_csat_templates_controller.rb

feat: Add support for sending CSAT surveys via templates (Whatsapp Twilio) (#13143 )

2026-01-13 16:32:02 +04:00

inbox_members_controller.rb

feat: invalidate cache after inbox members or team members update (#10869 )

2025-02-20 21:28:38 -08:00

inboxes_controller.rb

feat: Add support for sending CSAT surveys via templates (Whatsapp Twilio) (#13143 )

2026-01-13 16:32:02 +04:00

labels_controller.rb

chore: Use "destroy!" instead of "destroy" when not checking the return value (#4259 )

2022-03-24 13:28:25 +05:30

macros_controller.rb

fix: Validate blob before attaching it to a record (#13115 )

2025-12-19 19:02:21 -08:00

notification_settings_controller.rb

Chore: Code Cleanup in API controllers (#932 )

2020-06-07 13:58:05 +05:30

notifications_controller.rb

feat: Update last_snoozed_at after the un-snooze notification (#8943 )

2024-02-20 18:55:39 +05:30

oauth_authorization_controller.rb

refactor: use state-based authentication (#11690 )

2025-06-18 17:39:06 +05:30

portals_controller.rb

fix: Validate blob before attaching it to a record (#13115 )

2025-12-19 19:02:21 -08:00

search_controller.rb

feat: Advanced Search Backend (#12917 )

2026-01-07 15:30:49 +05:30

team_members_controller.rb

feat: invalidate cache after inbox members or team members update (#10869 )

2025-02-20 21:28:38 -08:00

teams_controller.rb

chore: Use "destroy!" instead of "destroy" when not checking the return value (#4259 )

2022-03-24 13:28:25 +05:30

upload_controller.rb

fix: Validate blob before attaching it to a record (#13115 )

2025-12-19 19:02:21 -08:00

webhooks_controller.rb

feat(webhooks): add name to webhook (#12641 )

2025-11-13 13:28:15 +05:30

working_hours_controller.rb

feat: Business hours

2020-11-01 00:14:33 +05:30