implement limits on outgoing messages for an account

by default 1000 messages per day, and to max 200 first-time receivers.
i don't think a person would reach those limits. a compromised account abused
by spammers could easily reach that limit. this prevents further damage.

the error message you will get is quite clear, pointing to the configuration
parameter that should be changed.

http/admin.go

@@ -1481,6 +1481,12 @@ func (Admin) SetPassword(ctx context.Context, accountName, password string) {
 	xcheckf(ctx, err, "setting password")
 }
 
+// SetAccountLimits set new limits on outgoing messages for an account.
+func (Admin) SetAccountLimits(ctx context.Context, accountName string, maxOutgoingMessagesPerDay, maxFirstTimeRecipientsPerDay int) {
+	err := mox.AccountLimitsSave(ctx, accountName, maxOutgoingMessagesPerDay, maxFirstTimeRecipientsPerDay)
+	xcheckf(ctx, err, "saving account limits")
+}
+
 // ClientConfigDomain returns configurations for email clients, IMAP and
 // Submission (SMTP) for the domain.
 func (Admin) ClientConfigDomain(ctx context.Context, domain string) mox.ClientConfig {

http/admin.html

@@ -476,6 +476,7 @@ const account = async (name) => {
 	const config = await api.Account(name)
 
 	let form, fieldset, email
+	let formSendlimits, fieldsetSendlimits, maxOutgoingMessagesPerDay, maxFirstTimeRecipientsPerDay
 	let formPassword, fieldsetPassword, password, passwordHint
 
 	const page = document.getElementById('page')
@@ -576,6 +577,42 @@ const account = async (name) => {
 			),
 		),
 		dom.br(),
+		dom.h2('Send limits'),
+		formSendlimits=dom.form(
+			fieldsetSendlimits=dom.fieldset(
+				dom.label(
+					style({display: 'inline-block'}),
+					dom.span('Maximum outgoing messages per day', attr({title: 'Maximum number of outgoing messages for this account in a 24 hour window. This limits the damage to recipients and the reputation of this mail server in case of account compromise. Default 1000. MaxOutgoingMessagesPerDay in configuration file.'})),
+					dom.br(),
+					maxOutgoingMessagesPerDay=dom.input(attr({type: 'number', required: '', value: config.MaxOutgoingMessagesPerDay || 1000})),
+				),
+				' ',
+				dom.label(
+					style({display: 'inline-block'}),
+					dom.span('Maximum first-time recipients per day', attr({title: 'Maximum number of first-time recipients in outgoing messages for this account in a 24 hour window. This limits the damage to recipients and the reputation of this mail server in case of account compromise. Default 200. MaxFirstTimeRecipientsPerDay in configuration file.'})),
+					dom.br(),
+					maxFirstTimeRecipientsPerDay=dom.input(attr({type: 'number', required: '', value: config.MaxFirstTimeRecipientsPerDay || 200})),
+				),
+				' ',
+				dom.button('Save'),
+			),
+			async function submit(e) {
+				e.stopPropagation()
+				e.preventDefault()
+				fieldsetSendlimits.disabled = true
+				try {
+					await api.SetAccountLimits(name, parseInt(maxOutgoingMessagesPerDay.value) || 0, parseInt(maxFirstTimeRecipientsPerDay.value) || 0)
+					window.alert('Send limits saved.')
+				} catch (err) {
+					console.log({err})
+					window.alert('Error: ' + err.message)
+					return
+				} finally {
+					fieldsetSendlimits.disabled = false
+				}
+			},
+		),
+		dom.br(),
 		dom.h2('Set new password'),
 		formPassword=dom.form(
 			fieldsetPassword=dom.fieldset(

http/adminapi.json

@@ -518,6 +518,31 @@
 			],
 			"Returns": []
 		},
+		{
+			"Name": "SetAccountLimits",
+			"Docs": "SetAccountLimits set new limits on outgoing messages for an account.",
+			"Params": [
+				{
+					"Name": "accountName",
+					"Typewords": [
+						"string"
+					]
+				},
+				{
+					"Name": "maxOutgoingMessagesPerDay",
+					"Typewords": [
+						"int32"
+					]
+				},
+				{
+					"Name": "maxFirstTimeRecipientsPerDay",
+					"Typewords": [
+						"int32"
+					]
+				}
+			],
+			"Returns": []
+		},
 		{
 			"Name": "ClientConfigDomain",
 			"Docs": "ClientConfigDomain returns configurations for email clients, IMAP and\nSubmission (SMTP) for the domain.",