[ee] feat: enforce password.disabled in auth checks

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/.sqlx/query-db162dd3ee5036e00b7196e21dc2127f42e33e5d98430fdcd48161b10f2fcecd.json

@@ -1,15 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "UPDATE usr SET disabled = $1 WHERE email = $2",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Bool",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "db162dd3ee5036e00b7196e21dc2127f42e33e5d98430fdcd48161b10f2fcecd"
-}

backend/ee-repo-ref.txt

@@ -1 +1 @@
-d6236db87c821b4abafe76c07294513b2c5434c1
+2089be6a6e534865c11794452391f6e25708f32c

backend/windmill-api-auth/src/auth.rs

@@ -233,6 +233,22 @@ impl AuthCache {
                 .flatten();
 
                 if let Some(user) = user_o {
+                    // Check if user is disabled at the instance level
+                    if let Some(ref email) = user.1 {
+                        let is_disabled = sqlx::query_scalar!(
+                            "SELECT disabled FROM password WHERE email = $1",
+                            email
+                        )
+                        .fetch_optional(&self.db)
+                        .await
+                        .ok()
+                        .flatten()
+                        .unwrap_or(false);
+                        if is_disabled {
+                            return None;
+                        }
+                    }
+
                     let authed_o = {
                         match user {
                             (Some(owner), Some(email), super_admin, _, label) if w_id.is_some() => {

backend/windmill-api-users/src/users.rs

@@ -1687,7 +1687,7 @@ async fn login(
     };
     let email_w_h: Option<(String, String, bool)> = sqlx::query_as(
         "SELECT email, password_hash, super_admin FROM password WHERE email = $1 AND login_type = \
-         'password'",
+         'password' AND disabled = false",
     )
     .bind(&email)
     .fetch_optional(&mut *tx)

backend/windmill-common/src/auth.rs

@@ -328,6 +328,15 @@ async fn fetch_authed_from_permissioned_as_inner(
     w_id: &str,
     conn: &mut sqlx::PgConnection,
 ) -> Result<Authed> {
+    let is_disabled = sqlx::query_scalar!("SELECT disabled FROM password WHERE email = $1", email)
+        .fetch_optional(&mut *conn)
+        .await
+        .map_err(|e| Error::internal_err(format!("fetching disabled: {e:#}")))?
+        .unwrap_or(false);
+    if is_disabled {
+        return Err(Error::NotAuthorized("User is disabled".to_string()));
+    }
+
     let is_super_admin = permissioned_as == SUPERADMIN_SYNC_EMAIL
         || email == SUPERADMIN_SECRET_EMAIL
         || email == SUPERADMIN_NOTIFICATION_EMAIL