fix: revoke tokens on demotions of superadmins

backend/.sqlx/query-192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM token WHERE email = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6"
+}

backend/windmill-api/src/users.rs

@@ -1364,6 +1364,7 @@ async fn update_user(
     require_super_admin(&db, &authed.email).await?;
     let mut tx = db.begin().await?;
 
+    let mut revoke_tokens = false;
     if let Some(sa) = eu.is_super_admin {
         sqlx::query_scalar!(
             "UPDATE password SET super_admin = $1 WHERE email = $2",
@@ -1372,6 +1373,7 @@ async fn update_user(
         )
         .execute(&mut *tx)
         .await?;
+        revoke_tokens = true;
     }
 
     if let Some(dv) = eu.is_devops {
@@ -1382,6 +1384,13 @@ async fn update_user(
         )
         .execute(&mut *tx)
         .await?;
+        revoke_tokens = true;
+    }
+
+    if revoke_tokens {
+        sqlx::query!("DELETE FROM token WHERE email = $1", &email_to_update)
+            .execute(&mut *tx)
+            .await?;
     }
 
     if let Some(n) = eu.name {