From 1c6af66a84da5cbeeb76bd8833da528ea74f021b Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Wed, 10 Sep 2025 09:20:11 +0000
Subject: [PATCH] fix: revoke tokens on demotions of superadmins

---
 ...44483024d9826a328bf0416c22daf06fff5ced08f6.json | 14 ++++++++++++++
 backend/windmill-api/src/users.rs                  |  9 +++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 backend/.sqlx/query-192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6.json

diff --git a/backend/.sqlx/query-192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6.json b/backend/.sqlx/query-192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6.json
new file mode 100644
index 0000000000..dc7c41cfd3
--- /dev/null
+++ b/backend/.sqlx/query-192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM token WHERE email = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6"
+}
diff --git a/backend/windmill-api/src/users.rs b/backend/windmill-api/src/users.rs
index c0b7c3d665..825c26f682 100644
--- a/backend/windmill-api/src/users.rs
+++ b/backend/windmill-api/src/users.rs
@@ -1364,6 +1364,7 @@ async fn update_user(
     require_super_admin(&db, &authed.email).await?;
     let mut tx = db.begin().await?;
 
+    let mut revoke_tokens = false;
     if let Some(sa) = eu.is_super_admin {
         sqlx::query_scalar!(
             "UPDATE password SET super_admin = $1 WHERE email = $2",
@@ -1372,6 +1373,7 @@ async fn update_user(
         )
         .execute(&mut *tx)
         .await?;
+        revoke_tokens = true;
     }
 
     if let Some(dv) = eu.is_devops {
@@ -1382,6 +1384,13 @@ async fn update_user(
         )
         .execute(&mut *tx)
         .await?;
+        revoke_tokens = true;
+    }
+
+    if revoke_tokens {
+        sqlx::query!("DELETE FROM token WHERE email = $1", &email_to_update)
+            .execute(&mut *tx)
+            .await?;
     }
 
     if let Some(n) = eu.name {