From 5aa0be811254ee27d85ea3a7180b9c1306e70ada Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@rubenfiszel.com>
Date: Fri, 24 Mar 2023 13:22:56 +0100
Subject: [PATCH] make superadmin_email permission be inherited by ephemeral
 tokens

---
 backend/windmill-common/src/users.rs  | 2 ++
 backend/windmill-worker/src/worker.rs | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/backend/windmill-common/src/users.rs b/backend/windmill-common/src/users.rs
index 0f1d0a211c..772670af74 100644
--- a/backend/windmill-common/src/users.rs
+++ b/backend/windmill-common/src/users.rs
@@ -6,6 +6,8 @@
  * LICENSE-AGPL for a copy of the license.
  */
 
+pub const SUPERADMIN_SECRET_EMAIL: &str = "superadmin_secret@windmill.dev";
+
 pub fn username_to_permissioned_as(user: &str) -> String {
     if user.contains('@') {
         user.to_string()
diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs
index 992fc2ad3b..d5dba98c4f 100644
--- a/backend/windmill-worker/src/worker.rs
+++ b/backend/windmill-worker/src/worker.rs
@@ -25,7 +25,7 @@ use windmill_common::{
     flows::{FlowModuleValue, FlowValue},
     scripts::{ScriptHash, ScriptLang},
     utils::rd_string,
-    variables, BASE_URL,
+    variables, BASE_URL, users::SUPERADMIN_SECRET_EMAIL,
 };
 use windmill_queue::{canceled_job_to_result, get_queued_job, pull, JobKind, QueuedJob, CLOUD_HOSTED};
 
@@ -241,7 +241,7 @@ pub async fn create_token_for_owner<'c>(
     let is_super_admin = sqlx::query_scalar!("SELECT super_admin FROM password WHERE email = $1", email)
             .fetch_optional(&mut tx)
             .await?
-            .unwrap_or(false);
+            .unwrap_or(false) || email == SUPERADMIN_SECRET_EMAIL;
 
     sqlx::query_scalar!(
         "INSERT INTO token