From 70db567a78b1e1bc9e2dcc9ff2139951d778117e Mon Sep 17 00:00:00 2001
From: hugocasa <hugo@casademont.ch>
Date: Fri, 9 Oct 2026 20:06:01 +0200
Subject: [PATCH] fix(cli): count superadmins as able to preserve ownership on
 push (#11653)

Claude-Session: https://claude.ai/code/session_011BzU9zd53JsTShCsbKzYzB

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 cli/src/core/permissioned_as.ts               |  8 ++++--
 cli/test/permissioned_as_context_unit.test.ts | 27 +++++++++++++++++++
 2 files changed, 33 insertions(+), 2 deletions(-)
 create mode 100644 cli/test/permissioned_as_context_unit.test.ts

diff --git a/cli/src/core/permissioned_as.ts b/cli/src/core/permissioned_as.ts
index d0301373da..87ee37a8cb 100644
--- a/cli/src/core/permissioned_as.ts
+++ b/cli/src/core/permissioned_as.ts
@@ -34,10 +34,14 @@ export async function buildPermissionedAsContext(
     return undefined;
   }
   const user = await wmill.whoami({ workspace });
+  // A superadmin acts as admin in every workspace, so the backend preserves
+  // ownership for them even when their own `usr` row there is not an admin.
   const userIsAdminOrDeployer =
-    user.is_admin || (user.groups ?? []).includes("wm_deployers");
+    user.is_admin ||
+    user.is_super_admin ||
+    (user.groups ?? []).includes("wm_deployers");
   log.debug(
-    `permissioned_as: user=${user.email}, is_admin=${user.is_admin}, groups=${JSON.stringify(user.groups)}, isAdminOrDeployer=${userIsAdminOrDeployer}`
+    `permissioned_as: user=${user.email}, is_admin=${user.is_admin}, is_super_admin=${user.is_super_admin}, groups=${JSON.stringify(user.groups)}, isAdminOrDeployer=${userIsAdminOrDeployer}`
   );
   return {
     userCache: new Map(),
diff --git a/cli/test/permissioned_as_context_unit.test.ts b/cli/test/permissioned_as_context_unit.test.ts
new file mode 100644
index 0000000000..33a24bf3a1
--- /dev/null
+++ b/cli/test/permissioned_as_context_unit.test.ts
@@ -0,0 +1,27 @@
+/**
+ * Regression guard: a superadmin whose `usr` row in the workspace is not an
+ * admin still preserves ownership on the backend, so the CLI must not refuse
+ * their push as if it would reassign every item to them.
+ */
+
+import { expect, test } from "bun:test";
+import { mockServices } from "./mock_services.ts";
+
+mockServices({
+  whoami: async () => ({
+    email: "super@windmill.dev",
+    username: "super",
+    is_admin: false,
+    is_super_admin: true,
+    groups: [],
+  }),
+});
+
+const { buildPermissionedAsContext } = await import(
+  "../src/core/permissioned_as.ts"
+);
+
+test("a superadmin with a non-admin membership counts as able to preserve", async () => {
+  const ctx = await buildPermissionedAsContext("w", "v1");
+  expect(ctx?.userIsAdminOrDeployer).toBe(true);
+});