[ee] refactor: use scim_deactivated_user table instead of password.disabled

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/.sqlx/query-6d33c5aa3965682831d0cb3f1d8ca17c7a59c468f6758be0dc4391734987b412.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT instance_group.id, COALESCE(instance_group.scim_display_name, instance_group.name) as display_name\n         FROM email_to_igroup\n         JOIN instance_group ON instance_group.name = email_to_igroup.igroup\n         WHERE email_to_igroup.email = $1",
+  "query": "SELECT instance_group.id, COALESCE(instance_group.scim_display_name, instance_group.name) as display_name\n             FROM email_to_igroup\n             JOIN instance_group ON instance_group.name = email_to_igroup.igroup\n             WHERE email_to_igroup.email = $1",
   "describe": {
     "columns": [
       {
@@ -24,5 +24,5 @@
       null
     ]
   },
-  "hash": "99c289a8bcf87588ecb89575f66e1fbfce74dd6b69a8a039714a02ce7558a1b3"
+  "hash": "6d33c5aa3965682831d0cb3f1d8ca17c7a59c468f6758be0dc4391734987b412"
 }

backend/.sqlx/query-9c3b928e73f4ed8ce8c75f0defb1d0d40c989bdce132736cfdc5a3c96f600091.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO scim_deactivated_user (email) VALUES ($1) ON CONFLICT (email) DO NOTHING",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Varchar"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9c3b928e73f4ed8ce8c75f0defb1d0d40c989bdce132736cfdc5a3c96f600091"
+}

backend/.sqlx/query-b8a99e0658a97e9c4950f37a8e68e19d1723bcb5bfa05f50fa22e30683d98ee5.json

@@ -1,11 +1,11 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT disabled FROM password WHERE email = $1",
+  "query": "SELECT EXISTS(SELECT 1 FROM scim_deactivated_user WHERE email = $1)",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "disabled",
+        "name": "exists",
         "type_info": "Bool"
       }
     ],
@@ -15,8 +15,8 @@
       ]
     },
     "nullable": [
-      false
+      null
     ]
   },
-  "hash": "fc6c6310ae8ac5eb351d7e2af1678447d0aa3d143e94e49924ff7ac8b7abf924"
+  "hash": "b8a99e0658a97e9c4950f37a8e68e19d1723bcb5bfa05f50fa22e30683d98ee5"
 }

backend/.sqlx/query-c8b50b6ff9e73844e14fc36f01c324415093cd5c904cba0825c69afd37d1eeb5.json

@@ -1,15 +1,14 @@
 {
   "db_name": "PostgreSQL",
-  "query": "UPDATE password SET disabled = $1 WHERE email = $2",
+  "query": "DELETE FROM scim_deactivated_user WHERE email = $1",
   "describe": {
     "columns": [],
     "parameters": {
       "Left": [
-        "Bool",
         "Text"
       ]
     },
     "nullable": []
   },
-  "hash": "8bd266705fc8272f3d8941922ad7d18161eb6f5ec1ba9f1b55feffe8b6518c67"
+  "hash": "c8b50b6ff9e73844e14fc36f01c324415093cd5c904cba0825c69afd37d1eeb5"
 }

backend/ee-repo-ref.txt

@@ -1 +1 @@
-2089be6a6e534865c11794452391f6e25708f32c
+70df2da1483760297f138277a58a708416604008

backend/migrations/20260323000000_password_disabled.up.sql

@@ -1 +0,0 @@
-ALTER TABLE password ADD COLUMN disabled BOOLEAN NOT NULL DEFAULT false;

backend/migrations/20260323000000_scim_deactivated_user.up.sql

@@ -0,0 +1,4 @@
+CREATE TABLE scim_deactivated_user (
+    email VARCHAR(255) PRIMARY KEY,
+    deactivated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);

backend/windmill-api-auth/src/auth.rs

@@ -233,22 +233,6 @@ impl AuthCache {
                 .flatten();
 
                 if let Some(user) = user_o {
-                    // Check if user is disabled at the instance level
-                    if let Some(ref email) = user.1 {
-                        let is_disabled = sqlx::query_scalar!(
-                            "SELECT disabled FROM password WHERE email = $1",
-                            email
-                        )
-                        .fetch_optional(&self.db)
-                        .await
-                        .ok()
-                        .flatten()
-                        .unwrap_or(false);
-                        if is_disabled {
-                            return None;
-                        }
-                    }
-
                     let authed_o = {
                         match user {
                             (Some(owner), Some(email), super_admin, _, label) if w_id.is_some() => {

backend/windmill-api-users/src/users.rs

@@ -1687,7 +1687,7 @@ async fn login(
     };
     let email_w_h: Option<(String, String, bool)> = sqlx::query_as(
         "SELECT email, password_hash, super_admin FROM password WHERE email = $1 AND login_type = \
-         'password' AND disabled = false",
+         'password'",
     )
     .bind(&email)
     .fetch_optional(&mut *tx)

backend/windmill-common/src/auth.rs

@@ -328,15 +328,6 @@ async fn fetch_authed_from_permissioned_as_inner(
     w_id: &str,
     conn: &mut sqlx::PgConnection,
 ) -> Result<Authed> {
-    let is_disabled = sqlx::query_scalar!("SELECT disabled FROM password WHERE email = $1", email)
-        .fetch_optional(&mut *conn)
-        .await
-        .map_err(|e| Error::internal_err(format!("fetching disabled: {e:#}")))?
-        .unwrap_or(false);
-    if is_disabled {
-        return Err(Error::NotAuthorized("User is disabled".to_string()));
-    }
-
     let is_super_admin = permissioned_as == SUPERADMIN_SYNC_EMAIL
         || email == SUPERADMIN_SECRET_EMAIL
         || email == SUPERADMIN_NOTIFICATION_EMAIL