fix: do not delete tokens on being promoted to superadmins

backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json

@@ -46,11 +46,11 @@
       ]
     },
     "nullable": [
-      true,
-      true,
-      true,
-      true,
-      true,
+      false,
+      false,
+      false,
+      false,
+      false,
       true,
       true
     ]

backend/.sqlx/query-192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6.json

@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM token WHERE email = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6"
-}

backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json

@@ -15,7 +15,7 @@
       ]
     },
     "nullable": [
-      null
+      true
     ]
   },
   "hash": "5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55"

backend/.sqlx/query-be303445868662af7b7475f19dc630668a2776fc7a253a6e747653338d10dbd0.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE token SET super_admin = $1 WHERE email = $2 AND label != 'session'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "be303445868662af7b7475f19dc630668a2776fc7a253a6e747653338d10dbd0"
+}

backend/windmill-api/src/users.rs

@@ -1603,7 +1603,7 @@ async fn update_user(
     require_super_admin(&db, &authed.email).await?;
     let mut tx = db.begin().await?;
 
-    let mut revoke_tokens = false;
+    let mut new_super_admin: Option<bool> = None;
     if let Some(sa) = eu.is_super_admin {
         sqlx::query_scalar!(
             "UPDATE password SET super_admin = $1 WHERE email = $2",
@@ -1612,7 +1612,7 @@ async fn update_user(
         )
         .execute(&mut *tx)
         .await?;
-        revoke_tokens = true;
+        new_super_admin = Some(sa);
     }
 
     if let Some(dv) = eu.is_devops {
@@ -1623,13 +1623,33 @@ async fn update_user(
         )
         .execute(&mut *tx)
         .await?;
-        revoke_tokens = true;
+        // If super_admin wasn't explicitly set, we still need to refresh tokens
+        if new_super_admin.is_none() {
+            new_super_admin = sqlx::query_scalar!(
+                "SELECT super_admin FROM password WHERE email = $1",
+                &email_to_update
+            )
+            .fetch_optional(&mut *tx)
+            .await?;
+        }
     }
 
-    if revoke_tokens {
-        sqlx::query!("DELETE FROM token WHERE email = $1", &email_to_update)
-            .execute(&mut *tx)
-            .await?;
+    if let Some(sa) = new_super_admin {
+        // Delete session tokens to force re-login with new privileges
+        sqlx::query!(
+            "DELETE FROM token WHERE email = $1 AND label = 'session'",
+            &email_to_update
+        )
+        .execute(&mut *tx)
+        .await?;
+        // Update super_admin flag on non-session tokens (webhooks, API tokens, etc.)
+        sqlx::query!(
+            "UPDATE token SET super_admin = $1 WHERE email = $2 AND label != 'session'",
+            sa,
+            &email_to_update
+        )
+        .execute(&mut *tx)
+        .await?;
     }
 
     if let Some(n) = eu.name {