From d4eeb507874badcfd6614d0338f2e767621995b7 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Tue, 27 Jan 2026 18:13:48 +0000
Subject: [PATCH] fix: do not delete tokens on being promoted to superadmins

---
 ...1f7f387f5055c47f493271d26731336257384.json | 10 +++---
 ...024d9826a328bf0416c22daf06fff5ced08f6.json | 14 --------
 ...153c43903f929ae5d62fbba12610f89c36d55.json |  2 +-
 ...630668a2776fc7a253a6e747653338d10dbd0.json | 15 ++++++++
 backend/windmill-api/src/users.rs             | 34 +++++++++++++++----
 5 files changed, 48 insertions(+), 27 deletions(-)
 delete mode 100644 backend/.sqlx/query-192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6.json
 create mode 100644 backend/.sqlx/query-be303445868662af7b7475f19dc630668a2776fc7a253a6e747653338d10dbd0.json

diff --git a/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json b/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
index d29a18c691..e7ed0aee65 100644
--- a/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
+++ b/backend/.sqlx/query-07168aaf14cb6beff0ad4274b441f7f387f5055c47f493271d26731336257384.json
@@ -46,11 +46,11 @@
       ]
     },
     "nullable": [
-      true,
-      true,
-      true,
-      true,
-      true,
+      false,
+      false,
+      false,
+      false,
+      false,
       true,
       true
     ]
diff --git a/backend/.sqlx/query-192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6.json b/backend/.sqlx/query-192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6.json
deleted file mode 100644
index dc7c41cfd3..0000000000
--- a/backend/.sqlx/query-192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "DELETE FROM token WHERE email = $1",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6"
-}
diff --git a/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json b/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
index 713ccb9dd3..36ddb8ab9f 100644
--- a/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
+++ b/backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json
@@ -15,7 +15,7 @@
       ]
     },
     "nullable": [
-      null
+      true
     ]
   },
   "hash": "5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55"
diff --git a/backend/.sqlx/query-be303445868662af7b7475f19dc630668a2776fc7a253a6e747653338d10dbd0.json b/backend/.sqlx/query-be303445868662af7b7475f19dc630668a2776fc7a253a6e747653338d10dbd0.json
new file mode 100644
index 0000000000..fefd006379
--- /dev/null
+++ b/backend/.sqlx/query-be303445868662af7b7475f19dc630668a2776fc7a253a6e747653338d10dbd0.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE token SET super_admin = $1 WHERE email = $2 AND label != 'session'",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "be303445868662af7b7475f19dc630668a2776fc7a253a6e747653338d10dbd0"
+}
diff --git a/backend/windmill-api/src/users.rs b/backend/windmill-api/src/users.rs
index 3876346fd7..af83d0d715 100644
--- a/backend/windmill-api/src/users.rs
+++ b/backend/windmill-api/src/users.rs
@@ -1603,7 +1603,7 @@ async fn update_user(
     require_super_admin(&db, &authed.email).await?;
     let mut tx = db.begin().await?;
 
-    let mut revoke_tokens = false;
+    let mut new_super_admin: Option<bool> = None;
     if let Some(sa) = eu.is_super_admin {
         sqlx::query_scalar!(
             "UPDATE password SET super_admin = $1 WHERE email = $2",
@@ -1612,7 +1612,7 @@ async fn update_user(
         )
         .execute(&mut *tx)
         .await?;
-        revoke_tokens = true;
+        new_super_admin = Some(sa);
     }
 
     if let Some(dv) = eu.is_devops {
@@ -1623,13 +1623,33 @@ async fn update_user(
         )
         .execute(&mut *tx)
         .await?;
-        revoke_tokens = true;
+        // If super_admin wasn't explicitly set, we still need to refresh tokens
+        if new_super_admin.is_none() {
+            new_super_admin = sqlx::query_scalar!(
+                "SELECT super_admin FROM password WHERE email = $1",
+                &email_to_update
+            )
+            .fetch_optional(&mut *tx)
+            .await?;
+        }
     }
 
-    if revoke_tokens {
-        sqlx::query!("DELETE FROM token WHERE email = $1", &email_to_update)
-            .execute(&mut *tx)
-            .await?;
+    if let Some(sa) = new_super_admin {
+        // Delete session tokens to force re-login with new privileges
+        sqlx::query!(
+            "DELETE FROM token WHERE email = $1 AND label = 'session'",
+            &email_to_update
+        )
+        .execute(&mut *tx)
+        .await?;
+        // Update super_admin flag on non-session tokens (webhooks, API tokens, etc.)
+        sqlx::query!(
+            "UPDATE token SET super_admin = $1 WHERE email = $2 AND label != 'session'",
+            sa,
+            &email_to_update
+        )
+        .execute(&mut *tx)
+        .await?;
     }
 
     if let Some(n) = eu.name {