fix: block disabled users from token refresh, clear error on OAuth login

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/.sqlx/query-21f4840f60e8310d7b7efcba7483e69e4ef8821c6cbf3b4f296b3853d95692af.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT COUNT(*) FROM usr WHERE workspace_id = $1 AND disabled = false",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "count",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "21f4840f60e8310d7b7efcba7483e69e4ef8821c6cbf3b4f296b3853d95692af"
-}

backend/.sqlx/query-d09706517cbc4763bcd4010a3de2c868e9ad2361ff56bb64a1ff12dab8c124b1.json

@@ -1,12 +1,17 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT super_admin FROM password WHERE email = $1 AND disabled = false",
+  "query": "SELECT super_admin, disabled FROM password WHERE email = $1",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
         "name": "super_admin",
         "type_info": "Bool"
+      },
+      {
+        "ordinal": 1,
+        "name": "disabled",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -15,8 +20,9 @@
       ]
     },
     "nullable": [
+      false,
       false
     ]
   },
-  "hash": "ccc49a2a6e11f874825365de758bdc0e1934d67d3f2b14047d434b77d370af21"
+  "hash": "d09706517cbc4763bcd4010a3de2c868e9ad2361ff56bb64a1ff12dab8c124b1"
 }

backend/ee-repo-ref.txt

@@ -1 +1 @@
-30f8c53b101b9e25107e793cdc038b0e07061739
+7e3a0afd393646a7179278febe593fa598252fed

backend/windmill-api-users/src/users.rs

@@ -1797,13 +1797,20 @@ async fn refresh_token(
         }
     }
 
-    let super_admin = sqlx::query_scalar!(
-        "SELECT super_admin FROM password WHERE email = $1 AND disabled = false",
+    let password_row = sqlx::query!(
+        "SELECT super_admin, disabled FROM password WHERE email = $1",
         &authed.email
     )
     .fetch_optional(&mut *tx)
-    .await?
-    .unwrap_or(false);
+    .await?;
+
+    if password_row.as_ref().map(|r| r.disabled).unwrap_or(false) {
+        return Err(Error::NotAuthorized(
+            "Your account has been disabled".to_string(),
+        ));
+    }
+
+    let super_admin = password_row.map(|r| r.super_admin).unwrap_or(false);
 
     let new_token = create_session_token(&authed.email, super_admin, &mut tx, cookies).await?;