fix: address PR review comments

- Add LIMIT 1000 to list_instance_emails SQL query
- Add loading state to prevent UI flash in AddUser
- Show email validation error only after blur
- Guard loadInstanceEmails with workspaceStore check

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/.sqlx/query-f11d3a43f804a33e412a69be54824d7666d4dac0b824095c4c4fefb1f802c6f7.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT email FROM password ORDER BY email",
+  "query": "SELECT email FROM password ORDER BY email LIMIT 1000",
   "describe": {
     "columns": [
       {
@@ -16,5 +16,5 @@
       false
     ]
   },
-  "hash": "21e9a9fc33dcdb66a2c8e95b1359ca1b3e04b4ecf155757abf5798834ebfd0ce"
+  "hash": "f11d3a43f804a33e412a69be54824d7666d4dac0b824095c4c4fefb1f802c6f7"
 }

backend/windmill-api-users/src/users.rs

@@ -431,7 +431,7 @@ async fn list_instance_emails(
         ));
     }
     require_admin(authed.is_admin, &authed.username)?;
-    let rows = sqlx::query_scalar!("SELECT email FROM password ORDER BY email")
+    let rows = sqlx::query_scalar!("SELECT email FROM password ORDER BY email LIMIT 1000")
         .fetch_all(&db)
         .await?;
     Ok(Json(rows))

frontend/src/lib/components/AddUser.svelte

@@ -37,6 +37,7 @@
 	getAutomateUsernameCreationSetting()
 
 	let allInstanceEmails: string[] | undefined = $state(undefined)
+	let emailsLoading = $state(!isCloudHosted())
 
 	let instanceEmails = $derived.by(() => {
 		if (!allInstanceEmails) return undefined
@@ -47,11 +48,13 @@
 	})
 
 	async function loadInstanceEmails() {
-		if (isCloudHosted()) return
+		if (isCloudHosted() || !$workspaceStore) return
 		try {
-			allInstanceEmails = await UserService.listInstanceEmails({ workspace: $workspaceStore! })
+			allInstanceEmails = await UserService.listInstanceEmails({ workspace: $workspaceStore })
 		} catch {
 			allInstanceEmails = undefined
+		} finally {
+			emailsLoading = false
 		}
 	}
 	loadInstanceEmails()
@@ -95,8 +98,9 @@
 		dispatch('new')
 	}
 
+	let emailTouched = $state(false)
 	let emailError = $derived.by(() => {
-		if (!email) return undefined
+		if (!email || !emailTouched) return undefined
 		const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 		return emailRegex.test(email) ? undefined : 'Please enter a valid email address'
 	})
@@ -115,17 +119,30 @@
 			<span class="text-sm mb-2 leading-6 font-semibold">Add a new user</span>
 
 			<span class="text-xs mb-1 leading-6">Email</span>
-			{#if instanceEmails}
+			{#if emailsLoading}
+				<AutocompleteSelect
+					placeholder="Loading..."
+					loading={true}
+					disablePortal={true}
+					bind:value={email}
+				/>
+			{:else if instanceEmails}
 				<AutocompleteSelect
 					items={instanceEmails}
 					bind:value={email}
 					placeholder="Select or type an email"
 					disablePortal={true}
 					error={!!emailError}
+					onBlur={() => (emailTouched = true)}
 				/>
 			{:else}
 				<TextInput
-					inputProps={{ type: 'email', onkeyup: handleKeyUp, placeholder: 'email' }}
+					inputProps={{
+						type: 'email',
+						onkeyup: handleKeyUp,
+						placeholder: 'email',
+						onblur: () => (emailTouched = true)
+					}}
 					bind:value={email}
 					error={!!emailError}
 				/>