From f229a21e046257f988c890aa42ca0db634525bf7 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 19 Jun 2026 12:25:59 +0000
Subject: [PATCH] fix(backend): clean up unique_ext_jwt_token on workspace
 deletion

The workspace_id column on unique_ext_jwt_token (migration 20260409145556)
has no FK constraint on the workspace table, and delete_workspace did not
remove its rows. Deleted workspaces left orphaned external JWT token records
that kept appearing in the superadmin External JWTs listing.

Add a DELETE FROM unique_ext_jwt_token WHERE workspace_id = $1 alongside the
other per-table cleanup statements in delete_workspace.

Fixes WIN-2078

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ...51e6e0ea01a3ffac15dd96ed7d8cc237a0c4e06a9a.json | 14 ++++++++++++++
 .../src/workspaces_extra.rs                        |  7 +++++++
 2 files changed, 21 insertions(+)
 create mode 100644 backend/.sqlx/query-9efca0a4f5ce030f90224951e6e0ea01a3ffac15dd96ed7d8cc237a0c4e06a9a.json

diff --git a/backend/.sqlx/query-9efca0a4f5ce030f90224951e6e0ea01a3ffac15dd96ed7d8cc237a0c4e06a9a.json b/backend/.sqlx/query-9efca0a4f5ce030f90224951e6e0ea01a3ffac15dd96ed7d8cc237a0c4e06a9a.json
new file mode 100644
index 0000000000..23ec222c5a
--- /dev/null
+++ b/backend/.sqlx/query-9efca0a4f5ce030f90224951e6e0ea01a3ffac15dd96ed7d8cc237a0c4e06a9a.json
@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM unique_ext_jwt_token WHERE workspace_id = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "9efca0a4f5ce030f90224951e6e0ea01a3ffac15dd96ed7d8cc237a0c4e06a9a"
+}
diff --git a/backend/windmill-api-workspaces/src/workspaces_extra.rs b/backend/windmill-api-workspaces/src/workspaces_extra.rs
index aa64514b4c..fe0638aa64 100644
--- a/backend/windmill-api-workspaces/src/workspaces_extra.rs
+++ b/backend/windmill-api-workspaces/src/workspaces_extra.rs
@@ -847,6 +847,13 @@ pub(crate) async fn delete_workspace(
         .execute(&mut *tx)
         .await?;
 
+    sqlx::query!(
+        "DELETE FROM unique_ext_jwt_token WHERE workspace_id = $1",
+        &w_id
+    )
+    .execute(&mut *tx)
+    .await?;
+
     sqlx::query!("DELETE FROM http_trigger WHERE workspace_id = $1", &w_id)
         .execute(&mut *tx)
         .await?;