From bfad05c438d67f835dcf3afc427c93e20a3f4eef Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@rubenfiszel.com>
Date: Sat, 7 Oct 2023 06:00:38 +0200
Subject: [PATCH] list users require being admin

---
 backend/windmill-api/src/users.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/backend/windmill-api/src/users.rs b/backend/windmill-api/src/users.rs
index dd184f2bf9..8e15f3dd69 100644
--- a/backend/windmill-api/src/users.rs
+++ b/backend/windmill-api/src/users.rs
@@ -717,6 +717,9 @@ async fn list_users(
     Extension(user_db): Extension<UserDB>,
     Path(w_id): Path<String>,
 ) -> JsonResult<Vec<UserWithUsage>> {
+    if *CLOUD_HOSTED && w_id == "demo" {
+        require_admin(authed.is_admin, &authed.username)?;
+    }
     let mut tx = user_db.begin(&authed).await?;
     let rows = sqlx::query(
         "