kalugin66/windmill
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[ee] refactor: use password.disabled for SCIM deactivation, block login for disabled users

Browse Source 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
hugocasa
2026-03-25 10:45:48 +01:00
parent a441069f10
commit d65a0b2647
12 changed files with 80 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
backend/.sqlx/query-c8b50b6ff9e73844e14fc36f01c324415093cd5c904cba0825c69afd37d1eeb5.json → backend/.sqlx/query-192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6.json generated
View File

@@ -1,6 +1,6 @@
{
"db_name": "PostgreSQL",
"query": "DELETE FROM scim_deactivated_user WHERE email = $1",
"query": "DELETE FROM token WHERE email = $1",
"describe": {
"columns": [],
"parameters": {
@@ -10,5 +10,5 @@
},
"nullable": []
},
"hash": "c8b50b6ff9e73844e14fc36f01c324415093cd5c904cba0825c69afd37d1eeb5"
"hash": "192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6"
}

14
backend/.sqlx/query-1d0e4015ddca083d210cb8cf759b5bc0fca32b608327ff475f66a48de88d8f9a.json generated
View File

@@ -1,14 +0,0 @@
{
"db_name": "PostgreSQL",
"query": "INSERT INTO scim_deactivated_user (email, name) SELECT email, name FROM password WHERE email = $1 ON CONFLICT (email) DO UPDATE SET deactivated_at = NOW(), name = EXCLUDED.name",
"describe": {
"columns": [],
"parameters": {
"Left": [
"Text"
]
},
"nullable": []
},
"hash": "1d0e4015ddca083d210cb8cf759b5bc0fca32b608327ff475f66a48de88d8f9a"
}

28
backend/.sqlx/query-23b9c862d050b00aaa332527b62ef901cd3c417b9f3af03f35009213143bd443.json generated Normal file
View File

@@ -0,0 +1,28 @@
{
"db_name": "PostgreSQL",
"query": "SELECT email, disabled FROM password WHERE email = $1",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "email",
"type_info": "Varchar"
},
{
"ordinal": 1,
"name": "disabled",
"type_info": "Bool"
}
],
"parameters": {
"Left": [
"Text"
]
},
"nullable": [
false,
false
]
},
"hash": "23b9c862d050b00aaa332527b62ef901cd3c417b9f3af03f35009213143bd443"
}

15
backend/.sqlx/query-8bd266705fc8272f3d8941922ad7d18161eb6f5ec1ba9f1b55feffe8b6518c67.json generated Normal file
View File

@@ -0,0 +1,15 @@
{
"db_name": "PostgreSQL",
"query": "UPDATE password SET disabled = $1 WHERE email = $2",
"describe": {
"columns": [],
"parameters": {
"Left": [
"Bool",
"Text"
]
},
"nullable": []
},
"hash": "8bd266705fc8272f3d8941922ad7d18161eb6f5ec1ba9f1b55feffe8b6518c67"
}

4
backend/.sqlx/query-6d33c5aa3965682831d0cb3f1d8ca17c7a59c468f6758be0dc4391734987b412.json → backend/.sqlx/query-99c289a8bcf87588ecb89575f66e1fbfce74dd6b69a8a039714a02ce7558a1b3.json generated
View File

@@ -1,6 +1,6 @@
{
"db_name": "PostgreSQL",
"query": "SELECT instance_group.id, COALESCE(instance_group.scim_display_name, instance_group.name) as display_name\n FROM email_to_igroup\n JOIN instance_group ON instance_group.name = email_to_igroup.igroup\n WHERE email_to_igroup.email = $1",
"query": "SELECT instance_group.id, COALESCE(instance_group.scim_display_name, instance_group.name) as display_name\n FROM email_to_igroup\n JOIN instance_group ON instance_group.name = email_to_igroup.igroup\n WHERE email_to_igroup.email = $1",
"describe": {
"columns": [
{
@@ -24,5 +24,5 @@
null
]
},
"hash": "6d33c5aa3965682831d0cb3f1d8ca17c7a59c468f6758be0dc4391734987b412"
"hash": "99c289a8bcf87588ecb89575f66e1fbfce74dd6b69a8a039714a02ce7558a1b3"
}

22
backend/.sqlx/query-ccc49a2a6e11f874825365de758bdc0e1934d67d3f2b14047d434b77d370af21.json generated Normal file
View File

@@ -0,0 +1,22 @@
{
"db_name": "PostgreSQL",
"query": "SELECT super_admin FROM password WHERE email = $1 AND disabled = false",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "super_admin",
"type_info": "Bool"
}
],
"parameters": {
"Left": [
"Text"
]
},
"nullable": [
false
]
},
"hash": "ccc49a2a6e11f874825365de758bdc0e1934d67d3f2b14047d434b77d370af21"
}

4
backend/.sqlx/query-638d3c2ba1198dce5b5b0e47df59a92ff8011e19fbefcc3960d6f0fe167e55b6.json → backend/.sqlx/query-daa1a6bf3d4a1001da88301932a7ac9019767074158e0c027988e5b0d51a3656.json generated
View File

@@ -1,6 +1,6 @@
{
"db_name": "PostgreSQL",
"query": "INSERT INTO password (email, login_type, verified, username, name) VALUES ($1, 'saml', true, $2, $3) ON CONFLICT DO NOTHING",
"query": "INSERT INTO password (email, login_type, verified, username, name) VALUES ($1, 'saml', true, $2, $3) ON CONFLICT (email) DO UPDATE SET disabled = false",
"describe": {
"columns": [],
"parameters": {
@@ -12,5 +12,5 @@
},
"nullable": []
},
"hash": "638d3c2ba1198dce5b5b0e47df59a92ff8011e19fbefcc3960d6f0fe167e55b6"
"hash": "daa1a6bf3d4a1001da88301932a7ac9019767074158e0c027988e5b0d51a3656"
}

8
backend/.sqlx/query-b8a99e0658a97e9c4950f37a8e68e19d1723bcb5bfa05f50fa22e30683d98ee5.json → backend/.sqlx/query-fc6c6310ae8ac5eb351d7e2af1678447d0aa3d143e94e49924ff7ac8b7abf924.json generated
View File

@@ -1,11 +1,11 @@
{
"db_name": "PostgreSQL",
"query": "SELECT EXISTS(SELECT 1 FROM scim_deactivated_user WHERE email = $1)",
"query": "SELECT disabled FROM password WHERE email = $1",
"describe": {
"columns": [
{
"ordinal": 0,
"name": "exists",
"name": "disabled",
"type_info": "Bool"
}
],
@@ -15,8 +15,8 @@
]
},
"nullable": [
null
false
]
},
"hash": "b8a99e0658a97e9c4950f37a8e68e19d1723bcb5bfa05f50fa22e30683d98ee5"
"hash": "fc6c6310ae8ac5eb351d7e2af1678447d0aa3d143e94e49924ff7ac8b7abf924"
}

2
backend/ee-repo-ref.txt
View File

@@ -1 +1 @@
a3a554aa2a142aef61cf346160272ec95397d961
e505e0413649966e36fc02c7f2bf293fe153334f

2
backend/migrations/20260324000000_scim_deactivated_user.down.sql
View File

@@ -1 +1 @@
DROP TABLE IF EXISTS scim_deactivated_user;
ALTER TABLE password DROP COLUMN IF EXISTS disabled;

6
backend/migrations/20260324000000_scim_deactivated_user.up.sql
View File

@@ -1,5 +1 @@
CREATE TABLE scim_deactivated_user (
email VARCHAR(255) PRIMARY KEY,
name VARCHAR(255),
deactivated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
);
ALTER TABLE password ADD COLUMN disabled BOOLEAN NOT NULL DEFAULT false;

4
backend/windmill-api-users/src/users.rs
View File

@@ -1687,7 +1687,7 @@ async fn login(
};
let email_w_h: Option<(String, String, bool)> = sqlx::query_as(
"SELECT email, password_hash, super_admin FROM password WHERE email = $1 AND login_type = \
'password'",
'password' AND disabled = false",
)
.bind(&email)
.fetch_optional(&mut *tx)
@@ -1776,7 +1776,7 @@ async fn refresh_token(
}
let super_admin = sqlx::query_scalar!(
"SELECT super_admin FROM password WHERE email = $1",
"SELECT super_admin FROM password WHERE email = $1 AND disabled = false",
&authed.email
)
.fetch_optional(&mut *tx)