fix: block disabled users from token refresh, clear error on OAuth login

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/.sqlx/query-115a9cb44d0a41952c08dc36e0331410d32a8d672cfa4929e9e3763c51daa1bc.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT email, login_type::text, verified, super_admin, devops, name, company, username, NULL::bool as operator_only, first_time_user, role_source FROM password ORDER BY super_admin DESC, devops DESC, email LIMIT $1 OFFSET $2",
+  "query": "SELECT email, login_type::text, verified, super_admin, devops, name, company, username, NULL::bool as operator_only, first_time_user, role_source, disabled FROM password ORDER BY super_admin DESC, devops DESC, email LIMIT $1 OFFSET $2",
   "describe": {
     "columns": [
       {
@@ -57,6 +57,11 @@
         "ordinal": 10,
         "name": "role_source",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 11,
+        "name": "disabled",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -76,8 +81,9 @@
       true,
       null,
       false,
+      false,
       false
     ]
   },
-  "hash": "05027983ffdb11824190543754d0be922e1463d2046753cf80377369a90013ab"
+  "hash": "115a9cb44d0a41952c08dc36e0331410d32a8d672cfa4929e9e3763c51daa1bc"
 }

backend/.sqlx/query-192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "DELETE FROM token WHERE email = $1",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6"
+}

backend/.sqlx/query-21f4840f60e8310d7b7efcba7483e69e4ef8821c6cbf3b4f296b3853d95692af.json

@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT COUNT(*) FROM usr WHERE workspace_id = $1 AND disabled = false",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "count",
-        "type_info": "Int8"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "21f4840f60e8310d7b7efcba7483e69e4ef8821c6cbf3b4f296b3853d95692af"
-}

backend/.sqlx/query-23b9c862d050b00aaa332527b62ef901cd3c417b9f3af03f35009213143bd443.json

@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT email, disabled FROM password WHERE email = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "disabled",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "23b9c862d050b00aaa332527b62ef901cd3c417b9f3af03f35009213143bd443"
+}

backend/.sqlx/query-5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55.json

@@ -15,7 +15,7 @@
       ]
     },
     "nullable": [
-      null
+      true
     ]
   },
   "hash": "5a219a2532517869578c4504ff3153c43903f929ae5d62fbba12610f89c36d55"

backend/.sqlx/query-8bd266705fc8272f3d8941922ad7d18161eb6f5ec1ba9f1b55feffe8b6518c67.json

@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE password SET disabled = $1 WHERE email = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "8bd266705fc8272f3d8941922ad7d18161eb6f5ec1ba9f1b55feffe8b6518c67"
+}

backend/.sqlx/query-9f07510019ebe6f0c5fa17bf31c2d14755474cba82b3b388a47585a8bb325b1a.json

@@ -1,17 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO deployment_metadata (workspace_id, path, script_hash, deployment_msg) VALUES ($1, $2, $3, $4) ON CONFLICT (workspace_id, script_hash) WHERE script_hash IS NOT NULL DO UPDATE SET deployment_msg = EXCLUDED.deployment_msg",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Varchar",
-        "Varchar",
-        "Int8",
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "9f07510019ebe6f0c5fa17bf31c2d14755474cba82b3b388a47585a8bb325b1a"
-}

backend/.sqlx/query-a5fd115e7be5129d623543bbfa7b5b31f0efc6d8ef73f691009c73f833dcee10.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "WITH active_users AS (SELECT distinct username as email FROM (SELECT username, timestamp, operation FROM audit_partitioned UNION ALL SELECT username, timestamp, operation FROM audit) AS a WHERE timestamp > NOW() - INTERVAL '1 month' AND (operation = 'users.login' OR operation = 'oauth.login' OR operation = 'users.token.refresh')),\n            authors as (SELECT distinct email FROM usr WHERE usr.operator IS false)\n            SELECT email, email NOT IN (SELECT email FROM authors) as operator_only, login_type::text, verified, super_admin, devops, name, company, username, first_time_user, role_source\n            FROM password\n            WHERE email IN (SELECT email FROM active_users)\n            ORDER BY super_admin DESC, devops DESC\n            LIMIT $1 OFFSET $2",
+  "query": "WITH active_users AS (SELECT distinct username as email FROM (SELECT username, timestamp, operation FROM audit_partitioned UNION ALL SELECT username, timestamp, operation FROM audit) AS a WHERE timestamp > NOW() - INTERVAL '1 month' AND (operation = 'users.login' OR operation = 'oauth.login' OR operation = 'users.token.refresh')),\n            authors as (SELECT distinct email FROM usr WHERE usr.operator IS false)\n            SELECT email, email NOT IN (SELECT email FROM authors) as operator_only, login_type::text, verified, super_admin, devops, name, company, username, first_time_user, role_source, disabled\n            FROM password\n            WHERE email IN (SELECT email FROM active_users)\n            ORDER BY super_admin DESC, devops DESC\n            LIMIT $1 OFFSET $2",
   "describe": {
     "columns": [
       {
@@ -57,6 +57,11 @@
         "ordinal": 10,
         "name": "role_source",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 11,
+        "name": "disabled",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -76,8 +81,9 @@
       true,
       true,
       false,
+      false,
       false
     ]
   },
-  "hash": "60118de85463098220b1c74f667b6fedb0f3f0040844c3774145e8f1f4c023ce"
+  "hash": "a5fd115e7be5129d623543bbfa7b5b31f0efc6d8ef73f691009c73f833dcee10"
 }

backend/.sqlx/query-d09706517cbc4763bcd4010a3de2c868e9ad2361ff56bb64a1ff12dab8c124b1.json

@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT super_admin, disabled FROM password WHERE email = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "super_admin",
+        "type_info": "Bool"
+      },
+      {
+        "ordinal": 1,
+        "name": "disabled",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "d09706517cbc4763bcd4010a3de2c868e9ad2361ff56bb64a1ff12dab8c124b1"
+}

backend/.sqlx/query-daa1a6bf3d4a1001da88301932a7ac9019767074158e0c027988e5b0d51a3656.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO password (email, login_type, verified, username, name) VALUES ($1, 'saml', true, $2, $3) ON CONFLICT DO NOTHING",
+  "query": "INSERT INTO password (email, login_type, verified, username, name) VALUES ($1, 'saml', true, $2, $3) ON CONFLICT (email) DO UPDATE SET disabled = false",
   "describe": {
     "columns": [],
     "parameters": {
@@ -12,5 +12,5 @@
     },
     "nullable": []
   },
-  "hash": "638d3c2ba1198dce5b5b0e47df59a92ff8011e19fbefcc3960d6f0fe167e55b6"
+  "hash": "daa1a6bf3d4a1001da88301932a7ac9019767074158e0c027988e5b0d51a3656"
 }

backend/.sqlx/query-f0c9c54740cc1c0c2a6fa4e79d4d504b7b5cb7a39538ab9abeb44f781c711493.json

@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT email, login_type::TEXT, super_admin, devops, verified, name, company, username, NULL::bool as operator_only, first_time_user, role_source FROM password WHERE email = $1",
+  "query": "SELECT email, login_type::TEXT, super_admin, devops, verified, name, company, username, NULL::bool as operator_only, first_time_user, role_source, disabled FROM password WHERE email = $1",
   "describe": {
     "columns": [
       {
@@ -57,6 +57,11 @@
         "ordinal": 10,
         "name": "role_source",
         "type_info": "Varchar"
+      },
+      {
+        "ordinal": 11,
+        "name": "disabled",
+        "type_info": "Bool"
       }
     ],
     "parameters": {
@@ -75,8 +80,9 @@
       true,
       null,
       false,
+      false,
       false
     ]
   },
-  "hash": "65c59e224e460351c2f88261f8b1b1e7ce2bb160270b59c0f359b7952453b2b9"
+  "hash": "f0c9c54740cc1c0c2a6fa4e79d4d504b7b5cb7a39538ab9abeb44f781c711493"
 }

backend/.sqlx/query-fc6c6310ae8ac5eb351d7e2af1678447d0aa3d143e94e49924ff7ac8b7abf924.json

@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT disabled FROM password WHERE email = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "disabled",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "fc6c6310ae8ac5eb351d7e2af1678447d0aa3d143e94e49924ff7ac8b7abf924"
+}

backend/ee-repo-ref.txt

@@ -1 +1 @@
-b5c8af4df9ba2c39fdd494d7a40f9a92fbff8abc
+7e3a0afd393646a7179278febe593fa598252fed

backend/migrations/20260324000000_scim_deactivated_user.down.sql

@@ -0,0 +1 @@
+ALTER TABLE password DROP COLUMN IF EXISTS disabled;

backend/migrations/20260324000000_scim_deactivated_user.up.sql

@@ -0,0 +1 @@
+ALTER TABLE password ADD COLUMN disabled BOOLEAN NOT NULL DEFAULT false;

backend/windmill-api-users/src/users.rs

@@ -157,6 +157,7 @@ pub struct GlobalUserInfo {
     operator_only: Option<bool>,
     first_time_user: bool,
     role_source: String,
+    disabled: bool,
 }
 
 #[derive(Serialize, Debug)]
@@ -213,6 +214,7 @@ pub struct EditUser {
     pub is_super_admin: Option<bool>,
     pub is_devops: Option<bool>,
     pub name: Option<String>,
+    pub disabled: Option<bool>,
 }
 
 #[derive(Deserialize)]
@@ -396,7 +398,7 @@ async fn list_users_as_super_admin(
             GlobalUserInfo,
             "WITH active_users AS (SELECT distinct username as email FROM (SELECT username, timestamp, operation FROM audit_partitioned UNION ALL SELECT username, timestamp, operation FROM audit) AS a WHERE timestamp > NOW() - INTERVAL '1 month' AND (operation = 'users.login' OR operation = 'oauth.login' OR operation = 'users.token.refresh')),
             authors as (SELECT distinct email FROM usr WHERE usr.operator IS false)
-            SELECT email, email NOT IN (SELECT email FROM authors) as operator_only, login_type::text, verified, super_admin, devops, name, company, username, first_time_user, role_source
+            SELECT email, email NOT IN (SELECT email FROM authors) as operator_only, login_type::text, verified, super_admin, devops, name, company, username, first_time_user, role_source, disabled
             FROM password
             WHERE email IN (SELECT email FROM active_users)
             ORDER BY super_admin DESC, devops DESC
@@ -409,7 +411,7 @@ async fn list_users_as_super_admin(
     } else {
         sqlx::query_as!(
             GlobalUserInfo,
-            "SELECT email, login_type::text, verified, super_admin, devops, name, company, username, NULL::bool as operator_only, first_time_user, role_source FROM password ORDER BY super_admin DESC, devops DESC, email LIMIT \
+            "SELECT email, login_type::text, verified, super_admin, devops, name, company, username, NULL::bool as operator_only, first_time_user, role_source, disabled FROM password ORDER BY super_admin DESC, devops DESC, email LIMIT \
             $1 OFFSET $2",
             per_page as i32,
             offset as i32
@@ -625,7 +627,7 @@ async fn global_whoami(
 ) -> JsonResult<GlobalUserInfo> {
     let user = sqlx::query_as!(
         GlobalUserInfo,
-        "SELECT email, login_type::TEXT, super_admin, devops, verified, name, company, username, NULL::bool as operator_only, first_time_user, role_source FROM password WHERE \
+        "SELECT email, login_type::TEXT, super_admin, devops, verified, name, company, username, NULL::bool as operator_only, first_time_user, role_source, disabled FROM password WHERE \
          email = $1",
         email
     )
@@ -648,6 +650,7 @@ async fn global_whoami(
             operator_only: None,
             first_time_user: false,
             role_source: "manual".to_string(),
+            disabled: false,
         }))
     } else {
         Err(user.unwrap_err())
@@ -1407,6 +1410,22 @@ async fn update_user(
         .await?;
     }
 
+    if let Some(d) = eu.disabled {
+        sqlx::query_scalar!(
+            "UPDATE password SET disabled = $1 WHERE email = $2",
+            d,
+            &email_to_update
+        )
+        .execute(&mut *tx)
+        .await?;
+        if d {
+            // Delete all tokens for immediate session revocation
+            sqlx::query!("DELETE FROM token WHERE email = $1", &email_to_update)
+                .execute(&mut *tx)
+                .await?;
+        }
+    }
+
     audit_log(
         &mut *tx,
         &authed,
@@ -1429,6 +1448,9 @@ async fn delete_user(
     require_super_admin(&db, &authed.email).await?;
     let mut tx = db.begin().await?;
 
+    sqlx::query!("DELETE FROM token WHERE email = $1", &email_to_delete)
+        .execute(&mut *tx)
+        .await?;
     sqlx::query!("DELETE FROM password WHERE email = $1", &email_to_delete)
         .execute(&mut *tx)
         .await?;
@@ -1687,7 +1709,7 @@ async fn login(
     };
     let email_w_h: Option<(String, String, bool)> = sqlx::query_as(
         "SELECT email, password_hash, super_admin FROM password WHERE email = $1 AND login_type = \
-         'password'",
+         'password' AND disabled = false",
     )
     .bind(&email)
     .fetch_optional(&mut *tx)
@@ -1775,13 +1797,20 @@ async fn refresh_token(
         }
     }
 
-    let super_admin = sqlx::query_scalar!(
-        "SELECT super_admin FROM password WHERE email = $1",
+    let password_row = sqlx::query!(
+        "SELECT super_admin, disabled FROM password WHERE email = $1",
         &authed.email
     )
     .fetch_optional(&mut *tx)
-    .await?
-    .unwrap_or(false);
+    .await?;
+
+    if password_row.as_ref().map(|r| r.disabled).unwrap_or(false) {
+        return Err(Error::NotAuthorized(
+            "Your account has been disabled".to_string(),
+        ));
+    }
+
+    let super_admin = password_row.map(|r| r.super_admin).unwrap_or(false);
 
     let new_token = create_session_token(&authed.email, super_admin, &mut tx, cookies).await?;
 

backend/windmill-api/openapi.yaml

@@ -588,6 +588,8 @@ paths:
                   type: boolean
                 name:
                   type: string
+                disabled:
+                  type: boolean
       responses:
         "200":
           description: user updated
@@ -23412,6 +23414,8 @@ components:
         role_source:
           type: string
           enum: ["manual", "instance_group"]
+        disabled:
+          type: boolean
 
       required:
         - email
@@ -23420,6 +23424,7 @@ components:
         - verified
         - first_time_user
         - role_source
+        - disabled
 
     Flow:
       allOf:

frontend/src/lib/components/SuperadminSettingsInner.svelte

@@ -17,7 +17,7 @@
 	import ToggleButtonGroup from './common/toggleButton-v2/ToggleButtonGroup.svelte'
 	import ToggleButton from './common/toggleButton-v2/ToggleButton.svelte'
 	import { userStore, workspaceStore } from '$lib/stores'
-	import { ExternalLink, Pencil, UserMinus, UserPlus } from 'lucide-svelte'
+	import { Ban, CheckCircle2, ExternalLink, Pencil, UserMinus, UserPlus } from 'lucide-svelte'
 	import DropdownV2 from './DropdownV2.svelte'
 	import Popover from './meltComponents/Popover.svelte'
 	import ConfirmationModal from './common/confirmationModal/ConfirmationModal.svelte'
@@ -67,6 +67,8 @@
 	let filteredUsers: GlobalUserInfo[] = $state([])
 	let deleteConfirmedCallback: (() => void) | undefined = $state(undefined)
 	let deleteUserEmail: string = $state('')
+	let disableConfirmedCallback: (() => void) | undefined = $state(undefined)
+	let disableUserEmail: string = $state('')
 	let editWrappers: Record<string, HTMLDivElement> = $state({})
 	let activeOnly = $state(false)
 
@@ -293,9 +295,9 @@
 								/><Toggle
 									bind:checked={activeOnly}
 									options={{
-										left: 'Show active users only',
+										left: 'Recently active only',
 										leftTooltip:
-											'An active user is a user who has performed at least one action in the last 30 days'
+											'Show only users who have logged in or performed an action in the last 30 days'
 									}}
 								/>
 
@@ -347,13 +349,25 @@
 									</Head>
 									<tbody>
 										{#if filteredUsers && users}
-											{#each filteredUsers.slice(0, nbDisplayed) as { email, super_admin, devops, login_type, name, username, operator_only, role_source }, i (email)}
-												<tr class={i % 2 === 0 ? 'bg-surface-tertiary' : 'bg-surface'}>
-													<Cell first class="max-w-[200px]"
-														><a href="mailto:{email}" title={email} class="truncate block"
-															>{email}</a
-														></Cell
-													>
+											{#each filteredUsers.slice(0, nbDisplayed) as { email, super_admin, devops, login_type, name, username, operator_only, role_source, disabled }, i (email)}
+												<tr
+													class="{i % 2 === 0 ? 'bg-surface-tertiary' : 'bg-surface'} {disabled
+														? 'opacity-60'
+														: ''}"
+												>
+													<Cell first class="max-w-[250px]">
+														<div class="flex items-center gap-1.5">
+															<a href="mailto:{email}" title={email} class="truncate block"
+																>{email}</a
+															>
+															{#if disabled}
+																<span
+																	class="text-2xs px-1.5 py-0.5 rounded bg-red-100 text-red-600 dark:bg-red-900 dark:text-red-300 whitespace-nowrap"
+																	>Disabled</span
+																>
+															{/if}
+														</div>
+													</Cell>
 													{#if automateUsernameCreation}
 														<Cell class="max-w-[150px]">
 															{#if username}
@@ -514,6 +528,39 @@
 																			if (btn instanceof HTMLElement) btn.click()
 																		}
 																	},
+																	{
+																		displayName: disabled ? 'Enable' : 'Disable',
+																		icon: disabled ? CheckCircle2 : Ban,
+																		action: () => {
+																			if (!disabled) {
+																				disableUserEmail = email
+																				disableConfirmedCallback = async () => {
+																					try {
+																						await UserService.globalUserUpdate({
+																							email,
+																							requestBody: { disabled: true }
+																						})
+																						sendUserToast('User disabled')
+																						listUsers(activeOnly)
+																					} catch (e) {
+																						sendUserToast('Failed to disable user', true)
+																					}
+																				}
+																			} else {
+																				UserService.globalUserUpdate({
+																					email,
+																					requestBody: { disabled: false }
+																				})
+																					.then(() => {
+																						sendUserToast('User enabled')
+																						listUsers(activeOnly)
+																					})
+																					.catch(() => {
+																						sendUserToast('Failed to enable user', true)
+																					})
+																			}
+																		}
+																	},
 																	{
 																		displayName: 'Remove',
 																		icon: UserMinus,
@@ -578,6 +625,33 @@
 	}}
 >
 	<div class="flex flex-col w-full space-y-4">
-		<span>Are you sure you want to remove <b>{deleteUserEmail}</b>?</span>
+		<span
+			>Are you sure you want to remove <b>{deleteUserEmail}</b>? They will be removed from all
+			workspaces and instance groups, and all their sessions and tokens will be revoked. This action
+			is irreversible. Their workspace content (scripts, flows, apps) will not be deleted.</span
+		>
+	</div>
+</ConfirmationModal>
+<ConfirmationModal
+	open={Boolean(disableConfirmedCallback)}
+	title="Disable user"
+	confirmationText="Disable"
+	on:canceled={() => {
+		disableConfirmedCallback = undefined
+		listUsers(activeOnly)
+	}}
+	on:confirmed={() => {
+		if (disableConfirmedCallback) {
+			disableConfirmedCallback()
+		}
+		disableConfirmedCallback = undefined
+	}}
+>
+	<div class="flex flex-col w-full space-y-4">
+		<span
+			>Are you sure you want to disable <b>{disableUserEmail}</b>? All their active sessions and
+			tokens will be revoked immediately. They will be unable to log in until re-enabled. Their
+			workspace memberships and content will be preserved.</span
+		>
 	</div>
 </ConfirmationModal>