mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-09-05 16:03:47 +00:00
Three deletions bypassed the workspace-user cleanup and left `u/<username>` on the roles it named: the superadmin's global delete, which frees the name in every workspace at once, and both leave routes. A member invited into one of those names afterwards inherited the roles. The settings lock says what it hands back — the config as stored, generated role passwords included — so it carries `_unchecked` and the contract that goes with it: callers authorize the read, and redact before passing the value on.