mirror of
https://github.com/penpot/penpot.git
synced 2026-09-01 17:49:08 +00:00
Add owner protection to ::delete-team-member RPC command. Previously, a team admin could remove the team owner, permanently locking them out of their team and all resources. Changes: - Fetch target member data before deletion - Validate member exists (return :not-found if not) - Reject removal if target is owner and caller is not owner This mirrors the existing protection in update-team-member-role. Closes #11367 AI-assisted-by: qwen3.7-plus