windmill-labs/windmill · error · Error

Invalid role for user ${email}: ${localUser.role}

Error message

Invalid role for user ${email}: ${localUser.role}

What it means

Thrown by pushWorkspaceUser during workspace user sync when the local user YAML declares a role outside the allowed set (operator, developer, admin). This is a local-input validation guard: the faulting input is the `role` field in the local user file being pushed, not any remote condition. Rejecting early prevents creating or updating the workspace member with an invalid role.

Source

Thrown at cli/src/commands/user/user.ts:146

interface SimplifiedUser {
  role: string;
  username: string;
  disabled: boolean;
}

export async function pushWorkspaceUser(
  workspace: string,
  path: string,
  user: SimplifiedUser | undefined,
  localUser: SimplifiedUser
): Promise<void> {
  const email = removePathPrefix(removeType(path, "user"), "users");

  log.debug(`Processing local user ${email}`);

  if (!["operator", "developer", "admin"].includes(localUser.role)) {
    throw new Error(`Invalid role for user ${email}: ${localUser.role}`);
  }

  try {
    const remoteUser = await wmill.getUser({
      workspace,
      username: localUser.username,
    });
    user = {
      role: remoteUser.is_admin
        ? "admin"
        : remoteUser.operator
        ? "operator"
        : "developer",
      username: remoteUser.username,
      disabled: remoteUser.disabled,
    };
    log.debug(`User ${email} exists on remote`);
  } catch {

View on GitHub (pinned to e474e8803c)

Solutions

1. Set role to operator, developer, or admin in the user's .user.yaml file.
2. Check for typos like 'operater' or capitalized roles.

When it happens

Trigger: Thrown at cli/src/commands/user/user.ts:146 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/22ef4146cbb913d2. Report an issue: GitHub.