Repository navigation
SHOW TENANT <name> not supported (only by usage-in-database form); no path for basic per-tenant introspection #126
Description
Activity
Fixed in 56a29f1.
Added two new typed forms:
SHOW TENANT <name|id>— single-row introspection. Resolves numeric ids first, then falls back to case-insensitive name match. Returns42704(undefined_object) when no tenant matches.SHOW TENANTS WITH NAME <name>— filter form on the existingSHOW TENANTSrow shape.
Both run through the AST-typed dispatcher (
pgwire/ddl/router/ast/database_ops.rs) rather than string-prefix routing. The legacystarts_with("SHOW TENANTS")branches in the pgwire admin router and theuser_authAST parser were tightened to exact match — left as prefix matches,SHOW TENANTS WITH NAME <name>would silently fall through and list every tenant, which is a data-disclosure hazard. The native protocol'sis_session_showwas likewise updated soSHOW TENANT <ident>reaches DDL instead of the per-sessionSHOW <param>handler.Coverage in
nodedb/tests/pgwire_auth_tenants.rs:show_tenant_by_name/show_tenant_by_id— happy pathsshow_tenants_with_name_filter_unknown_name_does_not_silently_listall— regression guard against the silent prefix-fallthroughshow_tenant_by_name_requires_superuser— privilege gate parity withSHOW TENANTS
- added a commit that references this issue
on Jun 10, 2026 - added a commit that references this issue
on Jul 4, 2026
Tested against:
origin/main @ a178aa5b6b0b260d105962c928f07304360b7b30(fetched 2026-05-20)Severity: Low (workaround exists)
SHOW TENANT <name>is not supported; only theSHOW TENANT USAGE FOR <name> IN DATABASE <db>variant works (per docs). Basic per-tenant introspection by name is missing.Reproduction
For an admin who wants "tell me about tenant 'mae8' — what's its ID, quotas, db, status?", the only path is:
SHOW TENANTS; -- iterate the list, find the row by name…which works but is awkward for scripts and admin tooling.
Suggested fix
Add
SHOW TENANT <name|id>for basic per-tenant introspection. Returns:tenant_id,name,database,quotas,active_requests,total_requests,rejected_requests, etc. Useful both interactively and from admin scripts that need tenant-by-name lookup.Workaround
SHOW TENANTS+ grep / awk for the desired name. Workable but every admin tool reinvents this filter.Context
Caught during mae8 v2 Phase 0 bootstrap (2026-05-20). Full bug catalog:
/home/system/rnd/mae8/docs/origin_bugs_2026-05-20.md(this is Bug 6 from that file).