Method resolve_identity

nodedb/src/control/server/pgwire/handler/core.rs:96–152

Resolve the authenticated identity from pgwire client metadata, then overlay the session's superuser tenant override (if any) onto the resolved `tenant_id`. The override is installed via `SET TENANT = ' ' | | DEFAULT` or `SET nodedb.tenant_id = `; the SET handler enforces that only superuser sessions may install one and that no active transaction is in flight. Honoring it here — at

(
        &self,
        client: &C,
        addr: &std::net::SocketAddr,
    )

    /// downstream `identity.tenant_id` read correct without threading the
    /// session into 13 unrelated dispatchers.
    pub(crate) fn resolve_identity<C: ClientInfo>(
        &self,
        client: &C,
        addr: &std::net::SocketAddr,
    ) -> PgWireResult<AuthenticatedIdentity> {
        let username = client
            .metadata()
            .get("user")
            .cloned()
            .unwrap_or_else(|| "unknown".to_string());

        let mut identity = match self.auth_mode {
            AuthMode::Trust => {
                // Strict resolution: `post_startup` has already ensured the
                // user exists (either because it was already in the store
                // or via the bootstrap auto-create path on an empty store),
                // so any miss here is a genuine unknown user.
                self.state
                    .credentials
                    .to_identity(&username, AuthMethod::Trust)
                    .ok_or_else(|| {
                        PgWireError::UserError(Box::new(ErrorInfo::new(
                            "FATAL".to_owned(),
                            "28000".to_owned(),
                            format!("trust auth: user '{username}' does not exist"),
                        )))
                    })?
            }
            AuthMode::Password | AuthMode::Certificate => self
                .state
                .credentials
                .to_identity(&username, AuthMethod::ScramSha256)
                .ok_or_else(|| {
                    PgWireError::UserError(Box::new(ErrorInfo::new(
                        "FATAL".to_owned(),
                        "28000".to_owned(),
                        format!("authenticated user '{username}' not found in credential store"),
                    )))
                })?,
        };

        if let Some(effective) = self.sessions.get_effective_tenant_id(addr) {
            // The SET handler guarantees the override only gets installed for
            // superuser sessions. If somehow a non-superuser carries one
            // (e.g. an ALTER USER demotion landed after the override was
            // installed), treat the override as cleared — the identity-bound
            // tenant is the safe fallback. Drop the override so future
            // requests on this session don't keep paying the check.
            if identity.is_superuser {
                identity.tenant_id = effective;
            } else {
                self.sessions.set_effective_tenant_id(addr, None);
            }
        }

        Ok(identity)
    }