Function isDistributorWorkerOrgID

pkg/ingester/ingester.go:1750–1752

isDistributorWorkerOrgID reports whether orgID matches the synthetic worker-name pattern that the distributor injects as X-Scope-OrgID when opening a long-lived PushStream: "ingester- -stream-push-worker- " When this pattern is detected, PushStream bypasses the orgID == req.TenantID check

(orgID string)

// pattern can spoof it and write to any tenant.  The stream-level gRPC interceptor
// enabled via -distributor.sign-write-requests-keys provides cryptographic proof.
func isDistributorWorkerOrgID(orgID string) bool {
	return distributorWorkerOrgIDRe.MatchString(orgID)
}

func (u *userTSDB) acquireReadLock() error {
	u.stateMtx.RLock()