CREATE USER ... WITH MAX_QUERIES_PER_HOUR is accepted but TiDB does not enforce the per-user resource limit
- Dominant language
- Go
- Stars
- 40.5k
- Forks
- 6.2k
- PR merge metrics
- PR metrics pending
Description
## Bug Report
Please answer these questions before submitting your issue. Thanks!
### 1. Minimal reproduce step (Required)
```sql
CREATE USER 'repro_res_limit'@'%' IDENTIFIED BY 'p' WITH MAX_QUERIES_PER_HOUR 1;
-- Connect as repro_res_limit:
SELECT 1;
SELECT 1;
```
Probe output:
```text
MYSQL_USER_RC=1
MYSQL_USER_ERR=ERROR 1226 (42000) at line 1: User 'repro_res_limit' has exceeded the 'max_questions' resource (current value: 1)
MYSQL_USER_RESOURCE_LIMIT_ENFORCED
TIDB_USER_RC=0
TIDB_USER_OUT='1'
TIDB_USER_RESOURCE_LIMIT_PATH_OK
TIDB_USER_RC=0
TIDB_USER_OUT='1\n1'
TIDB_USER_RESOURCE_LIMIT_IGNORED
```
MySQL rejects the limited user with error 1226; TiDB allows both queries.
### 2. What did you expect to see? (Required)
A user limited to `MAX_QUERIES_PER_HOUR 1` must be rejected with MySQL error 1226 once the limit is exceeded. If TiDB does not implement the other resource limits, `CREATE USER`/`ALTER USER` must reject those clauses instead of accepting them.
### 3. What did you see instead (Required)
MySQL: limited user SELECT 1; SELECT 1; -> ERROR 1226. TiDB: same user -> 1 and 1 with rc 0.
### 4. What is your TiDB version? (Required)
```text
Release Version: v8.4.0-this-is-a-placeholder
Edition: Community
Git Commit Hash: None
Git Branch: None
UTC Build Time: None
GoVersion: go1.25.12
Race Enabled: false
Check Table Before Drop: false
Store: unistore
Kernel Type: Classic
```
Built from source commit `a514a92784c9654502686e6ee6efc9e0aeda8afa` (pingcap/tidb master, 2026-09-07).
### 5. Root cause (optional)
- pkg/executor/simple.go:107-115 says only MAX_USER_CONNECTIONS is implemented
- pkg/executor/simple.go:840-846 parses maxQueriesPerHour/maxUpdatesPerHour/maxConnectionsPerHour
- pkg/executor/simple.go:1256 and 2132-2138 only use maxUserConnections
Contributor guide
Research direction
Start with the resource-limit comments and parsing paths in pkg/executor/simple.go, especially lines 107-115 and 840-846, then trace the uses around lines 1256 and 2132-2138. Reproduce the issue with the supplied CREATE USER and two SELECT statements. Done means MAX_QUERIES_PER_HOUR is enforced with MySQL error 1226, or unsupported resource-limit clauses are rejected rather than accepted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, mysql
- Domain
- databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100