Password Expiration Handling with PROXY Privilege in MariaDB: Diagnostic Question

When a MariaDB user account has an expired password and also holds the PROXY privilege, the server must decide whether to enforce the proxy chain before prompting for a password change or to block all operations until the password is reset. This decision affects least‑privilege enforcement, especially in environments where proxy users are used to delegate permissions.

The behavior appears to vary between client libraries and MariaDB releases. Some clients report ER_PASSWORD_EXPIRED (1862) and refuse to execute any statement until the password is changed, while others return a generic ER_ACCESS_DENIED_ERROR, potentially allowing privileged actions to be attempted before reset.

Given the lack of definitive documentation on the evaluation order, I need to understand the exact flow in MariaDB 10.6+ and later versions.

1. Does MariaDB evaluate the PROXY privilege chain before enforcing the password‑expiration prompt, or is the chain only considered after a successful password change?

2. If the proxy chain is evaluated before the password reset, can any privileged operation (e.g., SELECT on a protected schema) be executed before the user changes the password?

3. How do different client libraries (Connector/J, Connector/C, mysql client) expose this behavior, and is there a configuration option to standardize it?