; 3E Egitim — PgBouncer user list
;
;   cp userlist.txt.example userlist.txt
;   chmod 600 userlist.txt
;
; userlist.txt is gitignored and is NEVER committed.
;
; ---------------------------------------------------------------------------
; THE APPLICATION ROLES MUST BE HERE (plan chunk2 §2.2)
; ---------------------------------------------------------------------------
; PgBouncer authenticates against this file. A role missing from it cannot
; connect at all — the application fails to start, loudly, which is the good
; outcome.
;
; The bad outcome is the fix somebody reaches for next: pointing the
; application at "postgres", because that one is already listed and it makes
; the error go away. PostgreSQL lets a superuser bypass FORCE ROW LEVEL
; SECURITY, so the application would come up, every test would stay green, and
; every customer would be able to read every other customer's data. Nothing
; would report it (chunk2, experiment 1).
;
; If a role is missing, add the role. Do not change which role the application
; connects as.
; ---------------------------------------------------------------------------
;
; Passwords match the ones the role migration used, i.e. the values in .env.
; DB_USERNAME IS the application role, so its password is DB_PASSWORD — there
; is no separate DB_APP_PASSWORD. A mismatch here shows up as "cannot connect",
; and the tempting fix for that is the one this file exists to forbid.
;
; Format: "user" "password"

"3eegitim_app" "SET_TO_DB_PASSWORD"
"3eegitim_app_financial" "SET_TO_DB_FINANCIAL_PASSWORD"

; Maintenance only. Migrations and dumps use the direct PostgreSQL port and do
; not pass through PgBouncer; this entry is a convenience and must never become
; the application's connection.
"postgres" "SET_TO_DB_ADMIN_PASSWORD"