-- PostgreSQL DB-level roles for connection security
-- App uses a single app user; RLS enforces row-level isolation

CREATE ROLE finance_app_user WITH LOGIN PASSWORD 'CHANGE_IN_ENV' NOSUPERUSER NOCREATEDB NOCREATEROLE;
GRANT CONNECT ON DATABASE financedb TO finance_app_user;
GRANT USAGE ON SCHEMA public TO finance_app_user;

-- Permissions granted after table creation via Alembic migration
-- See backend/alembic/versions/001_initial_schema.py for GRANT statements