test

docs/setup/ENV_AND_SECURITY.md

@@ -34,7 +34,7 @@
 - **Secrets:** All secrets live in `.env` (or `.env.test` for test). Never commit them. `.gitignore` excludes `.env` and `.env.*` except `.env.example` and `.env.test.example`.
 - **Code:** No `eval()` or `new Function()` of user input. No hardcoded tokens, passwords, or API keys in source.
 - **Config:** Credentials are read from `process.env` via `config.js`; config is loaded once at startup from the file specified by `ENV_FILE` or default `.env`.
-- **MongoDB:** Use a dedicated user and database; restrict network access (Atlas IP allowlist or VPC). For test, use a separate DB or cluster.
+- **MongoDB:** Use a dedicated user and database; bind Mongo to loopback or docker network only; firewall 27017 from public interfaces. For test, use a separate DB or cluster.
 - **Discord / Google:** Use tokens with minimal required scopes; rotate if compromised.
 - **HTML in emails:** `LOGO_URL`, `EMAIL_SIGNATURE`, and closure messages are escaped in outbound HTML to prevent injection.
 - **Healthcheck:** Optional `HEALTHCHECK_HOST=127.0.0.1` in `.env` binds the healthcheck server to localhost only; omit to listen on all interfaces.

docs/setup/MONGODB_SETUP.md

@@ -20,10 +20,23 @@ Broccolini Bot uses **MongoDB only** for persistent storage (tickets, transcript
 Add to your `.env` file:
 
 ```env
-MONGODB_URI=mongodb://localhost:27018/broccolini_bot
+MONGODB_URI=mongodb://broccoli_bot:CHANGE_ME@localhost:27017/broccoli_db?authSource=broccoli_db
 ```
 
-**Note:** Uses port `27018` to match your existing setup (as defined in docker-compose.yml).
+**Note:** Mongo runs self-hosted on the same host as the bot. A **dedicated user per database** is required — create `broccoli_bot` with `readWrite` on `broccoli_db` only (no admin/root, no cross-DB access). For test, create a separate user with `readWrite` on `broccoli_db_test` only.
+
+Example mongosh setup:
+
+```javascript
+use broccoli_db
+db.createUser({
+  user: "broccoli_bot",
+  pwd: "CHANGE_ME",
+  roles: [ { role: "readWrite", db: "broccoli_db" } ]
+})
+```
+
+Bind Mongo to loopback (`bindIp: 127.0.0.1`) or the internal docker network only; firewall `27017` from public interfaces.
 
 ### 2. Install Dependencies
 
@@ -141,11 +154,12 @@ process.on('SIGINT', async () => {
 
 ### Connection refused
 - Check MongoDB is running: `docker ps` or `systemctl status mongodb`
-- Verify port 27018 is correct in `.env`
+- Verify port 27017 is correct in `.env` (or whatever port your mongod is bound to)
 - Check MongoDB logs for errors
 
 ### Authentication failed
-- If MongoDB requires auth, update URI: `mongodb://username:password@localhost:27018/broccolini_bot`
+- Verify the user exists in the correct DB's `authSource` (URI must include `?authSource=broccoli_db`)
+- Confirm the user has `readWrite` on `broccoli_db`: `db.getUser("broccoli_bot")` in mongosh
 
 ### Schema validation errors
 - Check required fields are provided when creating documents