test

docs/setup/MONGODB_SETUP.md

@@ -20,10 +20,23 @@ Broccolini Bot uses **MongoDB only** for persistent storage (tickets, transcript
 Add to your `.env` file:
 
 ```env
-MONGODB_URI=mongodb://localhost:27018/broccolini_bot
+MONGODB_URI=mongodb://broccoli_bot:CHANGE_ME@localhost:27017/broccoli_db?authSource=broccoli_db
 ```
 
-**Note:** Uses port `27018` to match your existing setup (as defined in docker-compose.yml).
+**Note:** Mongo runs self-hosted on the same host as the bot. A **dedicated user per database** is required — create `broccoli_bot` with `readWrite` on `broccoli_db` only (no admin/root, no cross-DB access). For test, create a separate user with `readWrite` on `broccoli_db_test` only.
+
+Example mongosh setup:
+
+```javascript
+use broccoli_db
+db.createUser({
+  user: "broccoli_bot",
+  pwd: "CHANGE_ME",
+  roles: [ { role: "readWrite", db: "broccoli_db" } ]
+})
+```
+
+Bind Mongo to loopback (`bindIp: 127.0.0.1`) or the internal docker network only; firewall `27017` from public interfaces.
 
 ### 2. Install Dependencies
 
@@ -141,11 +154,12 @@ process.on('SIGINT', async () => {
 
 ### Connection refused
 - Check MongoDB is running: `docker ps` or `systemctl status mongodb`
-- Verify port 27018 is correct in `.env`
+- Verify port 27017 is correct in `.env` (or whatever port your mongod is bound to)
 - Check MongoDB logs for errors
 
 ### Authentication failed
-- If MongoDB requires auth, update URI: `mongodb://username:password@localhost:27018/broccolini_bot`
+- Verify the user exists in the correct DB's `authSource` (URI must include `?authSource=broccoli_db`)
+- Confirm the user has `readWrite` on `broccoli_db`: `db.getUser("broccoli_bot")` in mongosh
 
 ### Schema validation errors
 - Check required fields are provided when creating documents