Exercise 1: Application vs. Database Authentication — Possible Solution
====================================================================

Application-level authentication (bc1) is about an END USER proving
their identity TO THE APPLICATION — a login form, a hashed password
check, a session or token issued afterward. Database-level
authentication is a completely separate layer: it's the APPLICATION
ITSELF proving its identity to the DATABASE, using a database
username and password that has nothing to do with any individual end
user.

NO, an end user's login does not directly authenticate them to the
database. The end user only ever talks to the application. The
application, in turn, uses its OWN single database account (its own
username/password, embedded in a connection string) to talk to the
database on behalf of every end user, regardless of who that user is.
From the database's point of view, every request from the application
— whether it originated from user #1 or user #10,000 — arrives as the
exact same database account.

This is precisely why the two are separate concerns requiring separate
security treatment: fixing weak end-user password hashing (bc1-2) does
nothing to secure the application's own database credentials, and
locking down the database account's privileges (this course) does
nothing to secure how end users log into the app.