You can do authentication and authorization inside sql. For example you could have something like

    CREATE ROLE initial LOGIN NOINHERIT NOCREATEDB NOCREATEROLE NOSUPERUSER;

And then you run SQL to validate any credentials and then check the database for any permissions, ending with

    SET LOCAL ROLE someuser;

It is uncommon but some people appreciate the simplicity of making the application layer do as little work as possible while pushing work into the database. It’s the logical conclusion after years of telling developers about the N+1 query problem.