Limiting Access to Exhibitor Records is a hands-on PostgreSQL project for learners who know basic SQL and want a shared register to respect each account's ownership. Two exhibitors need to create and maintain their own loading records; the organizer still needs to see everyone and assign booths. You will put those boundaries in the database and use them for real work.
One Guided Lab moves from row visibility to proposed-write checks and completed registrations. One independent Challenge changes the makers, table and records, then asks you to deliver the same usable boundary with the tools already practiced. Each lab prepares its own environment and data.
What You Will Learn
After completing this course, you will be able to:
- distinguish an authenticated ordinary login from a table owner, and test access through the intended identity;
- separate table/column permissions from the rows an account may read or change;
- retire overbroad permissive policies while preserving the organizer's legitimate access;
- protect existing rows and proposed INSERT/UPDATE values with reusable row-policy SQL;
- distinguish hidden rows, refused writes and failed connections, including writes without returned rows;
- complete new registrations and organizer assignments while preserving the original records.
Who This Course Is For
This course is for PostgreSQL learners and developers who want practical experience with database-enforced record ownership.
Prerequisites: Basic terminal navigation and PostgreSQL connections, tables, SELECT/WHERE, INSERT and UPDATE. The labs explain roles, row-level security, policy expressions, transactions and the required shell syntax before use. No Python programming is required.
Learning environment: LabEx provides a ready-to-use browser Terminal with PostgreSQL, synthetic registration data and separately prepared database accounts. You act as the operator who tests each account; no local database installation or cloud account is needed.
Frequently Asked Questions
Does this teach website authentication?
The project focuses on the permissions of actual database logins. It does not implement a website login, a shared application account's tenant context or a connection pool. Table owners and administrators remain trusted; the course does not promise protection from every information side channel.
Will restricting access stop all writes?
The finished register must still accept each exhibitor's own legitimate inserts and contact/count updates. The ordinary organizer must still read everyone and assign booths and fees. Denying everything does not complete the project.
What do I deliver in the Challenge?
You save and apply self-contained policy SQL, then complete two specified loading applications through their makers and the organizer. The original records, identities and prepared permissions must remain intact. The Challenge uses the same tools and mechanisms as the Guided Lab.
