Objective & prerequisites
Distinguish identity from permission to access a particular record. Prerequisites: basic Python expressions and files; use a disposable local practice folder and fictional data. This shared workshop complements the existing data/AI tracks and does not create a second progress system.
Understand the concept
Authentication identifies a user; authorization decides which action that identity may perform on a resource. A signed-in learner must not read another learner’s resume by changing an identifier. Check active status and ownership on reads, updates, exports and deletion, using the server’s session identity rather than a posted user_id.
Worked example
The local SQLite fixture containsD1 owned by user 1. owned_document selects id and owner_id with parameters. User 2 receives PermissionError forD1 and for an SQL-like string. The example is a defensive unit test against a disposable fixture, never a production attack.
python3 foundation_labs.py FoundationTests.test_private_ownerTry it yourself
Run the owner test. Add a second fictional document owned by user 2 and explain the four allowed/denied combinations. Record your prediction before running the supplied reference, then compare the observed result and explain any difference.
Worked solution
Each user may retrieve only their own record. Parameterization protects query structure, while the owner predicate protects access; one does not replace the other. Random-looking IDs alone are not authorization.
Knowledge check
Does a prepared statement by itself enforce document ownership? Try answering without rereading the example.
Check and explain
No. The query must also scope the operation to the authenticated owner and permitted action.
Mini-project, mistakes & handover
Produce a short README with the question, exact local command, input meaning, checks and actual results. Include one failure case and its explanation. Never silently turn an exception into a passing result. Mark simulated behavior explicitly, credit the supplied teaching code and identify your own contribution. These activities are unsaved self-practice, not certification.
Authoritative reference
— consulted for the underlying interface/concept. The lesson and fictional examples are original teaching material. Python reference tested with 3.12; designed for 3.10+. Git lab requires Git 2.28+.
Try the activity before reading its reference. Keep your sources, commands and assumptions with your work. Companion activities are unsaved self-practice and do not award a certificate or change lesson progress.