Personal Catalogue: PHP & MySQL — Chapter 9, Exercise 2
====================================================

TASK
Create the catalogue_app MySQL user with exactly the privileges shown
in this chapter, then confirm — by trying and expecting it to fail —
that a query like DROP TABLE items; run as that user is correctly
rejected by MySQL with a permissions error.

SOLUTION

As root, create the user and grant exactly the privileges from the
chapter:

    CREATE USER 'catalogue_app'@'localhost' IDENTIFIED BY 'a-real-strong-password-here';
    GRANT SELECT, INSERT, UPDATE, DELETE ON catalogue.* TO 'catalogue_app'@'localhost';
    FLUSH PRIVILEGES;

Confirm the grant took effect as expected:

    SHOW GRANTS FOR 'catalogue_app'@'localhost';

Expected output:

    +---------------------------------------------------------------------------------------------------+
    | Grants for catalogue_app@localhost                                                                |
    +---------------------------------------------------------------------------------------------------+
    | GRANT USAGE ON *.* TO `catalogue_app`@`localhost`                                                 |
    | GRANT SELECT, INSERT, UPDATE, DELETE ON `catalogue`.* TO `catalogue_app`@`localhost`               |
    +---------------------------------------------------------------------------------------------------+

Now log in as that user specifically (not root) and attempt the
forbidden operation:

    mysql -u catalogue_app -p catalogue

    mysql> DROP TABLE items;

Expected output:

    ERROR 1142 (42000): DROP command denied to user 'catalogue_app'@'localhost' for table 'items'

As a positive control, confirm a permitted operation still works fine
as the same user:

    mysql> SELECT COUNT(*) FROM items;
    -- returns a real count with no error

WHY THIS WORKS AS AN ANSWER
----------------------------
It doesn't just create the user and assume the restricted privileges
are correct — it actually logs in as that specific user and attempts
both a forbidden operation (confirmed rejected with the real MySQL
error) and a permitted one (confirmed still working), proving the
grant is scoped exactly as intended rather than accidentally too
broad or too narrow.