Noob question about user accounts
In a scenario like this, there are often two completely separate kinds of "user accounts".

First you have your database's user account - this is (or at least, should be) required for the webserver to access the database.

Then, you have your application's user accounts. Everyone using the application should have their own account.

While it may be possible to assign individual user accounts for all application users to the database itself, this is often not practical. In most cases, I would keep these two things separate.

So, your application would have its own user table, with passwords and other user information. I'd also have a role table, listing out the types of users you can have: sales, artist, or customer. You would add the id of the appropriate row in the role table into the user table, and would determine what options are provided on-screen based on those roles.

At the database level, you could use just one user. That user has sufficient access to the database to run any commands any user might need; control of which users can run which commands is based on the application-level user.

You could have 4 users. One, "login" (use better names, by the way) would only be able to access the information required to authenticate your application-level users. Once they're authenticated, you could have one user for each of the three roles, with their rights within the database limited by what's needed for that role.

Practically speaking most websites I've worked on (including e-commerce sites) have used a single account for all DB connections, and controlled access at the application level.

If this is for a class assignment, and the class isn't about security, then I'd keep things simple (at first at least - you can play around if you've finished the basics early - you don't want an over-complicated security system to prevent you from completing the basic course requirements). Worry more about SQL injection attacks and that sort of thing; even with the four DB user solution suggested, one artist could potentially use a SQL injection attack to destroy other artists' data.