In this video, let's create a controller to delete a post so inside the controllers and post, let's
locate the controller, which is this one.
So here, let's add commands by saying delete posts and we are going to use Mongoose method called find
by ID and delete.
So going to be as const deleted post is equal to await the post model dot find by ID and delete and
are passed in the ID which can be found and rec the params dot id and that is it.
But for the deleting of a post, I don't want to send back the post that has been deleted, but if we
want to do that, why not?
You can go ahead and do that.
But I'm going to send a message by saying that post has been deleted successfully.
All right.
So let me use the data here and then let me pass in next to handle any error here.
So inside the catch our code next pass in the app error, and then the message has error message.
So let me remove the response and this is what I want.
So let's get back to the deleting and remember this one going to be a protected endpoint, meaning that
unless you are logged in before you can delete a post.
So let's get back to the root and post and post the gist and let's look at the delete, which is this,
and let's pass in the middleware called protected.
So let's get back to the tender client and let me find all post first before I can take the ID.
We have all the post here.
Let's say I want to delete the first one called No Node.js.
So let me get back to delete here and pass in the ID and click on send and you can see post has been
deleted successfully.
But here is a problem guys.
It means that any log in user can delete any post from our endpoint and we need to avoid that.
Let's go ahead and register a new user and I'll show you what I mean.
So let's get back to the users and register for this one.
I'm going to register email and then the email is going to be as email at gmail.com hit send.
And I have been registered successfully.
So let me go ahead and look in before I can create a post.
So I'll click on, log in and I'll provide the email password for five and hit send.
Now I have logged in as IMA, but not John, so let me go ahead and create a post.
So inside the post, which is this one.
Now I'm going to create a post in my name that is email.
So in here I'm going to create a post called Main Stock and call.
This one is great.
And we're going to be.
Category.
JavaScript.
That's okay.
And I want to send the same image so I'll hit send.
I got this error, meaning that I'm not providing the title, so let me check the title and hit send
again.
And you can see that it has been created successfully and the user is IMA with the ID of 843 at the
end.
So let's check if indeed is the ID which is the same as this.
So this means that this post was created by IMA.
But let me go ahead and look in as John.
Which is this.
So when I look in at this now, I have log in as door with this email.
Now, because I've looked in, I can delete emails, posts.
So let's get back to find all posts and let's find the main stock, which is this.
Remember, this post was created by email, but I can go ahead and delete so I'll copy the id.
Remember I have log in as do.
So I'll provide the ID here and I'll hit send and you can see that I'm able to delete a post owned by
somebody.
So let's avoid that.
So inside the controller for deleting, let's have some step.
Step number one is we are going to find the posts.
So I'm going to be asked that, find the post and I'm going to be as concerned.
Post found or post for shots is equal to await the post model dot find by ID and the ID can be found
under red dot params dot ID.
Now, after finding the post, we are going to check if the post belong to the logged in user.
So the comment goes like this.
Check if the post belongs to the user, meaning the log in user and going to be as if remember on the
post we have a field called user, which is this.
We are going to check the value of this user If it is equal to the ID of the log in user, then that
post belong to that person.
So in here we are going to check if post dot user remember it's an ID if it is not equal to the log
in user, which is rec dot session.
Dart user of.
Then you go ahead and then return from this function by calling next, and then you provide the up arrow
and pass in the message by saying that you are not allowed to delete this post.
So the message goes like this.
And now provide the status code.
As for oh three, not authorized.
Perfect.
This expression will always retain force because we are comparing an object.
Remember the value of the ID in a DB is an object but not a string.
So unless we convert to string as to string, likewise the log in user also to string.
And that is it.
So let me go ahead and log in as IMA and create a post and let's see the message.
So I have logged in.
Let me provide the actual password for five sent and let me create a post with the same data and hit
send.
And here I have the user ID here.
So if I look in as do.
Now I have looked in as though.
So let's go ahead and then delete a post that has been created by Emma.
So let's find a posts.
And this is a post that I just created in the name of Emma.
So I will copy the ID and delete.
Let me place the ID here and hit send.
And here you go.
You can see that you are not allowed to delete this post, meaning everything is working fine.
The next video, Let's go ahead and update a post.