In this video.
Let's finish up with the authentication and then the authorization system.
We are done with the whole logic.
What is left is to protect a certain route from unauthorized user.
So what we are going to do is that we are going to create a meter and that middleware is going to check
the validity of a token being sent by a user.
So here we go.
Inside the middleware, we are going to create one file core is logged in.
So here we go.
Let's create the middle where as is logged in, is equal to every function that we have access to request,
response and then the next.
Perfect.
Here we go.
So here, let's lay out the steps.
So step number one is.
And that is it.
So here we are done with the verification and also get it to again from the request header.
But for this one, we implement it inside the actual root and we can create a function for that.
So inside the controller of users, here we go.
You can see this is the logic that we implemented.
Because of that we are going to cut this one from here.
That is to get it to again and you are going to create a function for that one.
So let's catch everything from here and let's go ahead and then create a file and utils folder as get
to kin from header.
Dart it is.
So cost as get to a king from a header is equal to.
And for this we need to pass in the entire request object so that we can have the header.
So here let's paste what we copied before we continue, unless we check if there's a token on that.
So here we go.
If token is not equal to undefined, it means that there is a token.
So here we can go ahead and then return the token.
Good, or else you are going to retain that there is no token attached to the header.
So here errors.
Retain objects with this property's status as failed.
And then the message that we want to send as.
There is no Tolkien
attached to the header.
So lastly, let's export that so module.
Dot exports is equal to get to and from header.
So here we go.
So inside the controller let's remove the replication and everything because we are going to handle
it inside the metal well.
So let's save it and let's save the middleware and let's save the function to get it taken from the
header.
So here we go.
Now that we have that function, let's go ahead to require that.
So above here, let's require the get token from header and here we go.
So here we are going to call the function here and pass in the entire request object.
So const and then the token remember is what we got from the previous video.
Then this one is the verification token.
And lucky for us too, we have the function already being created inside the utils as verified token.
So here we go.
So let's bring this one here and I'm going to pass in the token you got from the gate token from header.
And for this we have access to the decoded user.
Do you remember that or decoded is equal to that or make it coded user to be more specific?
Great.
So lastly, let's say the user into the request object is equal to the decoded user dot id.
Remember, that's what we specify upon generating the token as that.
So here let's return an error in case the token has expired or is not valid for this one to.
We need the app error plus we have all the functions already, so we need to use them where we need
it.
So here we go in case there is no user meaning that the token has expired or is not valid.
So the return next.
Then we pass in our error class as an error.
Then you pass in the message as invalid or expired.
Token comma, please.
Log in again, then pass in the status code as 401 And lastly, you need to export from this file as
module.
The export is equal to a logged in.
So now any route that we want to protect our the to is logged in.
So back to the root of users, that is a user's root.
Let's require that middleware as is logged in and the auto import is working fine.
So here I want to protect the profile, so I'll pass it as a second element to this handler.
And here we go.
So moment of truth, let's collapse everything.
And now let's go ahead and make the request for the profile.
So let's hit send.
Why is this happening?
The problem is that maybe we are calling next inside the murderer.
And indeed it is true.
Unless we are caught next to so that it can move to the next minute where that is our controller.
So now this one, let's send again.
And here we go.
We get back the profile.
So in case I change the token, let's see what we are going to get.
Whereas after we get back the profile.
So let's look at the verification token and this is where the problem is.
You can see that it is returning a text and a text is always true.
So we need to change this one to false.
So now let's save it.
And now let's send the request again.
This time around we go back the message meaning token expired, meaning that we have template with a
token.
So if I undo and send the request again you can see that we have back the profile round.
So with this one I have access to the log in user and red dot user.
So here if we consult the log, the rec dot user, let's see what we are going to get.
I'm going to get the ID of the log in user.
So let's hit send and here we go.
So with this one, I can take this ID and make a request to MongoDB to find that particular user.
So let's implement that one.
Before we end this video, we need to bring in the user model and we have it here.
And next is you are going to take the ID from the request object.
So here we go.
Cost as user is equal to our weight and on the user model we're going to use fine by ID.
The ID is under request dot user.
Do you remember I told you that we are going to implement this way without using a parameter or first
light by passing in the ID inside the URL, here is the answer.
Now we can get the idea of the user from the request object.
So we are going to remove this one from here.
In this way we need to modify our route so we inside the user's route, which is this one for the profile,
we are going to move the ID and going to be forward slash user how awesome it is.
So save it and let's save this one or so and let's thank the actual user.
So here we go.
So let's remove this one and let's send the actual user.
So let's check it out.
Let's hit st moment of truth.
A We go back the user with the account empty and with the details about the user here ends this section
and the authorization and then the authentication.
So with this one, we can create a word for admin users only and we can give you a a challenge.
So with this one, you are almost there to finish up with the entire application because it is a more
difficult part and we are done with it.
So in this video, let's continue with the account and then with the transactions.