1
00:00:06,630 --> 00:00:07,590
In this video.

2
00:00:07,590 --> 00:00:12,180
Let's finish up with the authentication and then the authorization system.

3
00:00:12,600 --> 00:00:14,770
We are done with the whole logic.

4
00:00:14,790 --> 00:00:20,670
What is left is to protect a certain route from unauthorized user.

5
00:00:20,880 --> 00:00:27,540
So what we are going to do is that we are going to create a meter and that middleware is going to check

6
00:00:27,540 --> 00:00:31,400
the validity of a token being sent by a user.

7
00:00:31,410 --> 00:00:33,120
So here we go.

8
00:00:33,150 --> 00:00:38,550
Inside the middleware, we are going to create one file core is logged in.

9
00:00:43,090 --> 00:00:44,830
So here we go.

10
00:00:44,860 --> 00:00:52,960
Let's create the middle where as is logged in, is equal to every function that we have access to request,

11
00:00:52,960 --> 00:00:55,930
response and then the next.

12
00:00:57,630 --> 00:00:58,530
Perfect.

13
00:00:59,010 --> 00:00:59,710
Here we go.

14
00:00:59,730 --> 00:01:02,670
So here, let's lay out the steps.

15
00:01:02,670 --> 00:01:04,920
So step number one is.

16
00:01:19,330 --> 00:01:20,560
And that is it.

17
00:01:20,590 --> 00:01:26,260
So here we are done with the verification and also get it to again from the request header.

18
00:01:26,710 --> 00:01:34,270
But for this one, we implement it inside the actual root and we can create a function for that.

19
00:01:34,270 --> 00:01:39,070
So inside the controller of users, here we go.

20
00:01:39,100 --> 00:01:42,640
You can see this is the logic that we implemented.

21
00:01:42,730 --> 00:01:46,330
Because of that we are going to cut this one from here.

22
00:01:46,360 --> 00:01:51,040
That is to get it to again and you are going to create a function for that one.

23
00:01:51,040 --> 00:02:01,060
So let's catch everything from here and let's go ahead and then create a file and utils folder as get

24
00:02:01,060 --> 00:02:02,800
to kin from header.

25
00:02:07,490 --> 00:02:08,930
Dart it is.

26
00:02:11,190 --> 00:02:20,140
So cost as get to a king from a header is equal to.

27
00:02:20,160 --> 00:02:26,100
And for this we need to pass in the entire request object so that we can have the header.

28
00:02:26,400 --> 00:02:33,390
So here let's paste what we copied before we continue, unless we check if there's a token on that.

29
00:02:33,390 --> 00:02:34,710
So here we go.

30
00:02:34,800 --> 00:02:42,570
If token is not equal to undefined, it means that there is a token.

31
00:02:42,780 --> 00:02:47,370
So here we can go ahead and then return the token.

32
00:02:47,700 --> 00:02:54,210
Good, or else you are going to retain that there is no token attached to the header.

33
00:02:54,210 --> 00:02:56,460
So here errors.

34
00:02:59,140 --> 00:03:06,250
Retain objects with this property's status as failed.

35
00:03:07,970 --> 00:03:13,340
And then the message that we want to send as.

36
00:03:15,740 --> 00:03:19,400
There is no Tolkien

37
00:03:21,680 --> 00:03:25,340
attached to the header.

38
00:03:25,880 --> 00:03:29,840
So lastly, let's export that so module.

39
00:03:32,800 --> 00:03:37,180
Dot exports is equal to get to and from header.

40
00:03:37,450 --> 00:03:38,710
So here we go.

41
00:03:38,710 --> 00:03:44,470
So inside the controller let's remove the replication and everything because we are going to handle

42
00:03:44,470 --> 00:03:47,140
it inside the metal well.

43
00:03:47,170 --> 00:03:53,890
So let's save it and let's save the middleware and let's save the function to get it taken from the

44
00:03:53,890 --> 00:03:54,490
header.

45
00:03:54,490 --> 00:03:55,840
So here we go.

46
00:03:55,870 --> 00:04:00,550
Now that we have that function, let's go ahead to require that.

47
00:04:00,550 --> 00:04:08,620
So above here, let's require the get token from header and here we go.

48
00:04:08,620 --> 00:04:15,490
So here we are going to call the function here and pass in the entire request object.

49
00:04:15,490 --> 00:04:22,060
So const and then the token remember is what we got from the previous video.

50
00:04:22,330 --> 00:04:25,030
Then this one is the verification token.

51
00:04:25,030 --> 00:04:32,440
And lucky for us too, we have the function already being created inside the utils as verified token.

52
00:04:32,530 --> 00:04:34,390
So here we go.

53
00:04:34,480 --> 00:04:41,770
So let's bring this one here and I'm going to pass in the token you got from the gate token from header.

54
00:04:41,860 --> 00:04:45,850
And for this we have access to the decoded user.

55
00:04:45,850 --> 00:04:54,760
Do you remember that or decoded is equal to that or make it coded user to be more specific?

56
00:04:54,970 --> 00:04:55,600
Great.

57
00:04:55,600 --> 00:05:05,290
So lastly, let's say the user into the request object is equal to the decoded user dot id.

58
00:05:05,350 --> 00:05:10,150
Remember, that's what we specify upon generating the token as that.

59
00:05:10,150 --> 00:05:17,680
So here let's return an error in case the token has expired or is not valid for this one to.

60
00:05:17,680 --> 00:05:23,890
We need the app error plus we have all the functions already, so we need to use them where we need

61
00:05:23,890 --> 00:05:24,280
it.

62
00:05:24,280 --> 00:05:32,860
So here we go in case there is no user meaning that the token has expired or is not valid.

63
00:05:32,860 --> 00:05:35,410
So the return next.

64
00:05:35,410 --> 00:05:41,050
Then we pass in our error class as an error.

65
00:05:41,090 --> 00:05:46,720
Then you pass in the message as invalid or expired.

66
00:05:47,200 --> 00:05:50,320
Token comma, please.

67
00:05:54,510 --> 00:06:04,460
Log in again, then pass in the status code as 401 And lastly, you need to export from this file as

68
00:06:04,470 --> 00:06:04,920
module.

69
00:06:04,920 --> 00:06:08,520
The export is equal to a logged in.

70
00:06:08,610 --> 00:06:14,580
So now any route that we want to protect our the to is logged in.

71
00:06:14,580 --> 00:06:20,250
So back to the root of users, that is a user's root.

72
00:06:20,280 --> 00:06:28,740
Let's require that middleware as is logged in and the auto import is working fine.

73
00:06:28,860 --> 00:06:36,660
So here I want to protect the profile, so I'll pass it as a second element to this handler.

74
00:06:36,660 --> 00:06:38,200
And here we go.

75
00:06:38,220 --> 00:06:41,850
So moment of truth, let's collapse everything.

76
00:06:41,850 --> 00:06:46,560
And now let's go ahead and make the request for the profile.

77
00:06:46,770 --> 00:06:48,450
So let's hit send.

78
00:06:49,930 --> 00:06:51,430
Why is this happening?

79
00:06:51,460 --> 00:06:56,430
The problem is that maybe we are calling next inside the murderer.

80
00:06:56,440 --> 00:06:58,390
And indeed it is true.

81
00:06:58,420 --> 00:07:04,250
Unless we are caught next to so that it can move to the next minute where that is our controller.

82
00:07:04,300 --> 00:07:07,210
So now this one, let's send again.

83
00:07:07,240 --> 00:07:09,070
And here we go.

84
00:07:09,100 --> 00:07:11,340
We get back the profile.

85
00:07:11,350 --> 00:07:15,940
So in case I change the token, let's see what we are going to get.

86
00:07:17,260 --> 00:07:19,840
Whereas after we get back the profile.

87
00:07:20,050 --> 00:07:26,430
So let's look at the verification token and this is where the problem is.

88
00:07:26,440 --> 00:07:31,210
You can see that it is returning a text and a text is always true.

89
00:07:31,210 --> 00:07:34,390
So we need to change this one to false.

90
00:07:34,390 --> 00:07:36,190
So now let's save it.

91
00:07:36,190 --> 00:07:38,470
And now let's send the request again.

92
00:07:38,650 --> 00:07:45,610
This time around we go back the message meaning token expired, meaning that we have template with a

93
00:07:45,610 --> 00:07:46,360
token.

94
00:07:46,360 --> 00:07:53,920
So if I undo and send the request again you can see that we have back the profile round.

95
00:07:53,920 --> 00:07:59,890
So with this one I have access to the log in user and red dot user.

96
00:07:59,890 --> 00:08:08,470
So here if we consult the log, the rec dot user, let's see what we are going to get.

97
00:08:08,470 --> 00:08:12,010
I'm going to get the ID of the log in user.

98
00:08:12,010 --> 00:08:16,060
So let's hit send and here we go.

99
00:08:16,060 --> 00:08:22,660
So with this one, I can take this ID and make a request to MongoDB to find that particular user.

100
00:08:22,660 --> 00:08:24,730
So let's implement that one.

101
00:08:24,730 --> 00:08:30,300
Before we end this video, we need to bring in the user model and we have it here.

102
00:08:30,620 --> 00:08:36,730
And next is you are going to take the ID from the request object.

103
00:08:36,730 --> 00:08:38,799
So here we go.

104
00:08:39,460 --> 00:08:49,630
Cost as user is equal to our weight and on the user model we're going to use fine by ID.

105
00:08:49,660 --> 00:08:52,990
The ID is under request dot user.

106
00:08:53,020 --> 00:08:59,800
Do you remember I told you that we are going to implement this way without using a parameter or first

107
00:08:59,800 --> 00:09:04,540
light by passing in the ID inside the URL, here is the answer.

108
00:09:04,570 --> 00:09:08,590
Now we can get the idea of the user from the request object.

109
00:09:08,590 --> 00:09:11,140
So we are going to remove this one from here.

110
00:09:11,140 --> 00:09:19,780
In this way we need to modify our route so we inside the user's route, which is this one for the profile,

111
00:09:19,810 --> 00:09:27,010
we are going to move the ID and going to be forward slash user how awesome it is.

112
00:09:27,010 --> 00:09:33,160
So save it and let's save this one or so and let's thank the actual user.

113
00:09:33,160 --> 00:09:35,140
So here we go.

114
00:09:35,140 --> 00:09:39,610
So let's remove this one and let's send the actual user.

115
00:09:39,610 --> 00:09:41,380
So let's check it out.

116
00:09:41,470 --> 00:09:44,680
Let's hit st moment of truth.

117
00:09:44,680 --> 00:09:55,120
A We go back the user with the account empty and with the details about the user here ends this section

118
00:09:55,120 --> 00:09:58,540
and the authorization and then the authentication.

119
00:09:58,630 --> 00:10:05,680
So with this one, we can create a word for admin users only and we can give you a a challenge.

120
00:10:05,680 --> 00:10:11,140
So with this one, you are almost there to finish up with the entire application because it is a more

121
00:10:11,140 --> 00:10:13,120
difficult part and we are done with it.

122
00:10:13,240 --> 00:10:18,310
So in this video, let's continue with the account and then with the transactions.