1 00:00:00,330 --> 00:00:05,930 And before we continue, let me just give you a big picture of what we're about to do. 2 00:00:06,330 --> 00:00:10,650 So first, we know that we have a post about the log one. 3 00:00:11,310 --> 00:00:16,620 And essentially, since we want to log in or register users in this case, we're going to be looking 4 00:00:16,620 --> 00:00:17,310 for two things. 5 00:00:17,760 --> 00:00:21,320 We're going to be looking for username as well as the password. 6 00:00:21,630 --> 00:00:25,650 And we already know that it's going to be available in RAGBRAI. 7 00:00:26,510 --> 00:00:35,360 Now, if both of them exist, we want to create a new JWT, if not, then we want to send back the response 8 00:00:35,750 --> 00:00:39,660 and we want to say, hey, listen, please provide email and password. 9 00:00:40,280 --> 00:00:47,210 Now, if we're good, if we create a new dress and web token, then of course, we want to send it back 10 00:00:47,210 --> 00:00:56,210 to the front end sans front and taxes in order to send another request, in order to send the request 11 00:00:56,570 --> 00:01:03,500 where essentially we display this secret information and on our end, we want to set up the authentication 12 00:01:03,920 --> 00:01:09,660 so only the requests we JWT can access the dashboard. 13 00:01:09,690 --> 00:01:17,150 Otherwise, if you go currently to our front end notice, click here and I can actually access the data. 14 00:01:17,390 --> 00:01:18,920 But that's not what we want. 15 00:01:19,280 --> 00:01:23,140 What we want on the front end here or from the postman doesn't really matter. 16 00:01:23,150 --> 00:01:25,880 But of course the content is just easier to see. 17 00:01:26,210 --> 00:01:31,970 We want to provide username and password and only if both values are provided. 18 00:01:32,360 --> 00:01:35,990 Then we get back the token and only with our token. 19 00:01:35,990 --> 00:01:42,110 We can make a successful request and eventually display our secret data on a frontin. 20 00:01:42,590 --> 00:01:50,180 Otherwise we get an error since the dashboard is restricted and only accessible by authenticated users, 21 00:01:50,270 --> 00:01:56,330 or in other words, only by the request where Jason, what token is present? 22 00:01:56,750 --> 00:02:02,420 And if we take a look at the comments, the first thing we want to do is check for username and password. 23 00:02:02,750 --> 00:02:08,009 And since it's a post, what we already know, that data is going to be in that body. 24 00:02:08,270 --> 00:02:14,210 So here we go with CONSED and then looking for both things, username and password. 25 00:02:14,540 --> 00:02:17,150 And this is going to be the case where I will log them out. 26 00:02:17,240 --> 00:02:23,190 So set up here log and I'm going to be looking for both username and password. 27 00:02:23,330 --> 00:02:28,820 This is the case where you can send those requests from the front line, but I highly encourage you 28 00:02:29,060 --> 00:02:36,300 to do that from the postman first and only do that later once our JWT functionality is in place. 29 00:02:36,770 --> 00:02:39,440 So I guess I'm going to navigate your my postman. 30 00:02:39,470 --> 00:02:40,970 I'm looking forward to logging one. 31 00:02:41,240 --> 00:02:42,210 I have the body. 32 00:02:42,260 --> 00:02:43,150 Yeah, that's awesome. 33 00:02:43,370 --> 00:02:49,110 And then I'll send it back in my application if I take a look at the console. 34 00:02:49,130 --> 00:02:51,950 Of course I have John and Secret. 35 00:02:52,130 --> 00:02:58,620 There also could be a case where the user is trying to login with just antivirus. 36 00:02:58,880 --> 00:02:59,330 Correct. 37 00:02:59,720 --> 00:03:03,290 So he or she can send this type of request. 38 00:03:03,560 --> 00:03:06,200 And now the console, I can see that I have nothing. 39 00:03:06,390 --> 00:03:14,600 And before we issue the token, which eventually will allow the front-end to access the road, I want 40 00:03:14,600 --> 00:03:19,610 to check whether the user name and the password have been provided. 41 00:03:20,120 --> 00:03:24,620 Now, eventually, once we work with the database, effectively, we have three options. 42 00:03:24,620 --> 00:03:30,410 First option, remember, when we use Mongo's required validation ID checks that for us. 43 00:03:30,890 --> 00:03:34,240 If the value is not present, it simply spits back there. 44 00:03:34,370 --> 00:03:38,720 So that's definitely one route that we can take once we introduce a database. 45 00:03:39,140 --> 00:03:42,200 But in this case, remember, we're not connecting to the database. 46 00:03:42,410 --> 00:03:47,720 Another option we have is to set up the entire additional layer of foundation, which is going to be 47 00:03:47,720 --> 00:03:54,500 sitting in front of all of our requests and in order to accomplish that task will utilize another package 48 00:03:54,500 --> 00:03:55,460 by the name of joy. 49 00:03:55,910 --> 00:04:02,000 But I only want to do that in the latter project once we have a solid understanding of the JSON Web 50 00:04:02,000 --> 00:04:02,430 tokens. 51 00:04:02,600 --> 00:04:09,320 Now, the third option is actually checking for both of these routers over here where I can say, hey, 52 00:04:09,860 --> 00:04:17,740 if the username or password have not been provided, then I'll send you back a response. 53 00:04:18,170 --> 00:04:24,410 Now, in our case, what's really cool, we have that package that wraps all of our routes and we simply 54 00:04:24,410 --> 00:04:25,620 want to throw error. 55 00:04:26,000 --> 00:04:26,770 What error? 56 00:04:27,200 --> 00:04:33,320 Well, our custom one where we say, hey, listen, you did not provide both of ours, so therefore 57 00:04:33,320 --> 00:04:38,150 we will send back a four hundred response, which essentially is a bad request. 58 00:04:38,390 --> 00:04:39,290 So let's try it out. 59 00:04:40,180 --> 00:04:49,440 I'm going to go back to my comptrollers and here I'll if and if there's no username, username and Zantop, 60 00:04:49,660 --> 00:04:53,470 let me move these ones up and I'll add that comment. 61 00:04:53,830 --> 00:04:55,960 Check in the controller. 62 00:04:56,970 --> 00:05:03,090 And the controller and once we're done, I'll actually show you how we could have used that in task 63 00:05:03,090 --> 00:05:03,910 manager as well. 64 00:05:04,290 --> 00:05:11,190 So let's go down and then we have user name if it doesn't exist or if the password doesn't exist. 65 00:05:11,730 --> 00:05:16,130 So essentially, if one or both are missing, that we want to throw that error. 66 00:05:16,170 --> 00:05:16,510 Why? 67 00:05:16,530 --> 00:05:21,930 Well, because that's what we can do since we have that express async errors. 68 00:05:22,350 --> 00:05:23,910 Now, what are we looking for? 69 00:05:23,920 --> 00:05:25,540 Of course, that is our own one. 70 00:05:25,980 --> 00:05:31,730 So in the controllers, when we want to do is import our custom error. 71 00:05:32,010 --> 00:05:34,530 So let's go here with const custom. 72 00:05:35,890 --> 00:05:43,330 Appear now that is equal to require we're looking in the errors in this case, and more specifically, 73 00:05:43,510 --> 00:05:51,220 we're looking in the custom one, and if the user has and provided the values of username and password, 74 00:05:51,550 --> 00:05:53,860 then of course, we can simply put you error. 75 00:05:54,070 --> 00:05:57,730 And remember, this is going to be handled in our own error. 76 00:05:57,730 --> 00:05:59,320 Handler middleware, correct. 77 00:05:59,620 --> 00:06:04,600 The middleware that we set up, it's going to check for our own API error. 78 00:06:04,900 --> 00:06:10,100 And if that is the case, then we'll send back the status with status quo as well as the error message. 79 00:06:10,360 --> 00:06:14,080 So now we simply want to throw new custom API. 80 00:06:14,590 --> 00:06:15,420 My apologies. 81 00:06:15,490 --> 00:06:21,430 I started typing our show where we need to go with Custom Appia and here also please provide email and 82 00:06:21,430 --> 00:06:21,910 password. 83 00:06:22,180 --> 00:06:24,730 And as far as the error code is going to be four hundred. 84 00:06:25,000 --> 00:06:31,060 So four hundred stands for bad request and once we have the code to throw the error now I can remove 85 00:06:31,060 --> 00:06:35,140 this console log and let's just go back to the postman and test it out. 86 00:06:35,710 --> 00:06:43,780 So if I haven't provided anything I should have please provide email and a password and that is code 87 00:06:43,930 --> 00:06:46,000 should be four hundred again. 88 00:06:46,390 --> 00:06:52,930 If you already forgot how the custom API error works and all that, please go back to the previous project. 89 00:06:53,380 --> 00:06:58,590 I believe we set it up in Task Manager where I covered all of this in great detail. 90 00:06:58,930 --> 00:07:03,550 So essentially, if these two values are not provided, we have three options. 91 00:07:03,730 --> 00:07:07,500 We can either use Mongo and, you know, just search less confusing. 92 00:07:07,510 --> 00:07:15,010 All right here, mongoose validations or we can set up another validation layer with the help of package 93 00:07:15,010 --> 00:07:16,750 by the name of joy, which we'll do later. 94 00:07:17,140 --> 00:07:22,330 Or we can simply check in the controller and just the showcase. 95 00:07:23,080 --> 00:07:28,150 If you take a look at the task manager, remember, that was our third project where we essentially 96 00:07:28,420 --> 00:07:30,250 just started working with database. 97 00:07:30,520 --> 00:07:35,830 More specifically, if we're looking in the controllers and then create a task. 98 00:07:36,130 --> 00:07:39,040 Remember, we handled this with the help of Mangoush. 99 00:07:39,370 --> 00:07:39,820 Correct. 100 00:07:40,090 --> 00:07:45,460 Because if you take a look at the models, you'll see the name and this one is set to be required. 101 00:07:45,850 --> 00:07:49,240 Now, the same way we could have just checked in the controller. 102 00:07:49,780 --> 00:07:53,560 We could have just said, OK, check if the task exists. 103 00:07:53,980 --> 00:07:56,300 If it doesn't exist, we throw the error. 104 00:07:56,320 --> 00:07:57,790 In this case, it was a little bit different. 105 00:07:58,090 --> 00:08:03,190 We use next since we used our own Anderson Cooper, the general idea doesn't change. 106 00:08:03,430 --> 00:08:04,840 We're still throwing the error. 107 00:08:05,140 --> 00:08:08,290 And if everything is great, then we're creating a task. 108 00:08:08,530 --> 00:08:14,440 And the only reason why I'm telling you all of this is just to understand that you have multiple options. 109 00:08:14,620 --> 00:08:19,300 You're not limited to just setting up the validations in the models. 110 00:08:19,420 --> 00:08:20,710 Yes, you should do it. 111 00:08:20,860 --> 00:08:22,590 It doesn't mean that you should skip that part. 112 00:08:22,900 --> 00:08:27,100 Just be aware that there's extra layers of validation that we can. 113 00:08:27,130 --> 00:08:31,600 And in our case, we simply set them up right in the controller. 114 00:08:31,810 --> 00:08:39,760 So if the username or password is not provided, just Rodier, which gets handled in our own middleware 115 00:08:40,090 --> 00:08:46,870 in the handler one here, which is check for the custom API and then we send back the response. 116 00:08:46,990 --> 00:08:52,480 And of course, if that is the case, we don't send back this string, we send back the error.