Now, I don't want to protect all event routes, instead just some of them, just the ones where
we create something.
And you can do this in Express.js by calling authenticate here, or by pointing at authenticate
here as a second argument after this path, before the function that should actually be
invoked for incoming requests that are sent to this path.
For that, authenticate is imported here, and then we can add this here for the put route
and for the delete route.
And the get routes are not using this middleware because they should be accessible even if
you're not authenticated.
So now as a result, we should be able to send a get request to localhost 3000 slash events,
and that should work.
Indeed, I get back an array of events that have been created before.
The first event has a bunch of nulls here because I didn't have validation back then,
if you recall.
But sending that request works.
Also we can send a get request to slash events slash and then some specific ID, like 1 or
of course also 2 here.
These are the two events I have, and we should get that specific event data.
So that works without authentication.
But trying to create an event, so sending a post request to slash events with valid
data should now fail if we don't have the token attached.
And to attach it, you can go to headers, and then add an authorization token here or
authorization header.
And then the value is bearer, blank, and then a valid token.
Now how do you get a valid token?
Well, by creating a user or by logging in.
So here I'll log in with those credentials, which I used before for creating a user.
And it's then this token here, this long string, which you want to copy, and which you then
should paste as a value after this blank, after bearer here.
And that attaches the token to the request.
If you now click send, you see I got back a success response again.
The post, the event, I mean, was created.
If I change the token and I remove the E, I make it invalid, and hence I get an invalid
token response.
So that seems to work the way it should.
We can now create events, but only if we're authenticated.
Now let's, of course, also test whether we can add it or delete events.
And for that, I'll actually create a new request here where I want to put or where I want to
send a put request because I'm expecting a put request to slash events slash some ID.
That's a placeholder for any specific ID.
I can send requests here, and I can attach the data with which I want to update the event
for a specific ID.
So I put request to HTTP localhost 3000 slash events slash free, let's say, and then add
a body raw JSON.
And I'll now copy the body from before, which I used before for creating an event, and I'll
paste it here for the put request.
But I'll now change it a little bit and say a test event updated so that we can tell that
this works.
And I'll also say updated here and have my updated test street and a different time.
Now this would fail because I haven't added a token yet.
That's why I get missing authorization header as an error message down here.
So again, just as before, we need to add the authorization header, bearer blank, and use
that same header we used before for creating the event.
So copy that or copy it here from the response of the login request.
Copy that and put it here after the blank after bearer.
That seems to work.
To verify whether it works,
we can grab this specific event with ID three,
which I just updated,
and send a get request to events slash three,
and you see all the updated data was stored here.
Last but not least, let's try deleting.
Send a delete request to localhost 3000 slash events,
and then slash the ID of the event we want to delete,
and let's say it's the event with ID four.
Without anything else that fails,
we don't need to add a body,
but we do need to add this authorization header,
bearer, blank, and a valid token,
and now it was deleted.
We can confirm that it was deleted by sending
a get request to slash events without a specific ID.
This will get us all events,
and we see one, two, three are there,
but the fourth event,
the event with ID four was deleted,
because that's exactly what I did with help of this request.
That's not working the way it should.
We don't have image upload, of course.
We'll add this later,
but that's not working,
and we added all that functionality with help of GitHub Copilot,
and of course, some manual programming work here.