Okay, now that we've got our entities, let's take a look at creating an orders controller inside here.
So I'll create a new file in the controllers folder.
I'll make this a class and I'll call it Orders Controller.
And inside here we're going to create some endpoints.
And we'll start off with the easy ones I guess which is going to be the Get requests.
And this is going to derive from the base API controller.
And we're going to inject our store context into this to give us access of course to our database.
And inside here we're going to have an HTTP get.
And all of the endpoints in here are going to need authentication.
So above the class I'm going to use the authorize attribute to ensure that anonymous users cannot hit
and get data from these endpoints.
So we'll use a public async task.
And we are going to return from this an action result of type list.
That's going to be an order and we'll call it get orders.
That takes no parameters, but we don't just want to return all of the orders.
We've got different users and different accounts that have orders specific to.
That user.
So we're only going to return them that match the user that's authenticating to this endpoint.
So we'll use var orders equals and we'll use await context dot orders.
And then we're going to include and say x arrow x dot order items.
And we're going to add a where and we'll say x add the arrow x dot buyer email that's equal to the user's
identity dot name.
And then we'll specify two list a sync.
But we've got an issue here because our identity our compiler at this point doesn't know if identity
is null or is an actual user.
So we need to be defensive here.
But can we get away with using the optional.
Of course not, because we're going to get an error at this point because an expression tree lambda
may not contain a null propagating operator.
Okay, fine.
So we need to do something with this.
And the approach we'll take is our user is a type of claims principle.
And we'll add another extension method that allows us to get the username which is the same as the email
in this case.
So username via email I'll use the terms interchangeably.
But we'll add an extension method to our claims principle so that we can use a method just to get the
username and guarantee that username is available.
So we'll head to our extensions folder and we'll create a new file that's going to be a class.
And we'll call it Claims Principal Extensions.
And inside here we'll make this a static class because it's going to contain static methods and we'll
use public static.
And this is going to return a string and we'll call it get username.
And we'll say this claims principal and we'll call it user.
And we will return the user dot identity dot name.
And we'll use the double question mark.
So we execute anything to the right of that.
And we'll use the optional chaining here or the optional operator there.
So anything to the right of this double question mark will just throw a new unauthorized access exception.
And that guarantees us that what we return from this is going to be a username.
Because if that is null, then we're just going to throw an exception.
So if we go back to our orders Ordered controller.
We can then use our user and get username and now we don't get any problems.
And then below the two list async we can return the orders and below this Http.get will also create
an endpoint to get an individual order.
So inside here we'll specify quotes, open curly brackets and then specify an id.
Another thing we can do inside this parameter if we wish to is we can specify the type that we're expecting.
This does work for integers and it's an option we can include if we want to.
I don't see a huge amount of benefits in that, but it's something we can add just to ensure the property
that we are passing in is a number.
And I'll use it just in this example.
And then we can return an action result, a task of action result that's going to be an order.
And we'll call it get order details.
And we'll pass in the int that's an ID And we'll use var order equals await context dot orders and we'll
specify where as we still want to make sure that the user that's authenticating is the buyer of this
order.
So we'll use x goes to x dot via email.
That's equal to the user dot get username and the id is equal to x.id.
And then we can use first or default async.
And because of course the order may not exist in our database.
We'll check to see if we have it.
So we'll use.
If order is equal to null then we'll just return a not found from this.
And then we can go and return the order.
So that takes care of the get methods that we need inside our orders controller.
And next we'll take a look at what we need to do to create a new order.