Okay guys, so it's time that we try if our system works.
I think this video is not only me clicking through the project that I've created, it's an exercise
of how we can debug things that we've created and see why they don't work.
So currently I am thinking everything should work fine, but I need to make sure that's why I'm open.
I'm gonna open the development tools and jump to the application tab to the cookies for this domain.
Just make sure you select yours.
And we see such cookies.
By the way this one is for the PHP session ID.
So by removing this one we can reset the session.
And that's how we're going to check if the Remember Me token works.
Let's try with this admin user.
So the password is admin 123.
Let me check this checkbox and let's log in.
Let me refresh the cookies so I don't see our cookie.
I'm definitely logged in because we have the logout button.
So let's start with the auth controller.
Okay so I think I see the issue right away.
This is grayed out the remember variable.
So I haven't passed the variable to the attempt method which as a reminder accepts this as a third parameter.
Okay.
And that's also a potential issue with optional parameters that you might forget to pass them.
Let's see.
Now I'm going to log out first.
Then I'm going to try again using the right password.
I'm gonna check this.
Not the best looking checkbox and login.
So now something went wrong.
And, um.
Table must not be defined in core model.
Remember token.
Line eight.
All right, let's jump to it.
Um.
Protected static string.
Okay, I see the problem.
So we try to add a type for a model field, which is table.
And in the base class it didn't have a type.
Now I think it should have the type.
And it just makes sense.
It's always a string.
Let's see if I can resend that.
Okay.
Another problem is that the table must be string, and apparently in the user it doesn't have a type.
You know what?
Let's just jump to all the models and make sure we type the table field.
That's comment.
That's post.
Remember token and user.
Okay let's try again by resending the form.
Okay.
Another problem is that the type of ID should not be defined.
Okay, so not to waste too much time on fixing those small issues.
Let's just ignore the type of ID for now as we'd like to check the core functionality.
And this is just slowing us down.
Okay, so this time something has happened.
We've got the token.
It has some value.
That's why we have used this.
Been to hex function.
Not sure if you even remember that, but we wanted this token to be human readable.
And when we generated it in the Remember token class, we've used this pin to hex function because random
bytes would really be random and some of the bytes don't really have a corresponding characters.
So that's our token.
At this point I'm just going to jump back to the database.
I think it's super handy to have an SQLite database for development.
It's so quick to jump back and forth to the database.
Okay, let me enlarge the row view.
I see a token here, and if I quickly take a look at it by comparing the beginning and the ending.
Well, it is exactly the same, which confirms it should really be fine.
Now this date is one month from now.
I'm recording this on ninth.
Sorry, 7th of September, I guess.
So, seventh or eighth doesn't matter.
Around one month earlier.
So this expiry date is fine.
Okay, so here's a created update.
So that is my current date okay.
So it seems that everything works at least up until now.
Now we're gonna do some destruction.
We're gonna remove this PHP session ID cookie, which PHP just internally is using to track the user
session by setting this expiring cookie, it can just get the session data for you.
Session data is stored on the server, but it is identified by the cookie value.
Now which one does remove.
Okay.
So this button will remove the selected cookie.
I'm doing it right now.
Normally we would be signed out.
And that's a test if everything works because we now have this remember token in a cookie and in a database.
And when I refresh this page I should still be authenticated.
If I am not, then we have something to fix and we are authenticated.
As you see the session ID is different.
Or maybe you didn't see that because probably you didn't focus on that.
But it is different.
It was recreated and I am still authenticated, not in the session, but using the cookie.
So maybe the next test would be to get rid of this.
Remember token or another test is to refresh again.
Because if we fetch this remember token we should get a new one.
And I think it is a different one.
It starts with different characters.
Well, you also maybe didn't remember that because I don't expect you to.
This is just some random characters, but I remember it was different.
So another test is let me jump to the database and see if we don't have duplicate tokens, and if we
have just this one, if our update method has worked, and I can see that it has worked because this
token is exactly the same as that one in the browser.
So this token rotation has worked.
Let me refresh again.
We are still authenticated.
And there we have it.
Another token.
This one is different.
Let me refresh the database.
And it is exactly the same as on the application network tab.
Okay, so this functionality looks like it just works.
We can stay authenticated up to 30 days.
And every single time we refresh the page we're going to get a new token.
Now the final test is to log out.
So now I hit logout and the cookie was destroyed.
And this row should also be destroyed.
It wasn't.
So that's a thing we should fix.
We should make sure that this token is destroyed first.
So we've got one thing to fix.
Everything else seems to work perfectly Now, this token does not match any cookie, but it is still
valid and it stays in the database.
So if someone would figure it out, he would be able to authenticate himself.
That's why we need to make sure it is actually deleted.
Okay, so let's debug it live.
I think it will be a useful exercise.
So I'm not scripting this.
It's not planned.
I'm just gonna try and fix the issue so you can see how this is typically done.
So I'm sure that I'm logging out using this method.
And it kind of worked because we see the cookie was destroyed but the token wasn't.
So let's jump to clear token method.
And it seems that we need to vardump the token string.
To see if it was found.
Because the last thing is removing the cookie.
So maybe I'm going to vardump that at this point saying token is.
So we just have all the steps.
Next up we're gonna print the token object.
That this token, maybe it is just empty or we have something wrong with this method.
No one knows.
And then there's delete method.
Um, let me var dump, um, id is and this id maybe the id is not set for any reason.
And finally, let me just dump the result of a delete query.
I think maybe that's enough.
Let's see how this would work.
So I want to be remembered for sure the login and password.
We are signing in now.
Let me log out.
Oh yeah.
The final thing is we need to die.
I forgot about that.
So the auth controller.
Is it this one?
Destroy.
Okay.
We need to die so we can see the output.
Okay, let's do it quickly.
Admin 123.
The remember token sign in sign out.
Okay.
So the token is.
And this was the token.
The token object.
Um, it did match the token from the cookie, it seems.
So I think that at this point we might try something else.
Maybe the token that stays in the database is maybe some old token that we didn't remove.
Maybe something went wrong and it just stayed because things went wrong.
It doesn't match the ID that I see on the screen.
And also this one seems to be removed.
What I'm gonna do is I'm just gonna load the fixtures again.
So let me do composer fixtures, suggest the correct method.
I'm going to run it.
So hopefully this would also remove the remember tokens.
I'm not sure if that would be the case.
Okay.
Not really.
Anyway, that's not a problem.
Let's jump to fixtures and let's add another query.
That removes everything from remember tokens.
Okay, let's run that.
Confirm with.
Yes.
Okay.
Now this table should really be emptied.
And it is.
And we just need to clean up after ourselves.
So I think it would work now.
So let me remove this debugging code.
Find validate.
We don't really have any debugging in here and here.
We need to get rid of this.
And this vardump.
Just make sure we run the query and the auth controller shouldn't die.
So what I expect right now is that we actually get the token deleted when we log out.
Let me restart the server and zoom out a little.
And the last time let's test signing in.
Remembering ourselves there is the cookie.
Remember token there is the value starting with four, eight, six.
Okay, let's log out.
Cookie is gone.
The database.
Let's refresh.
And it is empty.
So it was removed, which confirms that everything has worked fine and our feature is finished.