All right.
And once we're done setting up the validation layer for our login request.
Now let's set up the functionality in the controller.
Where we want to check whether there is a user with such email.
If not, then we'll throw our own error.
Remember a few videos ago we set up a few classes.
So this is the case where we'll throw our custom class for unauthenticated error.
Essentially that is 401.
And also we'll compare the password.
And this is the case where I'll right away set up the utils function since we are already familiar with
such approach.
So let's navigate to the auth controller and instead of the login one, well let's just start by looking
for the email.
Now where is the email located?
Well it's in the req dot body and then the email.
Correct.
So if everything is correct, we pass the validation layer and we're going to go with const user is
equal to await.
Then user dot and we're looking for find one and.
Essentially I want to go with email and if the email is equal to req, dot, body and email, so find
me that particular user whose email matches to whatever is coming in.
Now, if the user doesn't exist, essentially if it's null, what do we want to do?
Well, this is the case where we'll go with throw new and like I said a few videos ago, we already
created them.
So let me go back to the errors, custom errors.
Notice this on authenticated.
So this is the 401.
And then this one we'll set up a little bit later.
So in here, let's go with our custom one.
That's the one over here.
And as far as the message, we're going to go with invalid.
Provincials.
Let's save it and let's try it out.
So I'm going to go to a login one.
So the cool thing is that now I don't need to remove the users from the database.
I can simply provide a wrong email.
So if I'm going to go here with Susan, since there is no such user, of course I'll get back the invalid
credentials and check it out.
The status code of course, is 401.
Okay.
So now let's set it back to John and let's add more logic.
Like I said, we want to compare the password and I'll right away set it up in the utils.
So export it.
In this case, I'm going to call this compare.
Password.
And this is going to be equal to.
My function is going to be async and we'll first provide the password.
So that's the password that's coming in with the login one.
And second one is going to be the hashed password and you'll see what I'm talking about in a second.
So in here.
In a function body.
We want to set up a variable.
In my case, I'm going to call this is match and it's going to be equal to await.
Again, this is asynchronous.
We want to go with our script and the method name is compare and same deal.
It's looking for two things.
It's looking for the password and also the hashed password.
So Hashed password is coming from our database.
So let's provide the same two things hashed password and then at the end, what do we want to do?
We want to return is match.
So if the password matches, we are in good shape.
Now let's navigate to our auth controller and please keep in mind something very, very important if
we can get the user.
Then of course, we'll have the user object.
Correct.
And in there we have the password.
So we can only start comparing those passwords if there is a user with such email.
Hopefully that is clear.
Then we want to set up a variable and in my case I'm going to go with is password correct.
Now, I'm fully aware that some people probably don't like the length of such variable, but I actually.
Prefer the explicit naming over something really short.
And then later it's really hard to understand what's happening.
Let's go here with is password and then correct.
And that one is equal to await.
So again, our function is asynchronous.
We want to set up compare password and remember our password is in the req.body, then password just
like the email.
And then the second one is going to be user password.
If you want, you can log it over here.
Again.
If we can find the user, then there's definitely going to be a password property on the user.
Now, if it doesn't match, if the library complains that it's not the same password, what do we want
to do?
Pretty much the same thing.
And yes, in a second I'll show you how we can actually refactor and have even less lines of code.
So for now, I'm just going to go with is password Correct?
Let's save it here.
And if everything is correct, we'll just send back the login one.
So let's navigate to a login user.
Let's mess with the password.
So I'll remove the last character and we should see invalid credentials.
Now, if you're a fan of one liners, actually we can combine both of these conditions the way it's
going to look like.
First, let's navigate back to a login and essentially I can just go with const is valid.
User and that one is equal to user.
Then the and operator.
And then I basically want to take this logic over here.
So let me cut it out.
And then instead of having two conditions, we can have only one.
So is valid user and of course we can remove this one as well.
So essentially.
If.
The user exists, then we'll check for a password because the way the end operator works, if this is
going to be false, then we'll immediately just bypass the second option over here and we'll right away
throw this error over here.
So let's try it out again.
Let me send and notice I'll still get back the invalid credentials.
Now, if the email is correct as well as the password, then of course in response we'll see the login
text.