All right.
And once we can verify whether the cookie is present.
Up next, we want to verify the JWT as well.
If the JWT is present, then also we want to get the data.
Now, what data am I talking about?
Again, let's go back to auth controller and let's remember that when we create JWT, these are the
values that I'm passing in and this is exactly what I want to get back.
Why?
Well, because we'll attach this user to request and then of course we can create specific job with
user ID and also eventually we'll use this role as well.
And what's really cool with the library, there is actually a verify method that we can use and essentially
we just need to provide the token.
And also we want to provide the secret we use in order to create the JWT.
So first of all, let's navigate to the utils.
And here remember we have token utils.
So at the moment we are creating JWT and since we're already familiar with the setup, let's verify
the token as well.
We'll right away export and I'm going to call this verify.
Then JWT and in here I'll pass in the token basically a JWT that I'm getting back from the cookie.
And as far as the functionality, let's come up with a variable.
In my case, I'm going to call this decoded.
So essentially this is the result.
This is the payload we sent over here and this is what we're going to get back when we run JWT again,
the library.
And then the method name, like I said, is verify.
And it's looking for two things.
It's looking for a token and it's also looking for process dot env.
Essentially the secret string which we use in order to create the JWT.
And at the very end we just want to return the decoded.
Let's save it.
Now we want to navigate to auth middleware.
Over here and right between the next and the token I want to set up, try and catch.
So if the token cookie is present, I want to verify whether the JWT is valid and if everything is good,
then I want to grab the user ID and role because those are the two things I passed in the payload.
So first let's set up, try and catch and I'll actually move this next up.
So only if everything is great then I want to move on to the next middleware, basically to our controller.
If not, here's what we're going to do.
Same deal.
I'll say, You know what?
The authentication is invalid.
There's something off with the JWT.
Now, as far as the result, our right away or you know what?
Let me log it.
I think it's going to be easier.
For now, I'll just call this data.
But essentially, this is our payload.
And we want to go verify JWT.
Remember, it's looking for one thing and one thing only, the token.
And like I said, eventually we'll add it to the request.
For now, let's just go with log.
And you know what?
It's actually a user, so.
Let's be precise.
I'm going to go with user.
So let's navigate back again to our get all jobs.
Let's send it and check it out.
Since the cookie is present, since the token is valid, what do you know?
I have user ID which essentially matches the user ID of John and I also have the admin.
And what's super, super, super, super awesome.
We can attach these values to the request.
So then in the upcoming controllers, we can use them.
So how is that going to look like?
Well, in here, like I said, I'm going to destructure both of them and I'll create a new property
on the request object.
So for starters, let's just go over here and say user ID, so I'll destructure it.
Then also let's grab the role.
And when it comes to request, I'm going to create a new object, a new property, which is going to
be an object.
First value user ID, second one role, and then we'll pass it on to the next controller.
So now let's navigate to pum pum pum pum pum.
Job controller and same deal since we're working with Get all jobs again, we just want to log.
And more specifically, we want to look for req dot user.
So now let's check it out.
We're going to go to get all jobs and if everything is correct.
We'll be able to see the user object we just created.
Actually in the console, which again is super, super awesome.
And as a result, we now have restricted access to the job routes.
So we restrict the access if the cookie is not present or the JWT is not valid.
However, if everything is fine, then we actually attach the user from the JWT to our request, which
will allow us to set up the upcoming functionality.
And this user object is going to be available in all of the controllers which have this authenticate
user middleware sitting in front.
And of course, in our case, those are all the job controllers.