All right.
And last controller in the user controller is get application stats, which is going to be actually
an admin route where we can get info, how many users we have in our application as well as the jobs.
As far as functionality, it's actually going to be very straightforward.
We're going to go with const users and that is equal to await then user.
So first the user model.
Then the method we're looking for is count documents and the same deal is going to be for jobs.
We just want to change here, jobs and also we want to change to job documents.
We're not going to send back this message.
Actually, we'll go with users and jobs and everything is awesome.
So I can definitely make that request if I navigate to my Thunder client.
Let me just look for it.
Let's send it over here.
And now notice it gets me two users and each user has two jobs and that's why I have a total of two.
The problem is that at the moment, let me log in as Peter again.
Let me just change this value around.
And you'll notice that since Peter is a valid user, basically he has a valid token as well as the valid
JWT.
He can also take a look at the stats.
And in order to fix it, we need to create one more middleware.
So first, let's navigate to our auth middleware.
First, let's just have some basic setup and then we'll add some additional things.
So first let's just export and in this case, we'll call this authorize permissions.
And as far as the functionality, we're going to use the rest Operator.
So effectively we're gathering all of the parameters and they will be nicely stored in the array.
And you'll see in a second why we want to do that.
So first let's just go with next.
So we'll pass it on to the next one, basically to our route.
And also let's log what we have here as far as the roles.
So whatever I call over here, it's going to be my array.
So let me just go here with the rest and then let's look for our route.
Of course it's in the user one and we're looking for this app stats.
Please keep in mind we already have the authenticate user.
Correct.
So only authenticated user can access this route.
But now we want to add one more thing and that is our authorized permissions.
So let's go over here.
That's the function and here's the gotcha.
I actually want to invoke it and I want to pass in.
Well, which roles can access this particular route?
And essentially, in our case, we want to go here with admin.
Now also, this is an express thing, but we can nicely group together multiple middlewares just by
adding here the square brackets.
Again, in this case it doesn't change anything, but I just like how it looks better.
Basically we have authorized permissions and only if everything is correct then we get to the admin
one.
So now let's take a look.
What do we have in the console?
And actually it crashed because next is not defined.
Huh?
Now, why is that?
Well, because remember, we invoked this right away and instead of providing req and rest and next.
The parameters we have access to.
We actually went with roles.
Basically, we went with whatever we pass in.
In the arguments, not the express, and therefore we need to refactor.
Our authorized permissions.
So let's navigate to auth middleware.
And from this function I actually want to return another function because again, we invoke that authorized
permissions right away.
So how is that going to look like from the function?
I'll return another one.
Req.
Rise.
And then I'm going to go with next.
So again, this is provided by Express.
And now we want to move the next up and eventually we'll have a bit more logic.
Now there's a tiny syntax error.
Let me save it over here.
And now let me move this rest down.
Again, all of these acrobatics we need to do because we invoke authorize permissions right away.
Now, I still have the error because it's not req and req should be req and res over here.
And you know what?
Instead of using the rest operator name, I'm just going to go with roles.
Again, the idea doesn't change.
We simply want to take a look at the value we're going to be getting.
And now again, let's make a request to application stats.
So check it out over here.
Notice this is our array.
And in here I'm looking for the admin one.
So this is the logic up to this point.
So we can set up the functionality where we'll check whether rec dot user role is in the array.
So in our case, we're looking for the admin, correct.
Now for Peter, the role is what role is user and effectively we want to go with if condition and we'll
say roles, which is our array.
It has the method of includes and we just want to pass here req dot user role.
And again we have access to the req dot user role because we already have the authenticate user middleware.
And as far as the error, which one we want to throw, well this is going to be again that unauthorized
error.
So the 403.
So let's go here with throw new and unauthorized error.
So we import that, make sure that we have the JS and all that.
Okay, good.
And then when it comes to the error message, let's just write unauthorized to access this route.
And with this in place now we can go back to application stats.
And if everything is correct, if I'm logged in as Peter, I'm going to get back the 403 now if we go
to a login.
And we provide values for John that everything should be fine.
Why?
Well, because he's the first user and he's the admin user.
So now, of course I can get the application data and with this in place, we can move on to the next
step.