Beautiful.
So how do we set up check permissions functionality?
Well, like I mentioned, previous video Well, check for user I.D. God is available on Iraq, that
user that is coming with our authentication maneuver.
And then we'll compare it to instance, Marco's job and created by.
But before we start typing away, let me mention two things.
First of all, yes, we can check it right here in the video.
And essentially, if they don't match, we go with an authorized error.
And then what we need to keep in mind that we won't essentially trigger dysfunctionality.
So if we check for machines and by the way, I need to move this up.
And if we trigger the error, then reverse moron.
That's the entire point.
Now, even though we can do it directly in the there job.
Well, we also might want to use it in different controllers, correct?
Now, because that is going to be the lead job controller.
And since that's the case, we might as well set up a separate function now, second control we need
to be aware of is the fact that user I.D. will be strong and job created by will be an object.
So if you just compare them like show, then it's not going to make any sense.
Essentially, the functionality won't work.
And just to quickly showcase that.
I'll grab both of these ones, and I'll set it up in jobs controller just so I can see that I'm not
making this up again.
Make sure that you move the truck permissions up because we want to do that before we actually update
the job.
So let's go back to the postman and let's send it.
And now I'm not really bothered about the response when I want to see here is the council and notice.
Like I said, first one will be a string and the second one will be an object and therefore cannot compare
them flat out like I showcased in the room.
Where we want to do is turn the created by into a string.
But before we go any further, let's also set up our function.
So I already know that the name will be checked permissions if we take a look at the read me.
And essentially, we want to go with UTOS folder.
We want to create check permissions that we want to import in the jobs controller.
And the functionality is going to look something like this where we want to grab this unauthorized error
from the errors.
And this function is going to be looking for two things for the entire user object.
And I'll talk about it in a second.
And also the resource meaning an archives job user ID.
And then why we're looking for the entire object, because again, you might have a situation where
you have the admin, if you are comparing there is not going to make much sense since the admin did
not create the resource, but admin should be able to update or delete the resource and therefore it
will check for the entire user object and in there.
If the role is happening, then we simply return, which means that we proceed with the functionality.
And if the I.D. does not match to whatever we have in a resource turned into a string, then we throw
the error.
Hopefully this functionality is again, we don't have the admin.
This is just a showcase why we're grabbing the entire user object instead of just the user I.D..
So if they match, we return from the function and we proceed.
We proceed with our functionality, which is updating the job horror.
If they don't match, then we throw the error.
So let's start working on that and I'm going to go with your folder.
I'm looking for utils in this case, utils.
And let's go here.
Let's say check.
Permissions.
Jess Start are just setting up the functionality.
I guess I'm going to go with my error first, so that is equal to from online and we want to go one
level up.
I want to go to errors and remember we need to go with index jazz then as far as the function set up
concert and.
Check.
Permissions.
Like I said, I'm going to look for a request.
Request user.
So I want to get the entire thing Quest user.
Com Online resource user and I.D. cards is going to be the name of my primer.
And for the time being, I'm just going to return since I first want to pass them in just so I can see
what is happening.
Now I have a issue here with the syntax, so I've missed it and now let's explore that and export default.
And we're looking for check permissions, not serve it.
And now we want to go back through the jumps controller.
And I think I'll try to do that with auto import where?
I'm going to leave the council just for a second, just so I can grab both of these properties here,
and then let's go check permissions and let's see whether we have just one.
It looks like everything worked and now we want to pass in those two things.
Like I said, we want to pass in the entire user object, right?
That user and yes, technically in our case, we could pass the I.D., but I already covered.
Why would you want to pass in the entire user object?
Because then of course, you can check for the rolls as well, and then we will go with job online created
and then by.
So what is that resource user ID?
When we invoke it, and if everything is correct, shouldn't get any errors, but in this case, I do
have on authorized error is not coming from errors and in.
So does not provide expert name on authorized error.
So let me double check my errors.
Let's see where I went wrong.
So I'm going to go over here.
Two errors index.
And yep, it is on authenticated error.
My apologies.
I'm going to go back over here.
And let's copy and paste and now everything should work.
So let's go back to the postman.
And if everything is correct and if I have the exclamation point, then we still have the functionality
in place.
So at the moment, what we're simply doing, we're just invoking check permissions.
And if we return from this function?
Awesome.
Now, if there's going to be our will for all year, so we'll never get to this update job one.
And as far as the functionality, well, here I'll just start by checking whether the user ID is equal
to a resource user ID, turn into strength and then let's throw the error again.
I'm not going to add the admin.
The admin functionality is already in the read me.
So let's set up our condition where I'm going to go.
Request the user.
Remember that is rec user when I'm looking for user ID and I'm checking if it matches the resource user
I.D. But we need to turn this into a string.
Otherwise, they'll never match.
And then you all the time have the unauthorized error.
So if they match, we return, so we proceed updating the research.
Now I can remove the third one from here, and then let's just say throw new.
And we're looking for an authorized error or my apologies unauthenticated and that will say not.
Authorized to access the truth, and once we have this functionality in place, if everything is correct.
Back in our post, we should get back to 401.
So it's solid.
And what do you know now I have 401 and not authorized to access this drug.
So in this way, we can set up the permissions where we check the user I.D. on that user, which is
again coming from our middleware and to see whether it matches to the resource user I.D. turn into the
string.
If it does, then everything is great.
We update the job and the next example delayed the jump.
If not, then we throw the error and the response is for a one.