‫So, we're currently in the process
‫of putting some finishing touches on our API,
‫and one of the things that we need to do now
‫is to fix some of the authentication
‫and authorization in all our resources.
‫And we're gonna start here with our tour resource.
‫And since all the authentication
‫and authorization stuff is always defined
‫on the route declarations,
‫well, we're gonna work here on the tour routes file.
‫So, this tour API that we have here
‫is basically what we want to expose to the world.
‫So for example, we might want to allow
‫other travel sites to embed our tours
‫into their own website.
‫And so that's what this API is basically for.
‫And so therefore, we will not have any authorization
‫on get tour requests.
‫Right?
‫And so we should actually get rid of the one
‫that we have currently.
‫Right?
‫So, this one.
‫So on getting all the tours,
‫right now we have to protect it,
‫and so only authenticated users can use that.
‫Okay?
‫But again, that doesn't make much sense,
‫because you want to expose this part
‫of the API to everyone.
‫So, let's get rid of that.
‫However, the actions of creating or editing tours,
‫we only want to allow lead guides
‫and administrators to perform these actions.
‫So of course, no normal users,
‫and also no normal guides.
‫So, just admins and lead guides.
‫And so let's put that here actually.
‫Authcontroller.protect,
‫and authcontroller.restrictto.
‫Admin,
‫and lead guide.
‫Give it a save here,
‫and that looks just fine.
‫And next up we want to do the same with editing.
‫Right?
‫So we already did that actually in the leading,
‫and so let's just copy what we have here to patch as well.
‫Give it a save, and now that actually looks perfect.
‫Okay?
‫So everything else,
‫even getting just one single tour here,
‫is of course free to everyone, okay?
‫And the same goes for getting the top tours,
‫and also getting the tour statistics.
‫Now here, about the get monthly plan,
‫well we also might want to restrict that.
‫Only, for example, to everyone except normal users.
‫Okay?
‫So that's copy this one here as well,
‫give it a save, and then also add the normal guides.
‫Alright?
‫And so, that looks perfect at this point, I think.
‫Okay?
‫So basically, our tour router is now completed.
‫Perfect.
‫And I'm not going to test all of this
‫because we already know that it works.
‫Alright?
‫So, let's close this one
‫and move straight to the next one.
‫So, these first routes here
‫are of course open to everyone.
‫So, signing up, logging in,
‫forget password, and reset password.
‫For none of these you need to be logged in.
‫Right?
‫But, you need to be logged in
‫so to be authenticated to update your password,
‫to get your own information,
‫to update or to delete your own account,
‫and really for all these other operations
‫here as well.
‫So we don't want the public to basically get information
‫about all the users.
‫We also don't want anyone to delete users,
‫or to update users, and really none of these
‫operations here should be free for the public.
‫Okay?
‫So for all of these routes here,
‫starting from this point,
‫you will always have to be authenticated.
‫Alright?
‫And so, we could now go ahead and add
‫this authcontroller.protect to all of these routes,
‫but actually we can do better than that, right?
‫So in order to do that,
‫let's keep in mind that this protect function here
‫is really just a middleware.
‫And also remember that middleware
‫runs always in sequence, right?
‫Now with this router that we have here,
‫that we created in the beginning,
‫is kind of like a mini application.
‫Remember that?
‫And so just like with the regular app
‫we can use middleware on this router as well.
‫Okay?
‫And so, we can do something like this.
‫Router.use,
‫and now authcontroller.protect,
‫and that's it.
‫And what this will do
‫is to basically protect all the routes
‫that come after this point.
‫Okay?
‫And again, that's because middleware
‫runs in sequence.
‫And so after these four middleware functions,
‫because remember that technically
‫this is still also middleware,
‫then the next middleware in the stack is this protect.
‫And this will then only call the next middleware
‫if the user is authenticated.
‫And the next middleware in this case is this patch here.
‫Okay?
‫And so, again, what this is means
‫is that all of this routes
‫to all these middlewares, technically,
‫that come after this one are now protected.
‫And so, we can go ahead and remove this protect
‫from all of them.
‫Okay?
‫And just to prove you that this now still works,
‫let's just go ahead and get the me information.
‫So basically the current user.
‫So if I now run this,
‫you'll see that it still works.
‫And if I take away the authentication,
‫then it says we are not logged in.
‫And so that's exactly what that protect middleware does.
‫Right?
‫So, it's now going to be back to working.
‫So, perfect!
‫That's a nice little trick in order to protect
‫all of the routes at the same time,
‫typically by using a middleware
‫that comes before all these other routes.
‫Okay?
‫And for example, if we now move this
‫a little bit up, like this for example,
‫then we would also need to be logged in
‫in order to use forgot password.
‫Right?
‫So, let me just prove that to you.
‫Okay?
‫And so usually, of course, we do not need to be logged in
‫in order to forget our password,
‫because that wouldn't make any sense, right?
‫But right now, since we move that middleware
‫a bit up, it says "you are not logged in".
‫Okay?
‫And so really, that proves that this authcontroller here
‫is doing it's job.
‫So, protect all routes --
‫after this middleware.
‫Okay.
‫Now also remember how we said that
‫all of these actions here should only be executed
‫by administrators,
‫and so now we can actually use the exact same technique
‫that we used up here to protect all of these routes.
‫So, router.use,
‫authcontroller.restrictto,
‫admin.
‫Okay?
‫And so now, only admins will be able to get all users,
‫to create new users, to get users again,
‫and to patch and delete users.
‫Alright?
‫And so from this point on,
‫all the routes are not only protected,
‫but also restricted only to the admin.
‫But of course, the ones that come before everyone
‫who is logged in can access them, okay?
‫So let me just prove that to you.
‫So, I'm going to log in, not with admin,
‫but with testuser.
‫Okay?
‫And so we got logged in successfully,
‫now let's try to see all the users.
‫And now it says you are not logged in.
‫Well, we are actually logged in,
‫but we forgot to add the authorization here.
‫So, bearer token, send it again,
‫and now we see you don't have permission to perform.
‫But now, when we change this to the administrator,
‫so we log in as an admin now,
‫and now as we get all the users,
‫then of course it works.
‫So, perfect!
‫And that actually finishes the authentication
‫and authorization for these users as well.
‫But just to reflect that in Postman,
‫let's actually go back and so basically
‫put the authorization here, everywhere.
‫Okay?
‫And again, that's because later on
‫we're gonna create an API documentation
‫based on the collection that we created here.
‫And then, it's important that we actually mark
‫this one here as protected.
‫Save it.
‫Save this one as well.
‫And the same for update and delete user.
‫So, bearer token, save,
‫and the same for update.
‫Alright, and actually since we're doing that,
‫let's do the same with all the others.
‫So, not the reviews,
‫that one is for a bit later,
‫but really for the tours.
‫So here we no longer need any authentication,
‫so let's save that.
‫Forgetting we also don't need any authorization,
‫but for creating we now need the bearer token.
‫Okay?
‫Also for updating, and so it makes sense
‫to protect them here in Postman as well.
‫Now this one already had it,
‫because we actually used this one to test it
‫in the first place.
‫So this one did not have it, but the get monthly plan,
‫we protected this one as well.
‫Add the bearer token here as well,
‫and so I believe with this
‫we are really completed now, with these, too.
‫And so what we need to do to finish now this part
‫is here, fix the same thing on the reviews as well.
‫And the first thing that I want to do
‫is to basically protect all of the routes
‫which have to do with reviews.
‫So, we want no one who is not authenticated
‫to get, or to post, or to change, or delete any reviews.
‫Okay?
‫We say router.use,
‫authentication controller.protect.
‫Okay?
‫And so that means that from this point
‫no one can access any of this route
‫without being authenticated.
‫But we can remove this part here, okay?
‫And so now with authentication out of the way,
‫let's think about authorization.
‫So, first of all, only users should
‫be able to post reviews.
‫No guides, and also no administrators.
‫And so this part, we actually already have that here.
‫Okay?
‫Then, admins should be able to update
‫or to delete reviews, just like regular users,
‫of course, so that they can then edit
‫or delete their own reviews.
‫And finally, guides can not add, edit, or delete reviews.
‫Since the guides are the ones who are performing the job,
‫so it would be weird if they could post reviews
‫themselves, or edit other peoples' reviews, right?
‫And so let's put what we just described into code.
‫So, basically patch and delete
‫are restricted
‫to users,
‫or actually just user, and admin.
‫And then the same thing for deleting.
‫Okay?
‫And so you see that now guides and lead guides
‫have nothing to do at all with reviews.
‫All they can do is to really get reviews,
‫but not changing or posting them at all, okay?
‫And so, quickly now in Postman,
‫let's put that here as well.
‫So create new reviews already has the authorization,
‫get all reviews also needs it now.
‫So, with the bearer token, save that,
‫here, the bearer token as well.
‫Now write, and also get one single review.
‫Actually let's nicely order this as well,
‫so that all of them are kind of in the same order.
‫And now about these two here, they actually
‫are also protected.
‫Right?
‫Because ultimately it's the review handlers
‫that are actually called for both of them.
‫And so here we also need to add that bearer token.
‫Okay?
‫So now, basically, the only way of getting access
‫to data about reviews is to call all of the tours.
‫Right?
‫At least for people that are not authenticated.
‫Okay?
‫So, let's close all of this,
‫and so I think we're now good to go,
‫and we actually finished this part as well.
‫Let's just clean it up here a little bit.
‫And yeah, I think that's it.
‫So with this we actually finished the authentication
‫and authorization parts of all our three resources,
‫so we're really close to finishing our API here.
‫There's only a small amount of things left to do,
‫and so we're going to do all of that
‫in the rest of this section.