Hey, did everyone they share?
And in this video and some of the other videos that we'll be doing, just the two main routes for the
user itself are remaining.
The first one is password update and the second one is slash user slash update.
Or we're going to call this one slash user dashboard slash update to keep it consistent.
Just like there, let me just go ahead and add this one.
So this one is going to be saying slash user dash board.
And inside the user dashboard, he will have the slash update to have the update.
Sounds good.
Okay.
So why first and foremost, why we are having two of these two routes?
The reason for them is because they are going to be working to a different lane.
When we want to just update the password itself, then the user at this time should be aware of their
previous password.
So they will send me the previous or the old password and then also they will send me either the password
itself, the new password, and probably in some cases new password and confirm new password.
We won't be going with the three fields, we'll be going with just the two fields because we have already
seen in the past that how we can check the password and confirm password.
So we won't be repeating that.
So when we actually update the password itself, all we got to do is bring up the user check and verify
whether the previous password matches or not.
If it matches, just update one field and that's it.
That's all what we do and save the user itself.
Now in the case of when we are updating the entirety of the user, his name, email, maybe photo as
well, then there's a collection of information.
So we don't want to just manually go and add these fields into the user itself.
Rather, we would prefer to use a mongoose method which is find by ID and update, which takes the entire
object and just updates all of the information.
But again, can we do that by injecting one information at the time and saving the user?
And then of course, 100% we can do that.
So in this video, let's focus on the root, which is password slash update.
And by the way, I wanted to give you a small update that, yes, whenever I'm getting some time in
recording and editing these videos, I'm actually updating this swagger UI as well.
So it's much more easier for all of you.
So I have added the dummy out a whole lot of user roots as well.
So I have got this signup login log out, forgot password slash password, slash research slash token
user dashboard.
So all these are perfectly good and they are working as well, at least as of now.
And again, these are not really compulsory to have at it, but I thought, hey, let's go ahead, I'm
having some free time, so let's go ahead and update that so further down the road.
Let's go ahead and bring up this one up here.
So let's copy and paste this one and minimize this one.
And let's go ahead and get a new controller for ourself, of course, in the user controller.
So this one is going to be this time we are changing the password.
So let's go ahead and say change password.
Now, previously we were resetting the password.
This time it is a change password.
Reset the password when you don't know the old password, change password when you know the old password.
So you need to send this data to me in the back end.
Let's go ahead.
And by the way, also have added all these comments almost everywhere so that it's easier for you to
understand, although the code is very fairly self understandable, but still have added these comments.
So first and foremost, what we want to do is get the ID.
So we're going to go ahead and call this one as simply user ID.
Let me hold that into available.
So const user ID that will be coming from request dot user ID Y request, not user ID, because this
root will be accessible only when you are logged in.
If you are logged in, my middleware should be running and it should inject a new property which is
user, dot request, dot user and I'm extracting the ID from there.
Let's go ahead and find a user based on this one.
So we're going to go ahead and say, hey, user, just go ahead and find me a user by the ID and here
we're going to go ahead and pass on not like that, like this.
And I'm going to go ahead and say, Hey, just find me a user with the user.
ID also make sure you go ahead and simply say select because without selecting the password we'll not
get auto selected.
So we're going to say just plus password.
Okay, let's hold this into available.
So we're going to call this one as simply user.
And since database is always on another continent, we're going to go ahead and await that.
Okay.
Now let's go ahead and check whether the password or the old password matches or not.
So user will be sending me to properties at least the old password and the new password.
You might also want to have a new confirm password.
In that case, you have to check both the fields are equal.
You know what I'm trying to say?
We will just accept two fields, old password and new password.
Now, for the old password, I can go ahead and use Mongoose the model of it and I can simply go ahead
and say is validated.
Password.
This will help me to say that whether the password you are sending me matches or not.
So let's go ahead and do that.
So we're going to go ahead and say is correct.
Hold password.
I know this is too long, but I'm running out of the name.
So if that is true and we will get the result of it by first calling the.
User.
Remember the small case user.
It has this method which is is validate password, which requires you to pass on the old password.
So we're going to say request dot body dot old password.
So whatever the old password you are sending me, you can just go ahead and just pass it on that.
Now, based on this, it will either give me a true result or a false result.
Let's just say password doesn't match.
In that case, I'm going to go ahead and say if is a correct, I can actually copy this.
Actually, I should be lowering this down.
So this is usually what I prefer.
So I'm going to go ahead and copy this and we'll change this one here.
So if this is false, that means you haven't supplied me a correct password.
So I'm going to go ahead and say return.
Let's go ahead and wrap it up in the next new.
And we'll be saying simply error, custom error, actually.
Custom error and will be sending up simply that, hey, old password is incorrect and we're going to
go ahead and pass on an error as well, which is going to be 400 OC.
So it looks nice at least as of now.
Okay.
What about if the old password is correct?
In that case, I want to simply go ahead and update it with whatever the new password you are sending
me.
So I'll select user password.
Of course it has a field of password that will be updated by whatever you are sending me in the body,
which is going to be, you can call it as new password, or you can simply go ahead and call this one
as password, whatever you are sending me from the body.
This information, of course, needs to be conveyed to the front end user as well.
Then we're going to go ahead and simply say user, dot, save.
And since database is always on another continent, we are going to go ahead and say, hey, wait,
wait, that thing, once this is all done, we can go ahead.
And since this information has been changed, it is kind of unnecessary that you simply go ahead and
update the token.
So in that case, we are going to go ahead and call this method cookie token, which is going to update
that it requires a user to be passed on so that ID can be extracted from it.
And it also needs a response so that it can send a response on its own and update the cookie.
So that's it.
That's pretty much it, I guess, and it will be able to send all of that.
So this is all what we have to do in change password.
We need to check this one as well that are we able to properly use that.
So let's go ahead and verify that on to the Post man.
So it's been a while.
Let's go ahead and try to log in and let's go ahead and change this up.
Of course, we haven't actually created any route for this one.
So let's go ahead, copy, change password.
Let's go into the roots and let's bring in the route change password.
And there we go.
The route is going to be what is the route?
Let's go ahead and check this one here.
And this is slash password, slash update.
So we're going to go ahead and say slash password, slash update.
And of course, it needs to be logged in.
This one is going to be post because you are sending me the information and the method that's going
to run is the change password.
So now anybody who visits this slash password slash update should be able to send me the old password
and a new password, of course, after logging in.
So let's go ahead and log in.
So we're going to say that we want to change now this one, one, 2 to 3, three, two, back, one,
two, three, four, five, six.
Let's go ahead and send this one.
So hopefully this has updated the cookie.
And by the way, this updates the cookie everywhere.
So wherever you are going to see these cookies, they are actually updated.
I don't know why this is not reflecting it, but if you're going to try to access the user dashboard,
notice here the cookies are there and you are able to receive the data itself.
So let me in the body you are receiving the data.
So these cookies are updates in the entirety of the environment.
Let me go ahead and have another save as and this is going to be password update.
See that.
And this one is going to be a post route.
And the route is going to be.
Now it is going to be slash password, slash update.
Copy that.
Move back.
Remove this.
And it looks like we have two slashes.
It's so tiny, sometimes it's difficult to see.
So slash, slash password, slash update.
And what we should be getting up here, we are already having this cookie, so we don't need to worry
on that part in the body itself.
I need to pass on two values.
So this one is going to be old password.
And did I capitalize it while writing the controller?
These are the important thing that needs to be conveyed there.
So I'm saying old.
Where is the old password, request or old password?
So P is capitalized here.
This is very important in this case.
So if you are saying old password and this one is just password, so old password, let's go ahead and
change this one.
So one, one, two, two, three, three.
And this needs to be changed now to one, two, three, four, five, six.
So, moment of truth.
Let's go ahead and hit that send and we should receive something in the body.
So we have received the token.
That means our token is not only updated or password is also changed.
So this is something really awesome.
Notice here all the requests are coming in as a get post and whatever.
So this seems to be working fine.
Surely there could be a more thorough testing on that, but we'll just call it a day just right here.
Now, in the next video, we are going to work on updating the user information.
Let's go ahead and catch up in the next one.