Hey there, everyone that they share.
And in this video, as you can see, there is something new being introduced.
And we are going to have a discussion on this.
After this video, you will get much more clarity and you will have the sample code as well to understand
that how you can provide different kind of roles in an application.
Maybe you want to have admin roles, manager roles, sales roles, and you can have as many roles as
you wish.
There is no such criteria and we'll be writing a robust code for that.
So as you can see there, we have got slash admin slash users.
Obviously this is a route on which user can get all the list of the whatever the users are enrolled
on his website.
And similarly, we'll talk more about this later on.
Right now, this is the only goal that I want to have a special route slash admin slash users, which
gives me the detail of all of the users which are registered on my website.
Now the code part is really, really simple.
Couldn't be much more simpler than this.
Absolutely ridiculous simple.
So we'll be working on this inside the controller itself because there is no need of separate controller
for this one.
This is also playing around with the same model, so we'll be just working on that.
So I have just duplicated this and obviously I'll shrink the above one just like always and I'll work
on with this one.
Now this is going to be an admin route, so I usually recommend beginners whenever there is an admin
route or a manager route, just go ahead and right, start with the admin.
So what do you want to call this one as simply we're going to call this one as simply a route which
gives you all users.
So let's go ahead and say this one is admin all users.
Now usually you are going to find in the big organisation they don't write it like that that admin,
all users or manager, all user, they just write it as all user.
But for a beginner who is just getting started with a complex application, it will definitely help
you a lot if you just write it as admin all user.
And again, there is no such harm in writing in this way.
Even in the bigger organisation, it makes just more clarity that this controller was specifically being
made to be used by admin only.
But in case you are using for manager or anything, you'll know that which kind of a sensitive data
that it is exposing to everyone.
Now let's go ahead and clean up everything.
We don't want anything from inside.
We just need a boilerplate template here.
Okay, so once we have this, the goal is really simple.
I want to send all the data.
So all I have to go is user dot and I have to say just defined now in the find, if you don't pass on
any parameter, you pass it like this or you just say empty.
Which also means by the way, this, that means it will just look for everybody and we'll find everybody.
So let's go ahead and hold this one.
So we're going to call this one as users.
It is really important.
And since database is always on another continent, we're going to go ahead and evade this one.
So this users is an array of all the values that it was able to find inside this user model.
And then all we got to do is simply say red dot status.
And we have to say this time the status is good.
So 200 dot JSON and send an object of success is true and let's go ahead and send all of these users.
So there we go.
Told you it's really possibly the simplest of the case that you can design and write that.
Now let's go ahead and work on with the Roots.
So what we're going to do is we are going to go ahead and set up these admin routes.
I'll hit an enter here because these are our routes which are a little bit different from all the above
routes.
So how the route actually looks like, we already discussed that.
It says slash admin slash users.
So this is how you get that.
Obviously user is also logged in.
That is also great, but we don't want anybody to access that.
We want only specific user to access that.
So let's first save this and see whether this is working or not.
Of course, my bad.
I forgot that I need to import all that.
Many users go into the route at the very top.
Bring it up here again.
This is just the ordinary method.
Nothing special on this one.
Let's go ahead and save this one and see if we are able to grab this admin route up here.
So copy that and go up here and let's make a clone on this one or copy this one.
So we're going to go ahead and say this is admin, so we're going to say all user.
So save that.
And this one should be this one is actually a regular get route.
We don't send anything.
So we're going to say this is a get route and let's change this one to get save this one, change this
one to slash admin slash users.
I'm logged in, so I'm sending this one and I'm receiving an array of all the users who are registered
in my application.
But I don't want this case to happen.
I want only certain users to actually be able to grab this data.
So what I'll do in the very first time, actually there is no way of creating an admin.
You have to manually go head into the database and mark at least somebody, one guy to be admin as well.
So what we're going to do is we are going to have this three as an admin.
So notice right now I'll go into the role itself and I'll go ahead and change his role instead of saying
it user I'm going to go ahead and say that you are an admin now.
So again, admin.
There we go.
Okay.
So now I have manually verified.
I'll refresh this one.
So the tree is still.
User.
So let me go ahead and change that again.
Probably I forgot to save, so I'll go ahead and change this one again one more time to admin and I'll
update this one.
Forgot to update last time.
Refresh this one.
Okay.
So this is something which is specifically just for the admin.
Now how can I figure out that whether the user is admin or a regular user?
Of course I have a token which gives me the ID and through that ID I can extract the user and I can
ask What role do you have in the database itself?
So if I go ahead and say, Hey, whatever the user via the ID, I get that and I simply say user role.
It will give me either the admin or the user.
That is absolutely fine.
Now what I can do now further on this, that I have to check this one and have to design a kind of a
middleware which in betweens previously we were injecting the information in the logged in that you
are logged in.
I'm checking that and I'm also injecting some information this time I'll just verify from the database
itself that who you are.
Are you an admin, a manager or a role itself?
So how we're going to do that?
We're going to go up here and we need to design the method.
So we're going to go ahead and check this one, something like this, something like custom role, and
we can actually design it.
Something like is logged in.
We can actually go ahead and say something like is admin?
That is also absolutely fine.
There is no wrong, nothing harm in that case.
But what we can do is we can actually design a method, something like this custom role, and from this
we can actually pass on an information, something like admin.
This will help us to write just a one middleware and from the route itself we can pass on the information,
hey, this custom role or this route is for admin only, or this root is for manager only.
So this actually makes the code a little bit more robust.
Again, if you want to be just going with the is logged in way out 100% doable.
You can do this, but I prefer this one which says custom role and manager like this.
So let's go ahead and work on with that.
So I'll go into my middleware.
And inside this middleware, I will export a method which says custom roles.
So I'm going to go ahead and say export dot custom role and inside the custom role or roles however
you like to go work with that.
I'll go like this.
Come on.
There we go.
And there we go.
Now, in this custom role, since we are passing on a value a manager, this can you can treat this
as a simple string that is 100% valid or you can treat this entity as an array as well.
The beauty about treating this as an idea or converting this entire method as accepting array is that
you can use some of the inbuilt method of the array and you can get away easily with that.
It these areas have method as something like dot includes or something and if we don't have to manually
check all these things, converting everything into lowercase, take care of the things, there is a
lot more problem in the string itself so we can just get away with that and all we got to do in order
to make sure that this is an array we can actually market as an array like this.
Or what you can do is you can just spread this one and say that, Hey, you are sending me a roll,
that's it.
And rather it would be better if we call this one as roles because we are expecting an array.
Although technically this is not area, we are just getting away.
This area will have just one value itself, which is the admin itself.
Because you are passing me here, just the admin and we are doing all this to get away with the easier
way.
Again, I'm not doing it.
This is kind of industry practice all around and that's why you are going to see this code throughout
your organization as well.
Again, just the easy way of doing this.
So what we're going to do is we are going to go ahead and simply return it to and false value to move
forward and all of that.
So let's go ahead and do with that.
I will say simply return.
There we go.
Now, in the return, I will have obviously the request.
And again, are we wrapping it around with the big promise?
Oh, my bad.
I'm no, no, it's okay.
I'm writing into the user middleware, so that is fine.
I don't need to wrap around with the big promise in this case, although if I do that, that would be
great.
Let me quickly check that previously we were having the token and so many of the issues.
That is also fine, but I don't think so.
In this case we need it anyways.
Request response.
It will face some errors.
I'll come back and update that one.
Okay.
So what I'll do, I'll simply go ahead and check this one.
So I'm going to go ahead and simply put on if condition that if there is an inside this rolls that I'm
going to go ahead and say includes because this is an array now that's why I have spread it at the top
and I'll I'll request that because obviously I expect that you never use this custom role all alone.
I expect that you use it after is logged in because I will be extracting some information from you.
Request dot user.
So I'll say request dot user dot role in this case.
So user has this role as well.
So what I'm checking is whatever the role you are sending me from that root, whether this admin or
manager does it, is included as this one.
So this will give me a simple.
So basically what will happen.
Let me just write it quickly up here so that you understand this part because this can be a little bit
tricky.
I want everybody to understand this one.
So what this will do, this request, dot user, dot role, you will either get a user here or you will
get a simple admin here.
And what this roles DOT includes will will check that whether who you are actually what you are saying.
So in this case I'll pass on a manager or admin and it will work like that.
So I hope you get it a little bit.
I hope so.
Okay.
So this is the basics of it and I want to check for a negative of that because this is where I'm going
to raise an exception or raise an error.
So I'm going to go ahead and simply say in this case, let's go ahead and just close it up here.
So we're going to go ahead and say return, wrap it around in the next.
Let's raise a new custom error, custom error, and it will say that you are not allowed for this resource
and we can optionally pass on an error as well.
Let's go for four or three or four or two in this case.
Okay.
So if that is not the case, then only then you can simply go ahead and say, hey, you are all good
and you can just go ahead and move on to the next.
There we go.
Okay.
So I hope this is all clear.
And by the way, in case you want to go with the classic way of checking is admin only.
And if the role actually exists, if simply the request or role request or user role equal equal admin,
just go ahead and simply next.
Otherwise raise an error that is also fine.
So let me just go ahead and write that case also for you.
So in case you are looking for that.
So in that case, we are going to go ahead and wrap around the big promise and we are going to check
something like this will be going something like if request dot user, dot role, if that is equal to
something like admin, then go ahead and fire up next and something like that.
So in case you want to go that path, that is also great.
But I told you this is a little bit of a pro course, so we're going to go for a little bit more of
a robust approach.
So the whole idea is now to send a role that is manager or an admin, and then it will check that whether
you are actually the guy who you are saying.
So if you are saying that I'm admin.
So I should receive in the roles parameter as yes, I'm an admin because remember I'm spreading this
so automatically this admin will go inside this roles array.
I hope I am now able to explain this more clearly.
Okay, so this is all good.
Now let's go ahead and bring this custom role and let's go up here.
And after the is logged in, let's go ahead and bring custom role.
So now custom role is in.
Now let's first go ahead and try to access this resource that this resource is only available to manager.
We don't have any manager but want to check out these things that what happens inside the postman.
Let's go ahead and send a request and it says error.
You are not allowed for this resource.
Absolutely.
Fantastic.
So now let's see that.
What user did we updated?
So we updated the three as admin.
So let's go ahead and check whether three is able to access that or not.
Or by the way, we can actually change the role of this to as well.
Let's go ahead and change this one.
So let me go ahead and make him a manager this time.
So this one is manager.
And let's go ahead and update.
Let's see if the manager is actually able to access the data or not.
So let's refresh this and let's try it one more time and send this one.
And now we are accessing the data.
So you see how easy it is for me to now have a role of manager.
But I'm not interested in manager, I'm actually interested in admin.
So let's see whether the admin is actually able to access this or not.
So let's change this one that.
Now your custom role to access this route should be admin.
So let's go ahead and verify that and it says, hey, you are not you are not an admin, so you are
not allowed to access this resource.
I hope now you get the robustness of this code.
Let's go ahead and change this to into not the manager but actually an admin.
Admin.
And let's go ahead and update this one.
Hit a quick refresh and the postman and send this data.
And now we are receiving all the data.
So this is how you actually make anyone as a customer admin manager sales.
Again, the whole idea is that whatever the controller is doing, you should be focused more on that.
Right now I'm calling it as admin all user and I'm sending all data.
Maybe in your case the manager is there and only value that you want to give to the manager.
Or maybe a sales manager is just the name and the phone number.
Maybe you're accepting phone number as well.
So go ahead and just create a simple controller which gives the user only name and the phone number
and just all the fields are marked as undefined so he doesn't get the data.
So you can quickly craft a kind of a route for that that let's go ahead and catch up in the next video.