Hey, did everyone.
They sure.
And welcome to the new section.
I know this is a really, really long series, but now from here onwards, the things are going to be
really smooth because we have learned majorly whatever we wanted to learn, now it's all about.
Surely it's a really long one, but not complicated.
So a lot of work is going to go there, but not complicated.
So let's go ahead and work on with the login route, log out route and remaining whatever the routes
we have because we have a lot more than what you can see on the screen.
I'll discuss more later on.
So first, let's work on the login route and it's a fairly, fairly the easy one.
The first thing we do is always we usually like to copy and paste the above method, but in this case,
just for once, I will go ahead and export this one manually.
So I'm going to go ahead and call this one as simply login.
Again, we are going to wrap everything around with the big promise.
So there we go.
And inside this shortly we be talking with the database.
So we're going to go ahead and go with the sync route and with the sync.
We're going to go ahead and say, hey, I have a request response and a next just like that.
There we go.
Now, how do you think the login should work now?
Go ahead and pay a small attention on pen and paper.
The idea is really simple.
Somebody will be sending you name and email.
You have to receive that in the request.
These are compulsory.
You have to have email and password at least or maybe more fields.
Then you have to first check whether this user exists in the database or not.
If it doesn't exist, provide an error really simple.
After that match, it's password that he's entering.
Whatever he's entering, the password is correct or not.
And once all of these checks are done, then go ahead and provide him the token and that's it.
That's the login that we have to do.
So really simple.
So let's go ahead and first extract email and password.
So let's go ahead and say, hey, password.
Now this will be coming up from request body shouldn't be a big deal.
We have done so much of the talk on this one.
Now, once this is all done, I will first check whether email and password is present.
So check for presence of presence of email and password.
So we're going to go ahead and put up a simple if statement up here.
So there we go.
We're going to say if email is not there or if password is not there, come on.
No suggestion.
There we go.
So if email is not there or password is not there, we're going to go ahead and simply return the method
just right here.
So let's go ahead and wrap it around with the next.
Let's use the new and our custom error and feel free to use the regular error handler as well.
I'm going to go ahead and simply say, please provide email and password and let's go ahead and give
it a 400 as an error.
So first check is all done that we have checked whether the email and password both are present or not.
Now let's go ahead and assume that user has provided us the email.
So based on this email, let's find a user in the database.
So how we can do that, we're going to simply go ahead and say user and it has a lot of options to find.
There is a find, one find by ID and a whole lot of others we're going to use find one in this case.
Now in the find one method, you can just pass on an object.
And based on this, whatever the parameter you are looking for, in this case it is email, but it can
be ID, email, maybe role based on whatever filter you want to have that find, one is going to just
find the first one which it finds at the very top.
So that's basically it.
Okay.
Now also on top of that, we have to mention a11 more keyword which is select.
Now why we are going to use this select and let me first write that.
Just go ahead and add a plus.
Yes.
Plus is important here and make sure you write password.
The reason for writing this is because when we were writing the models of the user, we told that this
password field is select false.
So that means by default, whenever it is going to come, it is going to come without the password.
And eventually we need to compare the password as well that the whether the password is correct or not.
So that's why we have to write this one.
Let's hold this into a variable.
So let's go ahead and call this one as simply user.
Since database is always on another continent, let's go ahead and use a eight.
Pretty simple.
There we go.
Now there are chances that there might be no user while retrieving from the database itself.
So in this case, we're going to go ahead and copy this line and paste it up here.
And this time we're going to say if there is no user, so if user is not there, then we have to provide
a message that you are not registered in our database or website, however you want to craft this message
totally unto you.
Okay.
So this is the case where probably the user is not in the database, assuming we have moved forward,
that means user is there.
Now, the next step is to obviously confirm whether the password user has given to us is correct or
not.
Again, for this, we can go on to this model user and we have got a method already written for us which
gives us exactly same thing which is is validated password really.
Really obnoxious name, but this is what it is doing.
So it gives us a true and false value.
So let's go ahead and use that.
So we're going to go ahead and use that is password, correct?
So that that is going to be answered by that method.
So let's go ahead and call this one.
So we're going to go ahead and use the user notice.
This time I'm using the smaller one because I'm not looking into the database.
I've already received it from the database.
Now all these methods that you want to run is run on these objects.
So user dot what did we call this one is validated password.
So let's go ahead and paste that.
So is validated password just requires a password that user has entered.
So that is it password.
So again, reminding you again it takes the user send password and give us whether the password is correct
or not.
Again, since this is this may take some time.
So let's go ahead and use an update on this one.
So this is all good.
Now, based on if the password matches perfectly or not, let's go ahead and work on with that.
So again, we are going to go ahead and copy that.
Now, if the password matches correctly, then obviously we are going to get it true.
But what we are looking for is a false because in the false if password doesn't match, then we can
give a kind of a message to the user and what we can do is kind of give a better message that if user
is not present or the password doesn't match, we can give kind of a message.
Instead of allowing the user giving him a hint for boot forcing on the website, we can give that email
or password does not match or exist.
So yeah, I know this is not really one of the best message, but actually we are going to be using
this one only.
Feel free to use or change this message up here, assuming that everything is done correctly and we
have now these passwords and everything correct.
Now, after at this point, we have checked everything.
Now we are completely ready that everything is fine.
Now we can send it token to the user itself.
So in order to send the token, we need to take a help of the method which we designed above in the
previous section.
So we're going to be copying exactly this.
We can actually copy this exact line and can paste it at the bottom here.
So there we go.
Okay.
So this is all good.
Let me go ahead and put up some of the comments so that it's easier for you to understand what is happening.
This is checking for the presence of email and password.
And then here we're going to be saying get user from a DB and this one is checking if user not found
in in DB.
And then here we are saying match the password and here we are saying that at the top of this one we
are saying if password do not match and here we are just sending the cookie token.
So if all goes good and we send the token, there we go.
I told you, it's really simple from now onwards.
So there we go.
We have got this method now.
Only thing that's remaining is to use this method.
So let's go up into the roots.
We can actually close this user, which is the models.
One, we need to go into the roots user dot charges and let's go ahead and import the login.
So we're going to go ahead and say bring login and let's go ahead and add another root here.
This root is going to be simply login and it is also a post method and I have to say login.
Now notice here one thing that I don't have to worry that how am I writing these methods?
It can be a get method, post match or whatever it is, and I can control everything from just one place.
Let's go ahead and try to login into a user and see if we are able to successfully log in or not.
Let's go up here.
So we have created this three user.
Let's go ahead and create another root here.
So we're going to go ahead and say that, hey, let's save this one as another one, which is log in.
This is going to t shirt store user and let's go ahead and log in.
So this is also a post request and we will be sending into the body itself.
But this time it's going to be a simple you can send it into form data as well since it's a form request,
but I would rather like to send it into a JSON request.
The root is going to change to login.
I'm going to save this one.
So this is a login route.
Let's go ahead and say that I'm going to pass on an email.
And this email is going to be three at the rate AE or let's go ahead and log in with the two actually,
because the cookies right now are actually sending us all the data from the tree itself.
So let's go ahead and try with the two.
So to add ae dev and then a comma and this one is going to be password.
There we go.
And one, two, three, four, five.
And let's go ahead and trust out only with the five that whether we are actually getting some errors
or not send that and it says error, email or password does not match or exist.
So a really vague error.
But this is what we got.
What happens when I don't send any email value up here?
So let's go ahead and try to kind of cut this out and send it and still please provide email and password.
So fantastic there and let's go ahead and send the correct password, which is six and go ahead and
send this one so everything goes correctly.
Then we get a success through token we are receiving there and we are also receiving all the user values
and everything.
And notice password is still not coming in.
That is absolutely fantastic and this is exactly what we want.
We can also see that the cookie has been updated and now we have a cookie going on all so this is all
good.
Told you, it's really simple.
In the next video we're going to go ahead and work on with the log out root.