Hated everyone that they shared.
And in this video, we're going to work on the password reset.
So so far, our user journey is that he has requested for forgot password.
We have sent him instructions on the email.
Now he is able to click not in theory, not able to click on the link, but actually able to copy and
paste that link.
But nothing happens so far.
So we need to create a route exactly according how we created that URL.
So in the URL we say that we will be sending you things onto localhost, whatever, slash password,
slash, reset, slash token.
So we need to grab the token from exactly this place.
And by the way, I have added comments here, so I hope you can appreciate that and send me an instant.
Hello there.
I have added exact meaningful comment so that it's easier for you to follow through later on.
Okay, so this is all good.
Let's go ahead and kind of let's copy this actually.
We'll be just deleting everything inside it, but I'd love to copy and paste these methods.
Saves me just a second.
So forgot password is there.
Now we have to simply say this is forgot password reset or let's call this one as simply password reset,
whatever, whatever makes sense to you.
Just the method name.
Nothing of a big deal.
Let me go ahead and remove all of these details inside it.
We won't be needing any of that.
Okay, so what is the step one?
Obviously to grab the token.
So how are we going to grab the token?
Let's go ahead and call this one as simply token and the token will be coming from request dot params
dot token.
Okay.
So we have grabbed the token.
Now most important thing is in case you remember what we have grabbed from the token inside this user
model, user model, there we go.
The token that we are grabbing is the token which is not encrypted.
We want to actually encrypt this token on our own.
So for this one, we are going to go ahead and copy this exact all of these things and let's go ahead
and try to encrypt again on our back end.
So I'll go back into the user controller.
Now, this is kind of a regular token.
We want to grab an encrypted token, so we're going to go ahead and say increase and create token,
encrypted token basically, and we're going to go ahead and use the crypto library.
We obviously need to require that at the top.
So let's go ahead and first bring that in.
So we're going to go ahead and say crypto that is going to come up from require.
And let's go ahead and say, hey, we need crypto, okay, now that crypto is here, we can go ahead
and say, hey, this encrypted token, you are going to go ahead and say, hey, crypto dot create hash
use the same algorithm SHA 256 or 256 in case you are worried.
And let's pass on the same token that we grabbed from the URL itself and we're going to create a digest
hex of it.
So exactly.
So in theory, if we are actually using the same method and we are sending this on to the front end,
we should receive this exact same on the back end.
Okay, moving forward that assume that everything is all great.
Now let's go ahead and try to find a user based on this encryption token.
Again, we don't know which user to reset the password.
This is the only way how we can find that.
Again, this is a very unique field in the database.
It is almost like an email.
So just like we were able to find one through the email, we will be able to find a user based on the
encryption token.
So let's go ahead and use the same thing.
So we're going to say, hey user, let's go ahead and simply find one.
And previously we were saying, hey, go ahead and find the user based on email.
Now we'll be able to say, Hey, go ahead and find the user based on this increase token.
Okay, now this is the encryption token that user will be having this one.
But again, there is one more thing we need to worry about because we want to find a user based on this
encryption token.
But in case you remember, we only want to find the user whose this forgot password expiry is in the
future.
If anybody in the past is there, we really don't care about that.
So how we can go ahead and work on with that, we have to provide one more field here that find based
on this encryption token.
Let me go ahead and move on to the next line and we can actually move this one also on the next line.
Make sense.
Okay.
Now let's go ahead and copy another field from the database that I want to find.
We're passing two properties here and they work like both should be true in the basic mongoose.
So this field is also there.
And for this field, I'm going to pass on a property.
This is a classic MongoDB query.
I will simply say, hey, a dollar get this means greater than if the time is greater than.
So I'm going to go ahead and say date dot now.
There we go.
So what will happen?
It will try to look for both of these parameters, which are accurate.
So either the encryption token should be there in the user and further down the road it will say that,
hey, your time should be greater than time now if your time is in the past itself, because remember
we are setting this password time as well and at the time is 20 minutes above, then the password.
Six five.
So pretty simple logic.
Pretty simple logic.
Okay, let's go ahead and hold this user.
So let's go ahead and call this one as simply user.
Since database is on another continent, we go ahead and save this one.
Now, importantly, if we don't find the user, let's go ahead and work on with that first.
So we're going to go ahead and say, if I don't find the user, I will obviously throw you an error.
Let's go ahead and wrap it up in the next new.
Let's go ahead and use the custom error command, custom error.
And we're going to say simply that now token is invalid or expired.
So either one of the case is there that token is invalid or is expired.
So these are the two cases.
But again, based on that, that now if we have the user, if we have passed through this conditional
check, that means user is there.
Now we want to go ahead and reset the user's password.
So what we're expecting now that if we have reached to this point, that user is sending me the password
as well.
Now it's up to you and your frontend guys or the designers that at this point you are providing what
kind of feels to the user to see.
Usually it is password and confirm password and submit that.
So on the front end itself you can check whether the both the fields are kind of a same or not, but
we can go ahead and use that as well.
So let's go ahead and say that if let's go ahead and use that, we can hold them into a variable as
well.
But we're going to just go over directly like that.
So we're going to go ahead and say request body dot password, you'll be sending me to fields is not
equals to request dot body dot conf password.
So go ahead and send me two passwords or we can say that confirm not to be too lazy writing the entire
thing password.
So if both of them are equal again, I have to send both these fields in the post one as well.
If they are not equal, we're going to go ahead and return this response.
So copy this, paste it up here and simply change the message.
Again, we can pass on the message code here as well.
I need to work on why the code is not actually transferring.
I'll check that soon and we can say that the password.
Password and confirm password.
Do not match.
Match.
There we go.
Assuming that we have also passed on with this check, that means the fields are also correct.
Again, this was kind of a necessary check.
You can just send one field only.
That would be also fine.
In this case I'll select user password.
Remember user has this password field that will be filled by request dot body.
I could have saved that into a variable that would be better.
Now we are actually filling that field with the password.
The most important thing.
Yes, we are going to go ahead and save this one.
So we're going to go ahead and say, hey, a user dot save.
In this case, we can save it.
We don't need to say that.
Hey, don't check anything because things are all fine in this case because user is already registered.
We are just resetting or kind of updating one field here.
Now, one more interesting thing is if the user is all saved, then the most important thing is, which
a lot of people forget, is you haven't actually reset these two fields.
There is already a data in this.
This should be now undefined.
So let's go ahead and copy these fields and make them undefined.
So we're going to come here and we're going to say user dot and we're going to duplicate this one and
take another field which is expiry.
Copy that.
And there we go.
So these all both are going to go ahead and let me go ahead and and we're going to go ahead and say,
hey, both of these are undefined.
So there we go.
Save that, and now we can go ahead and save this one.
Now, since we have saved this, there are a couple of options in front of you.
You can go ahead and say that, hey, now these are all updated.
You can actually go ahead and log in into that.
Or once the user is actually set these password and successfully verified everything, you can send
him the token.
So it is totally your option.
So send a JSON response or send a token.
You are totally, totally capable of doing both of them.
I'm going to go ahead and just simply send him the tokens and all the details.
So let's go ahead and see that how we are doing it in the login.
And we are saying that cookie tokens, so copy that and come back here and just paste that.
Now in theory, if we actually grab this email and this link, we should be able to successfully do
that.
But the problem is we haven't said the link properly yet, so we're going to go ahead and make this
link properly.
So this is going to be a slash password slash reset, and then the tokens are copying it from here.
And going into the roots.
Let's go ahead and have this one since this will be sending some data.
This needs to be a post route and the route is going to be slash two slashes, slash password, slash
reset.
And then we're going to say colon and make sure you call it as 100% token because that's we are extracting
from the URL, but the method is not yet being exported.
So let's go ahead and say that forgot token.
No, this is not method name not even forgot password.
Password reset.
Copy that.
And this needs to come up.
So there we go.
Password reset and this is lot will be handled by password reset.
So hopefully in theory now we are capable of changing the password for a user.
Let's go ahead and verify that it's not yet been 30 minutes.
I'm back to back recording these videos so I can go back onto this one and let's go ahead and try to
copy this.
And go back to our postmen.
Get another route up here.
So let's go ahead and create a save as.
And this one is going to be reset password.
Password just like that.
This one is obviously going to be a post route and this allow doesn't look like this.
I need to grab I can actually grab the entire email itself so I can go ahead and say, hey, I want
to send the email onto this entire route.
This is what we are getting from the back end.
And not only this route slash password slash reset.
So we'll grab the token from here in the body.
We need to send the password and confirm password.
So password and we need to set.
I'll just copy the things from the back end because I know I might make a mistake.
So what?
We are checking it for the confirm password.
So copy that.
Bring it up here.
And the confirmed password both needs to be equal.
So we're going to go ahead and work on with that.
Let's go ahead and set another password.
So this time, password is changing to one, one, two, two, three, three.
And this also needs to be changed as one, one, two, two, three, three.
So let's go ahead and moment of the truth.
Let's go ahead and see if it is working or not.
So sending that it says error cannot post.
Password reset and all of that.
So it looks like we are not accepting the post request.
Let's go ahead and see and we are accepting password reset.
Did I saved it?
Oh, my bad.
Just realize that we cannot actually go ahead and craft it like this.
We need to use API slash V1 there.
So if we need to change this one because this is actually a slash API slash v1.
So we need to change the route a little bit.
But this is exactly the route where we need to send that little bit tricky of a bug, but let's go ahead
and try to see that and we can just add these two lines in the sending the email.
So let's go ahead and send this one and say says token invalid or expired.
So token has expired on our case.
No big deal.
Let's go ahead and send another forgot password token on to this one, which is two.
Let's go ahead and send this one.
Hopefully we'll receive another email.
So seems like it's over 30 minutes now.
You realize how much it takes to send to create the videos.
Okay, another one.
Let's go ahead.
And this time, different token came in and again, we need to fix this.
You are all part because this is API slash V1.
This is where we need to go and let's go into the reset password, paste that and this time we need
to go ahead and say this is slash API, slash V one slash password reset and the token and then we are
sending the password and confirmed password.
So send that and notice.
Well we are now grabbing the user and token and everything.
This means the password has successfully being changed for the to at the rate ae.
Let's try to log in and verify that that inside the login we have this raw data or we're not sending
any raw data into the login.
Very strange.
Let's go ahead and say that we are sending the email.
The email is going to be to add the rate ae dot dev and let's go ahead and add a password.
And the password is going to be one, one, two, two, three, three.
Let's first try the old password.
One, two, three, four, five, six and send that.
And obviously it doesn't match.
Fantastic.
This is exactly what we want.
Let's try one, one, two, two, three, three.
Send that and voila, we are actually logging in.
So that's great.
The only thing is we have to craft our URL very, very carefully.
Otherwise user may find it a little bit confusing.
Let's go ahead and check the user controller and craft the email better.
So this is the request host then we are having slash.
We are we need to come here slash API slash v one slash password.
So this is the exact root that should be there.
No big deal, no need to test that again because we obviously know that just changing the URL is not
going to bother us too much.
But in the ideal case, I would love to check that again.
Okay, so now let's see where we are.
So we have sign up login logout, forgot password password reset token as well.
Now we need to work on a user and when the user update password.
Now this update password we have worked on when the user has no idea that how to actually login into
that.
If a user is already logged in, that is actually a simpler update, just a regular update and user
might want to update his email or something else that we also need to take care.
Let's go ahead and catch up in the next video.