Hey, did everyone share?
And in this video we're going to work through with the user.
Now, what is this user route and what its goal?
The goal is really simple.
Anybody visits like something user dashboard or a user itself or slash me or something.
There are lots of names for that, or maybe slash profile or something.
The idea is user needs to able to get all the information that he has submitted to the application,
his name, email, probably encrypted password, not usually.
So name, email, photo, country, whatever you have asked to him, he should be able to grab all these
information.
So how this is accomplished, not in just this application, in every single application is remember
I told you about middleware earlier?
Yes, that's exactly the middleware that we worked on.
So the job of the middleware is not only to authenticate the user that you are allowed to visit this
resource or not, but sometimes is to inject some of the information as well.
So what we're going to do if somebody visits and hit this route in between, we are going to capture
that request, inject it into a middleware, middleware.
It will populate more information into it, and then we are going to pass it further.
Now, just like we have this request or body request cookie, you can inject your own objects in this
big massive object as well, rather more properties in this object.
So you can add request user, you can add request dot client, request, dot my user, whatever you
like to call that.
The general philosophy is to call it as always user.
So in majority of application you are going to see as request of the user, but it's not compulsory.
Feel free to call it as request of Superman.
It's up to you.
So let's go ahead and work on with the middleware so how this middleware is going to work on.
Let's go up and create another middleware.
So where is my middleware?
There we go at the top.
So what we're going to call this one as middleware, since we are going with the all user, let's call
it as user middleware.
So inside this one, I'm going to call this one as simply user Dages and we're going to be throwing
up a couple of methods from this middleware.
So the first thing is we need to import some of the big promises and models and all of that.
So obviously we'll be injecting some information.
I don't know from where to bring this information.
This will obviously come from the user as well.
So we're going to go ahead and say, hey, I want to bring in user and that user will be coming from
require let's go one directory back into the models and we just have one as of now which is user.
In fact, we can go into the user controller and bring some things from the top.
So we need big promise and now we don't need big promise.
Yeah, we need it.
And the customer as well.
So let's go ahead and bring them both at least as of now and let's go ahead and work on.
Okay.
Now moving on.
What we're going to do is we're going to directly go ahead and export a method.
So export dot we're going to say is logged in.
So this is a method which will also take care of whether the user is logged in or not.
We'll also inject some information in the middle of whatever the request is going on.
So again, just like always, we're going to wrap everything around the big promise.
So there we go, Big Promise.
And since we are talking through the database, and database is always in another continent.
So we got request response and for sure the next.
Sometimes people like to call this as callback.
CB I really don't like that, but it's up to you.
So the job one is to extract the token in case you noticed into the postman as well.
We are throwing the this token almost everywhere so far and request login reset, whatever this is.
The whole job of this token is actually to able to extract some information.
What we are cooking up into this token.
This token is combined of not too much information, just the ID itself.
So when we were cooking up this token, the cookie token notice, we are not sending too much of information.
We are saying, hey, just go ahead and get this JWT token.
So let's go ahead and explore this method as well.
And which is mentioned in the models itself.
Having a look again always gives you a more confidence and what we are actually doing.
So this is my get JWT token notice.
It is comprised of just just the ID field and we need to find a user based on this ID, but the first
job is to actually grab the token.
So let's go ahead and say that I want to grab a token from where this token will come up.
Probably request dot cookies, dot token.
Remember, we are not calling it as cookie, it is cookies, so it might be there.
Or we can just go ahead and say our field because sometimes it might be a mobile application and it
might be coming up into the header itself.
When it is coming up into the header, this is how it is looking usually looks like.
So let me show you that.
So into the header, there will be a field known as authorization.
So yeah, this exact guy will be copying it because I need to use that.
And then in the value you just go ahead and say beer and then a space and then you paste the token.
So this is how the value usually comes up and the beer and the space is compulsory.
This is how the format is.
So we can say that hey into the request dot header we might want to.
Grab some information which is called US authorisation and further down the road we want to replace
it with something.
So we're going to go ahead and change on whatever the value is.
I know the value is beer space token, but I want to extract only the token.
So I'm going to use the classic JavaScript.
I'm going to go ahead and say Replace, what do I want to replace?
I want to replace beer and a space with nothing.
So that will give me a PR token in case in case your token is stored somewhere else, maybe in the body.
Just go ahead and just after this request or token here, just add request or body token however you
are sending up, there can be a lot more places.
Okay.
Assuming that now we have access of this token, but what if we don't?
So let's go ahead and take care of that situation.
If I don't have token now or probably it is undefined, then I can go ahead and simply return an error
here.
So return next new custom command.
Custom error.
And that will be this will be a kind of a middleware error.
So we cannot pass on any error.
We will be simply saying login first to access this page and we'll be saying this is actually a41 error,
assuming that we have crossed this conditional check, that means token is there.
Now we need to grab some information from this token.
In order to grab some information we need JWT.
Let's go ahead and bring in JWT.
So we're going to say const JWT.
That will be coming up from REQUIRE and that will be coming up from JSON Web token.
Okay.
Let's decode this token.
We have done that already once in the past.
And one of the sections, I'm pretty sure you are aware of it.
So how do we do that?
We simply go ahead and say, Hey, JWT, you can actually sign the token, but you can also verify the
token.
So we'll be saying, hey, verify this token and how you're going to verify that you are going to verify
that based on the secret that I have only I have this one.
So process dot and V dot.
What did we call that?
We called it.
US JWT secret.
Yeah.
Super easy.
So based on this secret, you can actually verify this token.
Let's go ahead and hold this into a variable.
Usually this is called as decoded.
And feel free to call it anything.
It's just a variable.
But this is common practice out there.
Now, this token has all the values that you have thrown inside it with a simple dot notation.
So decode it, decode email, whatever you have injected in the token.
I have injected just one thing which is ID, so which is super easy for me.
What further down the road I can do is I can bring this model and I can say user dot find not find by
one but different this time find by ID because I have stored ID in this one.
So I'm going to go ahead and say Hey Decoded Dot ID, this will give me access of this ID, let's hold
the user into available.
So we're going to call this one as let's call this one as.
Request dot user and we're going to go ahead and say this one is going to be of eight.
Okay.
Now, a little bit more to that.
I cannot actually use a cost here.
I will say directly request dot user.
So what I'm doing here is this request has a lot of properties.
I saw that it has requested cookies request dot header.
I'm injecting one of my property here which is request dot user.
I can call this request or Superman, no problem.
But this is kind of a usual practice to call this one as request dot user.
So anybody.
Now this is a middleware.
So in between I have injected one more information onto this request and this can be accessed anywhere,
wherever this token is present.
So because everything is happening based on token.
Now, further down the road, I have to do nothing at all.
I have to just pass on this next so that whatever the information is, it can keep on continuing.
And that's all I have to do.
So this is the basic idea of the middleware.
You not only verify that the token is present or not, or you also actually inject some information.
And now we have exported this is logged in so we can actually use that.
So further down the road things are like super, even super, super easy after that.
Let's go ahead and catch up in the next video.