Hey, did everyone stay here?
And welcome to another video.
Now, before we start with this video, let me just point you towards one line that I've added in the
source code, which is this one.
A lot of you obviously will get a question that why we are sending token just when the user is registered.
Now there are a lot of flows and we can definitely argue about which one is the best, which we are
not going to do.
But again, some people just like to register the user and immediately they want to start their application
to be used by user.
But in some cases you just want to send an okay message that, hey, you are all set, all good, your
account was created.
Now go ahead and log in.
So when you send the token where you not send the token, that's up to you and the flow of the application.
There is no wrong or right here.
So I've added a simple line here that send the token or just send a success message that yes, your
account was created and send some information so that frontend guy can actually redirect it.
Now it can redirect just based on the yes or no also.
So it's totally up to you and the flow of the application.
Now in this case I am sending you the JSON token because I wanted to teach a lot and all of that, but
that's all what we wanted to do.
So now what I'm going to do is I'm going to go ahead and just minimize this because the registration
work is all done.
Now let's go back and see how we are going to move now.
Now, again, by the way, this video is going to be tiny bit longer because I just want to show you
that how now we can speed up the things.
So now we have to follow the login flow just like we have done the registration.
We are going to use the login flow and this is how the user login flow looks like.
You grab all the information so I know that I can grab it from request or body or maybe any other format.
I can just grab it maximum time.
It is going to be request body.
Now I can check the mandatory field.
Of course I can do it by simple if unless no big deal.
Get user from the database.
Okay.
So this is a little bit tricky.
Not too much, but I can use just like I was using user create to create a user in the database.
I can go ahead and use user find or find one or any other method that I know to find certain things
in the database.
And after that we have to compare and verify the password as well.
Once we have grabbed the user, we also need to grab his password and the password that the user is
sending while logging in time.
We have to compare both of them.
We are now aware about the library script and I showed you in the documentation that it has a method
of comparing and it can compare and can return us a boolean value that whether the password matches
or not.
And finally, we can give the token or any of that information, whatever we need to do.
In majority of the cases, you will be sending him the token back.
Okay, so this is all we have to do.
Let's go back up here and define another route.
So let's go ahead and do that app post and this is how it's going to be.
Let me shift a little bit.
So what is going to be the route?
In my case, I'm going to call this one as login.
There's a whole lot debate about calling it as a login, sign up sign and whatever you call it, I'm
just going to call it as this one since I'll be using some information with the database.
And as I told you, database is always in the other continent.
So we have to go through with the async and await method.
So I'll directly put in a sync of eight here.
I'm going to go ahead and say, Hey, I want to use a request and response just like that.
And there we go.
Now how we're going to do that, the very first thing is not accepting the request, but we I showed
you that we have to wrap everything around the trigger block because otherwise we have to go through
with the promises.
And that is also a good way of working with that.
Or you can wrap everything around the trigger and use a sync of it totally.
Your call how you want to go ahead and do that.
First, I'll handle the case of the error.
So I'm going to go ahead and say, Hey, I want to use the log and I'll just dump the error.
Yes, this is not a good idea.
I should be digging a little bit more into the errors.
But in the case of development, we usually prefer to have entirety of that or not.
In the production we production, we want to give very meaningful errors in the case of errors also.
Okay.
So let's go ahead and try first.
Let's grab all the users.
So I'm going to go ahead and say that, hey, I want to structure whatever is coming from the body.
So I'm going to say request dot body.
Let me go ahead and make some space for myself.
There we go.
Nice and easy.
Come back here.
There we go.
What all information is coming in.
The major information that is coming in is email and password.
Maybe you are expecting username or something else that's up to you and your flow.
After that, make sure that it is 100% there.
So just like the exact same flow that we used in the past as well, we want to make sure that if email
and password are there, but if they are not there, that's why the exclamation sign, if they are not
there, I just want to send a response.
So resort status, I'm going to raise the status code of probably 400 or probably 401 up to you.
And we're going to go ahead.
Usually it's a JSON.
All the response is being sent in the JSON.
If that is the flow that you are following, I'm not following any flow as of now.
So I'm going to go ahead and say and I'll respond with Field is missing.
I don't know which one because I'm checking both of them at the same time, but this is how we are going
to do that.
Okay.
Assuming I have reached to line number 68, that means email and password are present there.
Then we have to go ahead.
Based on this email, I need to find a user from the database itself.
So I'm going to go ahead and say user and again, make sure to remember.
That this user is coming up from here, from the model itself.
That's why I'm able to call this up here directly, like user.
So come on.
Click up here and then I can use either find or find one.
Again, we can discuss more about this better or not right now.
So I want to find a user based on the email.
Now this obviously will return with something, so I'm going to hold it into a variable.
Let's call this one as user.
There we go.
Nice and easy.
But since the the database is in another continent, I'm going to use an A and that's the reason why
we used a sync.
So this is good.
Now what if there is no user?
I can go ahead and say that if there is no user, then obviously I was not able to find the user from
the database.
So I can go ahead and copy this and paste it up here and can say that you are not registered in our
application app website.
However you want to transform the messages, assuming this is all this has also not happened.
That means now we need to check the password as well.
Now when we are grabbing the user, we also have grabbed the field which is user dot password.
In case you are using other mechanism in the mongoose, you are that much advanced level a little bit.
Then make sure you add a plus sign in case you have instructed the mongoose not to send the password.
Make sure the password is coming.
For those who didn't understood this, no worries.
This is not a beginner conversation that I was having for a minute.
Okay, so how are we going to use the password thing now?
Password thing is really, really easy and I'm going to show you the better way of accomplishing this.
So what you can do is you can simply use the script and Bacup has a method of compare.
Now in this compare, you can go ahead and compare the both password, the password that the user has
send me just right now in the body.
And I can also go ahead and compare with that user dot password.
Now this actually returns to a Boolean value that whether the password matches or not.
But let me show you one more thing when you are using this compare since I told you this can take a
little bit of a second.
So you always want to use an eight.
Now you can hold this result into a simple variable and then use the same settings of if the password
matches are not based on that, you can send the response.
But let me show you let me go ahead and comment this out and show you a little bit of better way.
This can actually stop some of the spams as well.
You don't want to individually compare the email and password.
You want to simply say, maybe I want to check out the one time email and password both at the time.
So what you can do again, this is just a flow.
Just wanted to show you both the situation.
I will cut this out and I will say if user again, if there is no user, it will automatically be treated
as false.
So we can go ahead and do that and we can go ahead and treat this entire thing that we just wrote about
the password comparison all here.
We don't need to store that into a variable.
So if user is there and the password also matches, then we go ahead and follow this up.
So what we're going to do in the case when both follows, again, you can use an exclamation sign wrapped
up in the press parenthesis.
If nothing happens, then we can respond.
But in this case we are going with the positive flow that if user is present and the password also matches,
then I'm going to do something.
Okay, what you are going to do?
The flow says you just generate a token and send it back.
Okay, let's go ahead and create a token.
How we're going to create the token again, same JWT sign.
This is how you sign.
This is how you create the token and you pass on just the three things headers we are not worried about.
So let's worry about just the information.
So we're going to say user underscore ID from where you're going to get the value.
Simple.
The user that we have extracted from the database dot underscore id told you the weird one and it is
not compulsory.
But still I'm going to go ahead and send the email as well.
It's not required because based on the ID, we can extract the email whenever we want, but maybe,
maybe for some reason we want to send it up.
Then the second thing is the secret.
So I have to say.
Process dot E and V dot.
Let's grab the secret key.
So I'm going to go ahead and copy this and paste that.
Once this is also done, make sure you always expire your passwords, not password, but tokens as well.
So I'm going to say expires in probably you want to get it more, but I'll just go for the 2 hours now
we have the user, we have got the token as well.
But since this token is not stored in the database itself, so I'm going to go after the if case, not
after the if case where we are sending this token.
So this is signed, this is where the token is created.
Few lines of enter.
There we go.
Okay, once we are done, let's add this property to the user.
So token is going to be token.
And also we don't want to send the password right now.
This user property has the password.
So I'm going to say user dot password and that is going to be undefined just like we did last time,
if I can write that.
There we go.
And finally, we want to simply does dot status.
We want to raise the status of 200, which is always a good sign that everything is happy.
And in the JSON, I'm going to go ahead and say, let's send this user.
Okay?
Now what happens if all of this if case doesn't work, maybe user is missing, maybe the password is
missing.
So we're going to go ahead and send a message based on that.
So let's go outside of this if statement and say that in case nothing of that if statement works, then
let's go ahead and send a status of 400 and send a user to message that email or password is incorrect.
Again, it's all up to you.
Not correct.
Incorrect.
There we go.
Now it's up to you which flow you want to go with.
That maybe user is a little bit confused in this case.
If he is not registered, maybe you like the upper flow better that if user is not registered, we probably
want to give a better message to the user that hey, you are not yet registered and probably you want
to have a separate thing for the password.
Maybe you want to give it all ones.
Definitely up to you how you are designing your application.
You are the boss here.
Okay.
So this is all done.
Let's go ahead and save this one.
I guess we don't need to worry about anything else.
Yeah, we can actually go ahead and remove extra spaces and this is basically a log in flow.
Okay, that's great.
In the same video, we can actually go ahead and test this out as well.
So let me go up here.
So there are two users here in the database we can see which is on AE.
I mistakenly added instead of one.
I said that I know the password, let's see if we are able to grab it back from the post.
Man So Post Postman Let's go ahead and save this one and I'm going to create another route.
So let me first copy this.
And paste that.
And this time we are going to go for register.
So I'm going to go ahead and say login.
This one is going to be post route.
We need to send some information in the body inside raw.
And Jason, there we go.
And the first information is email.
So these are the two that are required.
And the email is on the date ae dot dev.
And the password again, this needs to go in the double codes password.
And that password that I added is one, two, three, four, five, six really bad.
But this is what we got.
And let's go ahead and try to send this one.
And it looks like we are hitting some of the issues.
And it says underscore ID is not defined.
So let's go ahead and see where we messed it up.
Yep.
This is the place where we messed it up.
I'm pretty sure most of you have already seen that and might be pointing out from your screens that,
hey, you missed it there.
Okay, now let's go ahead and try to send it one more time.
And there we go again.
Debugging is always the part.
Please don't be afraid.
Don't be scared.
Sometimes it takes just a few minutes.
Sometimes it takes weeks, probably months.
So don't be afraid of that.
Now we are able to grab the ID, first name, last name, email and the token itself.
Maybe you don't want to send that much of information to the user.
You can always undefined something.
Maybe you just only want to send the token, not even the ID.
That's up to you how you want to play out the application.
So this is the entirety of the login flow.
Let's go ahead and catch up in the next video.