Hi everyone.
Welcome back.
So in this video we're going to be implementing the actual Abiah that we designed in the previous video
here.
And then we're going to be implementing it in class.
So let's get started.
So the first thing that we have to do is to handle the database connection right.
As usual we want connect to the database.
So actually we can just that's why I haven't deleted the previous app we can just copy this area over
here.
So if we copy this area over here all the way to here and then copy this then we can automatically just
we don't have to write it from scratch we can look at it so we can delete this one.
You don't need it.
And yeah.
OK.
So from flask import flask Jaison if I had requests So these all these are going to be using.
We're also going to be using flask restful to work we'll import API and resource and we're also going
to be implement using mango pie.
Man would you be right to store the sentences so gonna do from Mongo import Mongo client.
So we initialize the app and we say that it's an API.
And then the client is equal to Mongo client dot.
So we're connecting to this Mongo DBI you're here from knocker compose and then we're saying.
So instead I'm right I said VB is equal to client dot and then all of us call it sentence's database
database.
So this database is going to be called sentence's database.
And then I'm going to have a different table in that I'm going to have a table called let's say sentences
write so sentences so D-B.
So what if we look here.
This is the collection.
So when I have a different collection what I have I see sentences is equal to D.B and then sentences.
Ok so I'm going to have a collection called sentences and I can now remove this one.
So now I have a collection of all the sentences that the users send me.
But if you notice your then then there's a problem because one user should have one once more one or
more sentences.
So this design isn't very good.
So instead what we're going to be using is to make a collection off users and for each of these users
we're going to be putting inside of them their sentences right and we're going to put a embedded document
inside of them with their sentences.
I'm going to say users is equal to D.B users.
OK so restoring the users themselves.
OK hopefully this makes sense.
Now the next thing is we want to support registration right.
So we're going to say class.
And then we say register.
And this is a resource.
So we are bringing resource here.
And then as we said here we said register whereas it's at slash register and where it's also support
post.
Right.
So let's go back to here.
And if you remember here for free if we do what we do for example this class over here class and then
we do a defined post and that if I want to get the data I just say posted to you that is equal to request.
Get Jaison and automatically get the data that the user sent sent me right.
So I'll do the same thing here so register my defined post which is what is supposed to self.
So this is going to be the post the function that handles the registration of the user.
Now what I want to do on step one is to get posted data by the user.
And the way I do this is the same as below I'm going to do a request that get Jansa Jaison.
And now I have this piece on or that they use are posted from a post a data is equal to request JCA.
Now the second thing is out I need to verify.
Well in that case in here we assume that the user always sent the username and password right.
If you want to make this much more detail right you want to add some extra conditions that maybe the
user didn't send a password or maybe that you didn't send the user name.
Or maybe you didn't send anything.
So if you actually want to do this checking you can also add so extra responses in your calls here.
But for now we want to do you know a very basic API.
Let's trust the user let's say OK he's always going to send us the username and password so we don't
have to worry about it.
OK.
Let's go back.
So now how do we how do we access these things.
If you remember if we go down here all the way to add and then we say after we get the posted data.
And that ad we got we call the check posted data.
So let's go to check post data.
And if you remember here.
Let's see where it's at.
So we can access the posted data as really a dictionary with the index that we're looking for.
So for example posted data.
Why.
Right.
So it will do the same thing that we're expecting.
So the first thing is to get that data right.
So get the data.
So what is the data we want the username that the user would register with that user name is equal to
posted data and that say these are signs Senza username and then the password is equal to the data and
then password.
Now obviously the user doesn't send them in this form.
Then you have your server the crash because there is no username or password read.
Once you once you use them as once you assume they're there they're right but they're not.
So of course see if you're you are developing a real API to be you know going to the deployment then
you make sure you're here to to add this response codes here to make sure that everything that you received
is good.
There's no problems here and this registration form.
Right.
OK.
So let's go back now.
I have my username and password.
Now we need to talk about something else.
How do I store the username and password right.
I know what I need to do is to store this username and password into my database and users such that
this user here.
So this username and password this user would would have basically this user would be able to when he
tried to log in again he would be able to access this username and password.
He would give it to me and then I would compare it to the one stored in my database that if they're
the same that I would let him to log in or access to the API.
But you've probably heard every once in a while about a company which you know gets very bad publicity
and usually it's because they've stored this password wrongly in the database.
And the way they do this is they take this password as Ro data so this password might be sent as 1 2
3 x y z.
Right.
So they take this password over here and it is just they don't it into the database.
They just put it into the database and they don't care about it.
Right.
So this is really really really bad because if they give you if any hacker is able to access database
which happens a lot if any data if any hacker acts as that then you're in big trouble.
Right.
Because he can see all the usernames and passwords of people.
And usually they use your names and e-mail.
So now they use it and most people don't create new passwords right.
So mostly they can just reuse these passwords with these user names.
And they can just get access to your customers information or e-mails and passwords and all that stuff.
So that's very bad.
So we never store a password in a database in its general form.
So usually what we do is we do something called hashing what is happening now hashing is a function.
So we take a hash of the password plus solved and we'll talk about solved later.
But we basically hash the password and we add to it a little bit of soap and then it should give us
something some jibberish you're right.
And we just got denoted by this and this is what we store in the database.
Right.
And then the main idea of this is that you can go backward.
Right.
If you know this you can't know the password but you have to know that password to generate this.
So this is a very unique thing about hash functions.
If you know the password you can generate this very.
But if you don't know the if you don't if you know the hash you cannot generate the password.
So what we do is we store this hash inside this database over here and then for when when the user tries
to log in again I hash the password that he sends me.
So let's say he sends me again 1 to 3 x y Zed.
So when I hash it it generates the same hash.
So now I can compare it to the hash that I have.
So in other words I'm not storing the password of the user of the other people who are registering into
my API.
I'm actually storing just the hash of their password and reversing the hash is very very difficult.
It's almost impossible to do so except if you've done something wrong.
Right along the line.
So now what we need to do is to hash the password and to use this we're going to use a tool called Piatt
crypt.
OK so this is pipe B script and this is a python library that allows us to hash function.
Now I want to show you how this function works.
So I'll just open the terminal here on the right.
Then I just realize I don't have pie grips on most a pimp install decrypt.
OK.
So whoops suruh app Instow by some pick first.
So we make sure we have some bip that's important.
And then once we have it a pause now and then once I have it I'll come back and resume the video.
OK so welcome back.
So now we're going to do PID install script and that is going to be collecting me cribs and installing
it it shouldn't be too big.
OK so now that we have be created are going to open bytes and just open a python terminal and we're
going to important be great.
Great great.
Now for a look at the examples here.
So the example is actually at if if you're if you just write in Google the PI B script and then you
choose.
So why and then dash and then b y c r y P T and then you choose the first link it's at mandragora or
slash projects slash pi pi be great.
So if we go down to the example they have the API is very simple to use.
So we're going to use first of RSA hashed is equal to be crypt dot hash password.
And then for the password we're going to enter strings.
Let's say that my password is 1 2 3 x y is it OK.
And then I'm also going to be crypt that generate SOAD and then generate us all.
And then I click enter.
So now my password to 1 2 3 x y is and has been hashed.
Now if I print Hashd you would see that this is just a bunch of garbage right.
You don't understand what this is right.
You can't you can't go back to my original password 1 2 3 X was it.
So what you do is you store this hash or your and you store it in your database with the user name.
Now let's say the user now wants to log in.
So he gives you his user name and the password so that we know that the password that he's giving you
is actually the correct password right.
That gives you this hash Well you hash it again.
Right.
So you say so over here.
So if I do be cribbed that hash password.
Now let's say the user gives me 1 2 3 4 x y is that so that's not the correct password.
And then Hashd is equal to Hashd.
Now if this is true then that means that this Basford or here is the same as the original password 1
2 3 X was it.
But of course this would give me false because they're not the same.
But if I delete this for over a year so it's now 1 2 3 x y Zed.
And then I click enter then it should give me true.
So in other words if you notice here the only time that I used 5:59 the original password is when I
was hashing it.
And then I stored the hash in the in my database and then when I wanted to make sure whether the user
was the same user or not then I would generate I would hash the password that he sends me and compare
it to the hash that I have in my database.
So that way this is a much more secure system.
Right.
So we need decrypt.
So we're going to add it to our requirements that where we're going to add be grouped.
So be correct.
Right.
That's how it's built.
I think you point b c r y p t.
OK so we're going to import the crib.
And then we're going to go back to our application that we're developing and we're going to do import
regrouped again.
OK so now after the user has sent us the password we want to hash it.
So we say hashed password is equal to and then we copy the code from your so it's hashed is equal to
this line over years.
Copy it.
Put it here.
Oops.
So as to delete this.
So it's B script dot hash password.
And then the password is this password over here that the user posted to us and I generate a sock.
So now what I'm going to do is I want to store.
So I want to store the username and password too.
So I want to store the username and the password into the database.
So how do you do this.
Well we access the users where we access that we insert something into the users.
So we do users that insert going insert something.
And so I'm going to insert user name is going to be user name that he posted to me.
And I'm also going to put the password right so password and for the password I'm going to put the hashed
password OK.
Now an extra thing I'm going to put it I'm going to put the the sentence to be stored so each user has
the corresponding sentence a sentence and then the corresponding sentence for now is just going to be
an empty string.
Right.
So the user doesn't have any stored sentence for now.
So let's just initialize it with an empty sentence.
OK.
I'm gonna save that.
So now this user I'm going to insert into it our record with this username password sentence and that's
it OK once I'm done with that then I go what's the next step.
Well I want to return to the user addiction.
So I'm going to say.
So how do we how do we use to do that.
If you look here we would generate a map and then we would do a turn it was just on ephi.
OK we'll do the same thing here.
Redo return Jaison is equal to a map.
OK.
So I want to tell the user that he successfully logged into a status 200.
So now the status quo is 200.
And that means that he successfully.
So we get even at a message a message and you've successfully
signed up get signed up for the API.
So now the user knows that he entered US 206 Esco and he signed up to the API and I returned that as
Jason.
So we turn Jason if I was your son if I returned Jewson.
OK.
Now a couple things to consider here is for example what happens to you if the user tries to sign up
twice using the same username and password.
So again if we go back to our resources here we should assume that we have some air quality here that
tells if a user tries to sign to sign up twice then I can return him and Eyrecourt.
There's there is a user already with this user name.
Right.
What we didn't do that here.
So there is also something to consider and we talked about a lot of stuff that we could add here but
we haven't really added that many right because we're trying to do is just a very basic API or proof
of concept so we're not going to be deploying this anytime soon.
So this is just an idea to keep in mind.
OK so now that we have to we have we have this register we now we can add it to our API.
So I'm going to do API that add resource and then I'm going to add this resource register over here
and I'm going to add it at slash and we agreed that it will be slash register.
So I do slash register.
Great.
Okay.
So also we might as well add this.
The last thing here if name is Main then APTA right.
Right.
It's it's common for all the applications in general.
So we're going to add this one here.
Okay so the next thing that we need to do is to handle the next two resources which are store sentence
and retrieve sentence.
So I'm going to do.
First of all the story centers on one new class or and this is a resource.
And then we said that for a store we're going to be using post-ride because we're sending a sentence
to the user to do the the API.
So we're going to say Fine post itself.
And then in this year we first got Want to get that posted data.
So step 1 get the posted data so we get that using the same line of code here as opposed to data is
equal to requests that get us up.
So we can copy that and then step two step two is to read the data read the data so we have a couple
of things here we have my user name is equal to posted data e.g.
and password is equal to posted data password and we also have the last thing the sentence sentence
is equal to posted data sentence.
All right.
So we have all three things here.
Now first of all we want to.
So the steps three or you'll see steps three here is verify the username password match.
OK.
So verify that this user is indeed at a password and it matches his password.
And then step four Once verified.
So step for once I've verified that I should verify also that he has enough tokens or verify very high
user has enough tokens and that if he has enough tokens then steps live Storer the sentence.
And return 200.
OK.
Now a couple of things in the original registration we should have started the user with 10 tokens right
so we got this year through going to and dash and then we got tokens and then 10.
So we're going to give the user or actually just give him five OK so or six.
An even number.
So we will give the user only six tokens for every time he wants to input something.
Right.
OK so the first step is we want to verify that they use your name pass.
So for that I'm going to make a helper function so I'm going to say correct password is equal to verify
and then I'll I'll give it the user name and password.
OK.
So I'm going to verify this username and password to verify password.
And I'm also once I verified it.
Want to say if correct.
If not correct password.
So if not correct password then return Jason is equal to free go back to our choice here.
Then if his user name is wrong then it's three or two.
So I'm going to give him a status of three and two.
So let's go back and then I'm say returned Jaison.
And then I can tell him status is three or two.
So he knows what he did wrong and then return Jaison if I
returned J-Zone this.
OK.
So that's if.
So we still need to write the verse password function and then also we're going to say enough tokens
is equal to verify tokens for this username and password.
So since we're already here so we don't need the password right because if we're past this dept and
that means his username and password are correct so we can just check if this user name has enough.
Has this in the past has enough tokens or not.
So we're going to do it enough toker enough tokens is equal to verify tokens and then we say if not
enough tokens.
So if not enough tokens.
And what do we do.
And the return Jaison is equal to a map and the status in it is going to go back here.
It will be 3 or 1 right out of tokens.
So three or one.
And then we simply return to satisfy our return Jason.
OK.
So if these two steps pass then we finally can return.
First of all store the sentence.
So how do we do that.
I always say users write users so users what is users that's needed the collection.
So are you going to say users data update.
OK.
And there's two things right.
The selection criteria is going to be by the user name so user name.
So I'm going to update and then the criteria I'm looking for is the user name here.
I want his user name to match the selection criteria.
Let's put that on your line so the user name is going to be user name.
Right.
Let's see.
Yep.
It's going to be user name but without a capital.
And then that's the selection criteria and for what we're going to replace it with we're going to replace
it with a dollar or dollar set.
So we're going to let's open a new line actually.
So we're going to do a dollar set and then it's going to be a list or a document and this document is
going to contain what I want to replace.
And going to replace a sentence or two here this one over your with the new sentence so sentence.
With the new sentence so sentence.
And I also want to set the tokens to be minus one right so let's do it on a new line.
So first of all it's.
His is his the sentence that he sent us.
Now we take away was that he said restore the sentence.
Take one token away and returned to him.
OK.
So the first thing is we're going to update the user.
The user with the user name is your name.
And then we're going to set his sentence to the sentence.
Now that that is a second thing is actually you know what we can actually change the idea to verify
it for verified tokens to actually count tokens so he can count the number of tokens that he had and
then number of tokens here.
And so we say if not our number off tokens is bigger than zero.
So is the number of tokens is less than or equal to zero then returned Jaison is.
So you can actually get rid of this.
And so we have the number of tokens is less than or equal to zero.
And then in that case returns three or one else.
I'm gonna update histo again so I can actually do it in this file right here so I'll click enter here
and Tab this one over here.
Right.
So we don't have to go back and count the number of tokens again.
I can just automatically do a comma here and then I'm going to say the number of tokens.
Right.
And if your memory is T with a capital.
So tokens.
And then I'm going to say none tokens and tokens minus one.
So I subtract one from his tokens.
So now I'm replacing his for this user and the user with this username on setting his sentence to be
this and his tokens to be this over here.
OK so now we've subtracted one from his tokens and restored his sentence.
Now we can tell him returned Jason is equal to status is 200 and we can tell him you know we can we
can you can also send him a message if he wants a message and sentence saved successfully.
OK.
And then we can now return.
Jason if I return Jason so that should be it for for the registration and for storage.
Now the final thing is if you know this year that we have done the register and the store so we'll stop
here and in the next video we want to see first test this.
So make sure this is working with no problems.
And then we're going to do the final resource which is the retrieve the sentence.
And that should be it for the API.
So yeah we'll stop here and until the next video.
Be Koning.