Okay, our data is finished.
We can see everything in our serializers and we'll be able to see that in the front end.
And let's allow users now to log in.
We already remember how to do it with a Docker authentication, so let's enable that.
In this application we need to go to the settings.
And we need to add another application.
So it's a rest.
Framework.
Out token like that.
And then what we need to do if I will save it.
Token.
So what we will need to do is migrate now.
So python three manage.
PY migrate.
So no module named rest framework.
I misspell it.
So frame like that.
So we'll save it and I will migrate now.
And I can see too, migration has been applied for our database.
So that is done.
What we need to do is we can go to our admin page now.
I can go run.
Run this.
And then here.
I can go slash admin.
And we have tokens here, so I will generate a token for current user.
And we have our token here.
So that's been added.
What we need to also do is we need to enable a kind of link that will give us some options to log in.
That means we can provide a username and password and I will have that token back.
So let's do that now.
We'll come back here and then we need to go to the URLs.
We can do it on either URL we like.
We can have it here along with others, but I prefer to have a login on the main URL which is in the
inside our projects here because it's an part of our API itself.
It's a let's say extra top level.
So what I can do is I will duplicate it and we can name it as we like, but out is kind of short and
easy to remember.
And then we need to.
Add the method so from rest framework out.
Token views, import, obtain authentication token and we can use it here.
So what I will do, the server has been run, but I can refresh it just in case.
And then we have another URL here.
So let's come back here and then we can actually we can do it in Postman.
So we have instead of API that's on the main URL.
So it's authentication like this and let's test it.
We get of course get is not allowed.
So we need to do a post post and then we'll try this and you can see username and password is required.
So let's go to body and instead of stars here we can do username and minus username is Christian and
then we have password and the password was also Christian.
So I will send this and I will send it here and we have that token back.
I will copy that token here and that token I will be able to use in our application wherever we need.
So if I will go to authorization here, I will go to headers here and then I will do authorization,
I can pass token this one so I can get a let's do get and API movies.
And I can send it with my request.
At the moment we don't do anything with that token.
And what we can do is first we will restrict only a login people to see the resources here.
And also what we need to also do is to come back.
Inside our views.
And use that request user here.
So let's say take a look what we have so far.
We have rate movie.
So I will go here and then I will have just one, let's say movie first and I will do rate rate movie
and I will to try to use a method post, I will send it now and you need to provide stars.
Of course we need to do that.
So I will do stars like that.
And then we need to also provide movie and we need to do a user.
At the moment we don't need to have a user, so let's do stars and movie.
So we'll do stars.
Let's say two and the movie will be one.
So if I will send it now, you can see rating has been updated and the user is one because we hardcoded
that.
So if I will replace it now with the user here.
I can do print and let's try to see what's in the user.
So I will go.
I can print it extra information here.
User.
And that's been refreshed.
Let's go back to the postman and try to do it again.
So you can see here cannot assign automatically an anonymous user a rating.
User must be a user instance.
So the problem for this is I will show you before we have that error.
You can see here we had user anonymous user.
So despite the fact we provided and we pass.
This.
This headers here.
Authorization token.
It's still Django doesn't know how to deal with it is how to translate that token, how to use it.
And we need to actually tell Django that we will use it in our.
View set.
So if I go here, you can see we have query set and we have serializer class, but we haven't tell Django
that we would like to use our token so we can do it now.
Authentication classes and we'll have a tuple here and then we can do token authentication like that.
I also need to put a comma at the end and we need to import it.
From rest framework authentication, import token authentication, and we have that.
So if I will save it now.
Actually, I can copy that and I can also include it for the rating.
So we'll use token authentication for both.
So let's refresh the server.
And coming back here.
I will send it again.
And if now everything is fine, you can see user is here.
And also if I go back here, you can see user Christian has been printed.
And the reason why I see that printed here is because I have this.
So now we switch from this fixed one to use the user from the token authentication.
So if you.
Pass in the headers authorization token and the token for your user.
Django will extract from request that user because this token is connected with that user and we can
have it from the request object available so we can actually remove this part.
And now this is automatically extracted.
So if I will be logged in as a different user and try to do a different rating, this will create a
different rating object in our database because the unique together user and movie will be different.
So that's it.
That's our login.
Option.
We will need to also allow users to register and we can restrict some of our application to be available
only for login user and we can do that in the next video.