Let's continue with our sign up flow so we need to take the email and password out of the body.
The requests those have now been validated.
So we're going to you then run a query on our collection of users inside of our Mongo DB database.
We're going to try to find a user with that same email.
So I'm gonna flip back over to my sign and root handler because we want to run a query.
We need to import the User model at the very top of the file.
So up here at the top I'm going to import user from a blender factory models user I'll then go back
down to my root handler.
We're going to run a query inside of here which means we're definitely going to be making use of that
async await syntax.
So I going to mark the enclosing function as async and then going to pull the email Andi password out
of the body of the request I'll then run a query and try to find some user inside of our database with
this email.
They'll do existing user is a weight user not find one and I'll try to look up that e-mail so that we
can immediately do a quick check if there is no existing user if we fail to find one then we want to
throw in air immediately and bail out of everything inside this request handler.
So this would be another good scenario another good place to make use that very generic customer we
had put together called Bad request.
You might think that this would be a scenario to throw a kind of 4 0 4 error something like user not
found or something like that.
But remember whenever we are at handling validation or key authentication whenever dealing with authentication
We usually prefer to share as much or assuming it has little information as possible.
I got all those words opposite.
We want to share as little information about why things go poorly during failed authentication attempts
because the more information we give to someone it might be information we are providing to a malicious
user.
So if someone tries to sign up or sign it with an email that doesn't exist we don't want to tell them
that that email doesn't exist.
We just want to say sorry but you provided us some bad log in credentials or we can just say log and
request failed something like that.
That's why you're going to use that very generic custom error of bad request error at the very top.
I'm going to import that error ad request error from errors that requester
and I'll make sure that I threw that down inside the if statement.
So throw new bad request error and remember we can optionally provide a reason for the error.
So I'm going to give a very simple very direct message that's very generic in nature.
I'll just say invalid credentials to say sorry but failed.
All right.
So if we make it past that check the next thing we have to do look our diagram we need to store the
password that was supplied inside the request with the hashed password of the stored user.
And remember we already put together a nice little class to take care of this stuff for us go back inside
of our services directory.
We've got that password to yes file.
So here's the class we put together and we've got that compare method.
We're going to call compare the first argument is going to be these stored password off the user that
we just fetch.
And the second argument will be the supplied password.
So the one that was given to us inside the request so back inside a sign and TSA at the very top let's
import password and you know I really regret the name of this class.
It really should have been something like password manager or something similar.
But we're in pretty deep at this point so we're going to stick with that I'm going to get that from
the services directory password
all right after we have that if statements we're going to compare those two passwords and remember the
compare passwords method is going to return a boolean.
They'll do passwords match that's going to be a true or false and then a weight because comparing the
passwords is asynchronous password dot appear
our first argument is going to be and if we forget as I just did hover over that thing.
All right.
First one is the start password off the existing user.
And the second argument is the password that came in the request.
Second it has an existing user that password and then password.
That looks good.
So now passwords match is going to be a Boolean if it is false that means.
Well we've got some invalid credentials.
And so once again we'll probably want to throw another error just like that right there.
So if not passwords match that is false then throw new bad request Error Invalid credentials
and then finally if we get past that statement right there.
Last thing we have to do our user is now logged in.
So we need to once again generate a on web token and send it back inside the cookie.
That's going to essentially be the exact same logic we've just put together inside of sign up.
A moment ago if we go back over to our sign up root handler we've got where we generated the Jason web
token and then we started on that session object and sent a response back rather than rewriting all
this code.
Let's just do a simple copy paste.
This course is already getting a little bit long.
So we're gonna do as much copy pasting or reuse this code as we reasonably can.
So I'm going to paste inside of sine in our step to generate the Jason web token we're going to assign
that to the session object and then we're going to send back a response.
However when we send back the response we're no longer reading a new record inside of our database.
So traditionally we would send back a 200 in addition.
Right now we are sending back a user variable that does not exist inside this file so we need to rename
it user throughout here over to existing user because that's what we assigned that variable or the result
of that query to it's going to find no one right there and change it to existing user number two and
then down here in number three looks good.
Now the very final step let's make sure that we import the Jason web token library into this file so
we'll go to the top add in and import for Jason a web token from Jason web token and that should be
it's for sign in well this video is just a little bit long.
So let's take a pause right here and we'll test this thing out in just a moment.