All right.
Let's go ahead and start to implement our root handler.
LOGAN We're going to follow these same series of steps we saw back over here inside this current user
file at the very top.
I'm going to import one or two things that we're probably going to end up needing though up the top.
I'm going to add in an import or JWT from Jason web token.
Remember this is the GDP library that we're using to not only create but also validate the token and
extract information from it then inside of the request handler itself.
I'm going to delete the resource and that's already inside there.
We're going to first begin by taking a look at the record session dot JWT property.
So if not rec session JWT that thing is not set then let's return early and we will do a rez dot sent
and say the current user is no right away.
You'll notice that we get an error around wrecked out session.
We saw this error tied to typescript just a little bit ago back inside of the with sign up or sign in
one of the other.
If we hover over it you'll see that typescript is being told by the cookie session libraries high definition
file a lot of terminology there that the wrecked out session property might be either null undefined
or an actual cookie at session object not just you know the only case or the only scenario where we're
going to add this object really be null or undefined is if we somehow get to this root handler without
first executing this cookie session middleware.
So if the request does not flow through that cookie session middleware and the rect session property
will not be set.
And so that's why typescript is being a little bit upset here.
So we can fix this up by adding in a very simple check.
We can say if not wrecked out session.
So if that thing doesn't exist for some reason or if the JWT property is not set then we're just gonna
say the user is not logged in the code you see right here we can condense down using a special little
typescript operator.
So notice how we are first checking to see if a record session exists.
We can add it in right after a record session instead.
A little question mark.
So this right here is 100 percent equivalent to what we just had a moment ago if record session is not
defined then this entire if statement or this entire expression right here will evaluate or I should
say with the question mark really that's going to all evaluate to be true.
So it's 100 percent equivalent to what we had just a moment ago.
Well the question mark is just checking to see if some internal property actually exists or not OK so
that's going to handle this first case right here.
So now after that we're gonna try to decode the data on a Web token.
We're gonna check out and see whether or not it is actually valid if it's not valid.
We're going to once again send back current user of null.
Otherwise if it is valid we're going to send back this object that has the payload inside their so after
the if statement will say constant payload is JWT not verify.
Remember very quickly we had seen back in the documentation when we're looking at the JWT library.
This is how we decode or essentially extract information out of a chase on a Web token.
The first argument is going to be the token itself that will be rec session JWT and then the second
argument is going to be the J W T key which we had set up previously as an environment variable.
So quick reminder back inside of sign in T S when we had generated that Jason Webb token we use that
process EMV JWT key right there.
That is our signing key and we need it in order to validate the token.
We're going to provide that as the second argument right here.
Process in the data to underscore key.
Now once again typescript is not really or doesn't really want us to assume that that property is defined
as it is entirely possible that we're going to start up our app forgetting to set that environment variable.
So that's why we get that error there.
But as we saw just a bit ago back inside of sign in and sign up we are very sure that we already check
to see if that thing is defined.
So we put the question mark at the very or seeing the estimation at the very end.
It tells typescript to just not worry about it as a further reminder.
We had check to make sure that the property actually was defined back inside of our roots indexed to
yes file specifically inside the start function so if our app starts up without that environment variable
being set we threw an error back there.
That's essentially where we just took care of that so once again inside of current user I'm going to
put a question mark right afterwards
now.
Something really interesting here.
Remember a user can technically try to fiddle around or mess around with the properties inside this
chase on a Web token when we call verify if the token has been messed with in any way then verify it
is going to throw an error.
So we need to make sure that we try to capture that error.
We're gonna wrap this with a try catch statements but again if something goes wrong with verifying the
token we're going to throw an error and we're gonna end up inside of catch.
And in that scenario as we saw back in the diagram if the Jason Webb token is invalid we're just gonna
say Hey you're not logged in.
So current user of no inside the catch statement we'll do a resort sent or user of no
but then finally we can handle this very last case here.
So if the token is valid if we have a token we have successfully decoded it.
We have the payload.
We're gonna send that back inside the response.
So after Conte's payload right there we'll do a red dot sent rent user and we'll stick the payload in
like so.
All right.
That should be it.
Let's save this.
Let's go back over to postmen and we're gonna do a quick test so over inside of post man I'm going to
first make sure that I am successfully logged into the application so I can make sure I am making a
post request to sign in.
I've got some valid credentials right here.
I'm going to send that request off I get back a good response and if I go to the cookies tab I can see
very plainly that I do in fact have a cookie set.
So presumably there is a js on web token inside there yeah.
That's good.
I'm not going to open up a second tab inside a postman.
I'm going to set the request out to get and I'll make that request to HDD P.S. ticketing
not Dev API users current user.
I'll make sure that I set headers with a content type of application.
Jason and we're not gonna have a body because we are making a get request now just you know whenever
we get a cookie set inside a postman postman is going to automatically send that cookie to any follow
up request to the same domain as a matter of fact we can actually see that if we go to the right hand
side over here and click on that cookies button.
So this is listing out all the active cookies we have inside a postman.
And at present we've got the ticketing dot Dev cookie.
So again our JWT is inside there.
So when we make this request we should be including our taste on the web token.
All right.
I'm going to send this off.
And there we go.
So I've got my current user and I got the body or the payload of the Jason web token.
So I'm being told my email my I.D. and the issue would at time of the token.
So in the context of a react application if we got back a response like this in our ReACT app we would
assume that the user was logged in let's now repeat this process but we are going to go ahead and delete
our cookie.
So I got to go back over to the cookies tab.
I'm going to delete the cookie.
Associate with ticketing dot dev and then I will make the request to get the current user.
Once again.
So now we did not include a cookie.
And so we get a current user of no OK.
Well this looks pretty good.
So we now have a route to figure out whether or not the user is signed into the application.
We are going to very quickly have to come back over here and start to refactor some stuff.
I know it's kind of unfortunate.
We do want to eventually have a middleware that's going to automatically try to figure out whether or
not the user is logged in for us to limit access to some routes and also to just take some information
about the user and throw it onto the request object.
But those are two middleware so we're going to put together a little bit later and then kind of use
to spruce up this file a little bit.
We did have to go to this process just to understand that yeah we gonna check to see if there's the
chase on a Web token.
We got to decode the JWT and so on.
So quick pause right here.
We're gonna take care of handling these sign outs process in the next video.