1
00:00:02,110 --> 00:00:08,110
So we worked a lot on the products and I hope it's now clearer how you can do these basic crud operations

2
00:00:08,470 --> 00:00:12,820
from within a driver with your connected mongo database.

3
00:00:12,820 --> 00:00:18,130
Now let me also talk a bit about authentication and users because you might note that there is a logout

4
00:00:18,190 --> 00:00:18,580
button

5
00:00:18,610 --> 00:00:19,900
and actually if we click it,

6
00:00:20,160 --> 00:00:22,160
well then we can sign up or log in.

7
00:00:22,180 --> 00:00:28,010
Now important, this authentication here is totally related to my app,

8
00:00:28,060 --> 00:00:31,130
I want users to be able to sign into my store,

9
00:00:31,210 --> 00:00:35,260
this is not related to the mongo database at all,

10
00:00:35,260 --> 00:00:37,440
this is really important to understand.

11
00:00:37,480 --> 00:00:40,490
People will not log into my database here,

12
00:00:40,600 --> 00:00:42,760
they can't enter the credentials

13
00:00:42,760 --> 00:00:44,560
we set up on the cluster.

14
00:00:44,560 --> 00:00:49,170
So what we configured here for the users, we're not talking about these users at all,

15
00:00:49,330 --> 00:00:55,510
our app will not create users here or use these users for signing in. These are the users, the clients

16
00:00:55,720 --> 00:01:02,320
connecting to our database and in our case, our client that connects is our node backend, not the react

17
00:01:02,320 --> 00:01:05,620
frontend and certainly not the users of our app.

18
00:01:05,710 --> 00:01:10,700
I just want some users in my app and therefore, I will store the user data in my database

19
00:01:10,900 --> 00:01:12,990
but they will not be able to access the database,

20
00:01:13,000 --> 00:01:15,640
that is really important to understand.

21
00:01:15,670 --> 00:01:21,850
Now with that, I can go into the auth.js file, the routes and there, I already have some code in place

22
00:01:22,060 --> 00:01:29,170
for signing users up and for logging users in. Now for signing users up which is a sensible thing to start

23
00:01:29,170 --> 00:01:29,710
with, I

24
00:01:29,800 --> 00:01:35,820
of course also want to connect to my mongo database, then use a different collection, may be named users

25
00:01:36,370 --> 00:01:41,190
and there, the user data should be stored, the email and the password.

26
00:01:41,230 --> 00:01:44,280
Now the password will also be hashed first,

27
00:01:44,320 --> 00:01:50,140
I already have some logic in place which takes the password and hashes it. This is the encryption at rest

28
00:01:50,290 --> 00:01:56,040
or a part of it, the part where we do encrypt some data on our own 

29
00:01:56,170 --> 00:02:03,040
so that even if our database gets compromised, the passwords are not stored as plain text there.

30
00:02:03,040 --> 00:02:07,460
So inside of here, I now have my stored, my hash password here

31
00:02:07,660 --> 00:02:13,080
and I can store it to mongodb along with the email and that is exactly what we will do now

32
00:02:13,180 --> 00:02:18,400
and of course as always, feel free to pause the video and try writing this code on your own because in the end

33
00:02:18,490 --> 00:02:21,290
you'll just insert a document here, nothing more.

34
00:02:22,860 --> 00:02:24,160
Now let's do it together.

35
00:02:24,540 --> 00:02:30,770
First of all, I'll import my db helper by requiring it from the db.js file,

36
00:02:31,050 --> 00:02:40,470
the same I did in products.js and then here where I have my hash password, I will call getDb then

37
00:02:40,470 --> 00:02:41,530
call db,

38
00:02:41,670 --> 00:02:47,790
so get access to the database itself and call collection to get access to a collection and I will get

39
00:02:47,790 --> 00:02:52,710
access to the users collection which will be created dynamically if it doesn't exist yet.

40
00:02:52,740 --> 00:03:00,990
Now there I simply want to insert one new element and that one new element here will simply be my user

41
00:03:00,990 --> 00:03:01,960
data.

42
00:03:02,010 --> 00:03:04,930
So there I will store my email,

43
00:03:05,100 --> 00:03:10,260
so I'll name that key e-mail, you could name it however you want and I'll take the e-mail value which I

44
00:03:10,350 --> 00:03:11,520
extract up there

45
00:03:12,860 --> 00:03:18,520
and then, I will also add password where I take the hashed pw value,

46
00:03:18,590 --> 00:03:23,990
so the hashed pw value is something I get here from that hashing package which does the hashing for

47
00:03:23,990 --> 00:03:26,000
me, so I'll store that too.

48
00:03:26,390 --> 00:03:33,440
So this will insert a document and I will then add a then block to do something once this insertion

49
00:03:33,470 --> 00:03:34,700
completed.

50
00:03:34,700 --> 00:03:41,510
Now in the error case, I'll copy the code from this catch block which is related to catching errors during

51
00:03:41,510 --> 00:03:43,430
the password hashing process,

52
00:03:43,430 --> 00:03:50,030
now this catch block here is related to catching errors related to inserting the document into the database

53
00:03:50,540 --> 00:03:52,790
or here, I succeed,

54
00:03:52,820 --> 00:03:57,480
so here I should successfully add my user to the database.

55
00:03:57,590 --> 00:04:04,100
So let's maybe console log the result here and then here, I will use a token based authentication approach

56
00:04:04,490 --> 00:04:10,220
which means I'll create a token which I return to my client side app, to the react app which then could

57
00:04:10,220 --> 00:04:16,370
theoretically handle that token to authenticate itself to my backend for future requests and this is

58
00:04:16,370 --> 00:04:18,130
a bit beyond the scope of this course,

59
00:04:18,260 --> 00:04:23,230
if you want to learn more about this, check out my upcoming or already released

60
00:04:23,270 --> 00:04:25,360
nodejs course where I will cover this

61
00:04:25,580 --> 00:04:32,980
and also a free series on my YouTube channel or on my website, academind.com, we build a node restful 

62
00:04:32,990 --> 00:04:37,610
API there and there, I also have this authentication process in there,

63
00:04:37,640 --> 00:04:41,370
you'll find a link to that in the last lecture of this module.

64
00:04:41,420 --> 00:04:50,680
So here in the result, in the then block basically, I know that we inserted our document, our user,

65
00:04:50,900 --> 00:04:53,530
so in that case I will send

66
00:04:53,540 --> 00:04:56,970
this success response and I will create that token,

67
00:04:57,040 --> 00:05:00,480
so let's copy that here.

68
00:05:01,960 --> 00:05:09,990
Now create token as a side note is this function which just creates so called json web token

69
00:05:10,000 --> 00:05:15,460
and again this is the part you can learn more about in my node course or in the free series, 

70
00:05:15,730 --> 00:05:24,980
so I just return that token here then and I can also return the email of which this was created on the

71
00:05:24,980 --> 00:05:27,070
user object.

72
00:05:27,110 --> 00:05:33,880
So now we have all the code in place we need to create a new user entry in the database hopefully,

73
00:05:34,280 --> 00:05:35,790
so let's give this a try.

74
00:05:36,110 --> 00:05:37,700
Let's save that file

75
00:05:38,500 --> 00:05:44,070
and restart our backend server and then here on the frontend,

76
00:05:44,310 --> 00:05:53,620
I switch to sign up and I'll enter some dummy email address and some password and actually, I can tell

77
00:05:53,620 --> 00:05:57,230
you that I will enter tester here as a password

78
00:05:58,050 --> 00:05:59,430
and then click sign up.

79
00:05:59,430 --> 00:06:07,330
Now this seems to work and on the backend here, I see a log with some data about the operation,

80
00:06:07,350 --> 00:06:09,830
one document was inserted, this is the ID

81
00:06:09,990 --> 00:06:12,130
and this is the document which was inserted

82
00:06:12,320 --> 00:06:18,400
and we can also confirm this in the shell by accessing users and finding all users

83
00:06:18,510 --> 00:06:23,640
and there you also that encrypted password, that is not the password I inserted but the encrypted

84
00:06:23,640 --> 00:06:24,150
form,

85
00:06:24,210 --> 00:06:26,040
so that is that encryption in place

86
00:06:27,350 --> 00:06:30,670
and that is our own encryption in place here I should say.

87
00:06:30,790 --> 00:06:33,360
So this insertion works,

88
00:06:33,390 --> 00:06:34,740
now we do have an issue

89
00:06:34,980 --> 00:06:43,770
if I do enter that same data again. The same password is ok but the same user is not that great because

90
00:06:43,800 --> 00:06:49,940
now if I check my users collection, you actually see the same e-mail in there twice and

91
00:06:49,980 --> 00:06:52,430
that is not something you want typically.

92
00:06:52,440 --> 00:06:58,410
So in the next lecture, let me show you how we can fix this and how we can ensure that email is unique

93
00:06:58,410 --> 00:07:00,700
and maybe you also already know this solution.