In the last video we spoke about how we needed to make sure that user has at least one credit inside
their account before we allow them to create a survey.
So we're going to make a new middleware file in order to check to make sure that the user has the minimum
number of credits.
Now we are only doing this as a middleware because we might have additional routes in the future where
we want to secure it and make sure the user has some minimum number of credits so we could have just
as easily done all this logic that we're about to write inside of the request handler body right here.
I'm just thinking towards the future and thinking hey we might want to kind of reference the same code
at some point in the future.
OK let's get to it.
We're going to make a new file inside of our middleware directory.
So make a new file and I'm going to call it require credits.
Yes.
Then inside of here we're going to end up with the middleware that looks very very very much similar
to what we had done previously inside of require in.
So if we flip over or require log in I'm just going to select everything inside this file.
I'm going to copy it all.
I'm going to go back to require credits and then paste it like so.
OK.
So at present we've got this checkup here to say hey if you don't meet some requirements like if your
requests come in if there's something wrong with it we're going to kick you out early and we're not
going to let you go to the next middleware or wrap handler in the chain.
So we're going to keep the exact same structure here.
All we really have to do is update the statement up here and then update the error message as well.
So we'll say if the current user does not have greater than zero credits in the words if you have zero
or negative for some reason credits inside of our application we want to kick you out early.
So we're going to update the if statement.
Remember that the number of credits that the user has is contained within the user model.
So we can say rec user dot credits like so and we'll say if your number of credits is less than one
and the words you have one are less than one like zero or point five whatever it might be if you have
less than one credits.
We're going to boots you out early.
Now we will merely change the error message that gets sent back here from you must log in to say something
instead like you don't
you don't have enough.
You know let's do it very simple as a say not enough credits.
Very simple.
I was kind of hesitating there because I wanted to put in a contraction or I want to use a single quote
but the string overall is used in single quote and I was just thinking about it a little bit.
OK.
So now the status code for the response.
Remember the status quo that we sent back isn't really necessarily the most important thing in the world.
Really all we care about is making sure that it is in the 400 range a status code in the 400 range.
So like from 400 to 499 indicates to whoever made the request that they made some air in the request
or they did something wrong essentially.
So all we really care about indicating here is the status quo code is telling the user hey there's something
wrong with the request you just made.
So we have a 401.
Right here.
I do want to mention that in the actual HTP spec there actually is a status code that actually kind
of matches up with what we're trying to tell the user here.
So this is the W3 or documentation on all status codes.
If we look up in the 400 range.
So we're currently using 401.
On authorized to tell the user Hey you're not signed in for that other middleware.
Now if I'm the one that we are putting together right now they're actually kind of is a status Coode
that very much fits the bill here for two payment required.
And the words you have to pay us money to do what you're trying to do.
But this code is not actually in public use right now.
You could see very plainly it says reserved for future use.
So instead I think that we'll use a 403 forbidden to kind of indicate Hey you're not quite authorized
to do what you're trying to do here.
Not exactly.
You know not quite exactly in communicating the intent of what we're trying to say here but close enough
in lieu of the fact that we can't use for O2.
So we'll send back a status of four or three like so.
OK.
So that's all required credits middleware.
Again there's only one location site of our application where we want to do this check right now but
I can easily imagine at some point in the future having other routes where we need to make sure the
user has some minimum amount of money inside of their account.
So I'm not going to close the required credits middleware and the require loggin middleware.
I'm now back inside of our survey route's file and I'm going to require in and hook up the new middleware
that we've just created.
So I'll say Konst required credits is require up one directory middleware weares require credits like
some then we need to make sure that we wire up the middleware itself to the request handler.
Again remember we can put in as many middleware as we want to the request handler function.
The post function.
The only requirement is we need to make sure that we add them in as arguments in the order that we want
them to be executed.
So you can very easily imagine that we definitely want to make sure that the user is logged in before
we check the number of credits they have.
But we definitely want to do both of these checks before they get to the actual request handler body
which is the Aero function here.
So I think that right after checking to make sure that the user is logged in.
But right before we actually create the survey we can do this check to make sure that a user has the
minimum number of credits.
So I'm going to add in the required credits right here.
So I got a pretty long line of code here.
I'm going to zoom out for just a second so you can see the whole thing.
So in total we're saying if anyone makes a post request to API slash surveys first make sure that they
are logged in then make sure they have enough credits and then you can finally go ahead and create a
survey or do whatever logic you want to put inside of here.
OK.
So I think that's about it.
We're now ready to move onto the actual survey creation process inside of this request handler body.
So let's take care of that in the next section.
I'll see you in just a minute.