Narrator: So, we're currently in the process
of putting some finishing touches on our API,
and one of the things that we need to do now
is to fix some of the authentication
and authorization in all our resources.
And we're gonna start here with our tour resource.
And since all the authentication
and authorization stuff is always defined
on the route declarations,
well, we're gonna work here on the tour routes file.
So, this tour API that we have here
is basically what we want to expose to the world.
So for example, we might want to allow
other travel sites to embed our tours
into their own website.
And so that's what this API is basically for.
And so therefore, we will not have any authorization
on get tour requests.
Right?
And so we should actually get rid of the one
that we have currently.
Right?
So, this one.
So on getting all the tours,
right now we have to protect it,
and so only authenticated users can use that.
Okay?
But again, that doesn't make much sense,
because you want to expose this part
of the API to everyone.
So, let's get rid of that.
However, the actions of creating or editing tours,
we only want to allow lead guides
and administrators to perform these actions.
So of course, no normal users,
and also no normal guides.
So, just admins and lead guides.
And so let's put that here actually.
Authcontroller.protect,
and authcontroller.restrictto.
Admin,
and lead guide.
Give it a save here,
and that looks just fine.
And next up we want to do the same with editing.
Right?
So we already did that actually in the leading,
and so let's just copy what we have here to patch as well.
Give it a save, and now that actually looks perfect.
Okay?
So everything else,
even getting just one single tour here,
is of course free to everyone, okay?
And the same goes for getting the top tours,
and also getting the tour statistics.
Now here, about the get monthly plan,
well we also might want to restrict that.
Only, for example, to everyone except normal users.
Okay?
So that's copy this one here as well,
give it a save, and then also add the normal guides.
Alright?
And so, that looks perfect at this point, I think.
Okay?
So basically, our tour router is now completed.
Perfect.
And I'm not going to test all of this
because we already know that it works.
Alright?
So, let's close this one
and move straight to the next one.
So, these first routes here
are of course open to everyone.
So, signing up, logging in,
forget password, and reset password.
For none of these you need to be logged in.
Right?
But, you need to be logged in
so to be authenticated to update your password,
to get your own information,
to update or to delete your own account,
and really for all these other operations
here as well.
So we don't want the public to basically get information
about all the users.
We also don't want anyone to delete users,
or to update users, and really none of these
operations here should be free for the public.
Okay?
So for all of these routes here,
starting from this point,
you will always have to be authenticated.
Alright?
And so, we could now go ahead and add
this authcontroller.protect to all of these routes,
but actually we can do better than that, right?
So in order to do that,
let's keep in mind that this protect function here
is really just a middleware.
And also remember that middleware
runs always in sequence, right?
Now with this router that we have here,
that we created in the beginning,
is kind of like a mini application.
Remember that?
And so just like with the regular app
we can use middleware on this router as well.
Okay?
And so, we can do something like this.
Router.use,
and now authcontroller.protect,
and that's it.
And what this will do
is to basically protect all the routes
that come after this point.
Okay?
And again, that's because middleware
runs in sequence.
And so after these four middleware functions,
because remember that technically
this is still also middleware,
then the next middleware in the stack is this protect.
And this will then only call the next middleware
if the user is authenticated.
And the next middleware in this case is this patch here.
Okay?
And so, again, what this is means
is that all of this routes
to all these middlewares, technically,
that come after this one are now protected.
And so, we can go ahead and remove this protect
from all of them.
Okay?
And just to prove you that this now still works,
let's just go ahead and get the me information.
So basically the current user.
So if I now run this,
you'll see that it still works.
And if I take away the authentication,
then it says we are not logged in.
And so that's exactly what that protect middleware does.
Right?
So, it's now going to be back to working.
So, perfect!
That's a nice little trick in order to protect
all of the routes at the same time,
typically by using a middleware
that comes before all these other routes.
Okay?
And for example, if we now move this
a little bit up, like this for example,
then we would also need to be logged in
in order to use forgot password.
Right?
So, let me just prove that to you.
Okay?
And so usually, of course, we do not need to be logged in
in order to forget our password,
because that wouldn't make any sense, right?
But right now, since we move that middleware
a bit up, it says "you are not logged in".
Okay?
And so really, that proves that this authcontroller here
is doing it's job.
So, protect all routes --
after this middleware.
Okay.
Now also remember how we said that
all of these actions here should only be executed
by administrators,
and so now we can actually use the exact same technique
that we used up here to protect all of these routes.
So, router.use,
authcontroller.restrictto,
admin.
Okay?
And so now, only admins will be able to get all users,
to create new users, to get users again,
and to patch and delete users.
Alright?
And so from this point on,
all the routes are not only protected,
but also restricted only to the admin.
But of course, the ones that come before everyone
who is logged in can access them, okay?
So let me just prove that to you.
So, I'm going to log in, not with admin,
but with testuser.
Okay?
And so we got logged in successfully,
now let's try to see all the users.
And now it says you are not logged in.
Well, we are actually logged in,
but we forgot to add the authorization here.
So, bearer token, send it again,
and now we see you don't have permission to perform.
But now, when we change this to the administrator,
so we log in as an admin now,
and now as we get all the users,
then of course it works.
So, perfect!
And that actually finishes the authentication
and authorization for these users as well.
But just to reflect that in Postman,
let's actually go back and so basically
put the authorization here, everywhere.
Okay?
And again, that's because later on
we're gonna create an API documentation
based on the collection that we created here.
And then, it's important that we actually mark
this one here as protected.
Save it.
Save this one as well.
And the same for update and delete user.
So, bearer token, save,
and the same for update.
Alright, and actually since we're doing that,
let's do the same with all the others.
So, not the reviews,
that one is for a bit later,
but really for the tours.
So here we no longer need any authentication,
so let's save that.
Forgetting we also don't need any authorization,
but for creating we now need the bearer token.
Okay?
Also for updating, and so it makes sense
to protect them here in Postman as well.
Now this one already had it,
because we actually used this one to test it
in the first place.
So this one did not have it, but the get monthly plan,
we protected this one as well.
Add the bearer token here as well,
and so I believe with this
we are really completed now, with these, too.
And so what we need to do to finish now this part
is here, fix the same thing on the reviews as well.
And the first thing that I want to do
is to basically protect all of the routes
which have to do with reviews.
So, we want no one who is not authenticated
to get, or to post, or to change, or delete any reviews.
Okay?
We say router.use,
authentication controller.protect.
Okay?
And so that means that from this point
no one can access any of this route
without being authenticated.
But we can remove this part here, okay?
And so now with authentication out of the way,
let's think about authorization.
So, first of all, only users should
be able to post reviews.
No guides, and also no administrators.
And so this part, we actually already have that here.
Okay?
Then, admins should be able to update
or to delete reviews, just like regular users,
of course, so that they can then edit
or delete their own reviews.
And finally, guides can not add, edit, or delete reviews.
Since the guides are the ones who are performing the job,
so it would be weird if they could post reviews
themselves, or edit other peoples' reviews, right?
And so let's put what we just described into code.
So, basically patch and delete
are restricted
to users,
or actually just user, and admin.
And then the same thing for deleting.
Okay?
And so you see that now guides and lead guides
have nothing to do at all with reviews.
All they can do is to really get reviews,
but not changing or posting them at all, okay?
And so, quickly now in Postman,
let's put that here as well.
So create new reviews already has the authorization,
get all reviews also needs it now.
So, with the bearer token, save that,
here, the bearer token as well.
Now write, and also get one single review.
Actually let's nicely order this as well,
so that all of them are kind of in the same order.
And now about these two here, they actually
are also protected.
Right?
Because ultimately it's the review handlers
that are actually called for both of them.
And so here we also need to add that bearer token.
Okay?
So now, basically, the only way of getting access
to data about reviews is to call all of the tours.
Right?
At least for people that are not authenticated.
Okay?
So, let's close all of this,
and so I think we're now good to go,
and we actually finished this part as well.
Let's just clean it up here a little bit.
And yeah, I think that's it.
So with this we actually finished the authentication
and authorization parts of all our three resources,
so we're really close to finishing our API here.
There's only a small amount of things left to do,
and so we're going to do all of that
in the rest of this section.