Great with our front and ready let's cover some general concepts regarding strappy and authentication.
We need to understand that product was the content type that we created ourselves.
Correct.
How old are users comes straight out of the box and the way it works is we can set up our roles permissions
for authenticated users.
Remember when we had rules and permissions we had two of them.
We had a public one so anyone can access.
But even that was initially restricted.
Remember we had to specifically say that the public can do fine as well as find one but you can also
set it up where if let's say you have authenticated users you could set up a different permissions.
In our case eventually we're going to have the waters and only the authenticated users can create a
order so public cannot just willy nilly start ordering stuff.
So you need to register first and only then you can make your order.
But please keep in mind you can also do the same thing with other content types where let's say you
would say you not only authenticated users can see my blog.
So in that case the API is restricted by default.
Remember public wouldn't be able to see it at all and only let's say a registry user can see that particular
content.
Now we could technically have users ourselves because we are admin so an honest.
We have had new user.
So we can just keep on adding the content and the fields that they're looking for his user name email
as well as deep password.
Now eventually we're going to set this up of course from the front end because what's going to happen
is that we're gonna have our form.
The user is going to fill out the form and then we're going to perform a CTP POST request.
That way we're going to create a user from our front end and of course since we're admin We can delete
that user or we can do whatever we want.
Just please keep in mind you could technically set up here everything from the admin.
You could set up the user and then that particular user could in fact log in.
Now if you're interested in more of what we're going to be doing if we're going to head over to documentation
then we'll look for users and permissions.
The way it works the way they restrict the access is if you're let's say setting up some kind of request.
So let's imagine that if I would have some kind of blog post and back and strappy I would say you know
what rules and permissions and authenticated let's say I'm going to use the blog post example but of
course since I have product I'm going to say that only authenticated users can find those particular
blog posts.
Now in our case of course we said the public can find it as well.
But let's imagine that scenario we have different content type and only the user can see that content.
How we would be able to access well when we set up our front end instead of just setting up a simple
get request like we did we would need to pass in the token.
And you're wondering OK so what on earth is it talking.
Well it's the one we're going to register or when we're going to sign in.
What's going to happen is first of all we're going to perform a post request and this is gonna be again
the URL.
Please keep in mind once again we deploy our application.
That's when the domain is gonna change.
That's why we use that you are all variable because again I don't like hopping or on my application
and then the URL pull passed is off local and register so that would be for register if the register
is successful we are going to get back our token.
So once we get back our token then if we need to set up some kind of request with our not get request
or in our case or orders by the way we're going to have a postal request then we're just going to attach
that token so that we're strapping gnomes.
Okay.
If you have the token awesome you can either view the content you can.
I don't know update the content delete the content whatever create the content.
If you don't have that token sorry there's nothing we can do.
You're not authorized to perform that particular action.
And what's interesting is that we get that token when we register as well as we log in.
So what's gonna happen in our application.
The moment we register we write away again and get the token then on our front end we're going to use
the fact that if we have the token then we're going to display a different link.
Then we're also gonna show the check out page and all that but the general idea is very simple we're
straight out of the box we'll get the users with strappy and weakens and restrict the permissions.
We can say you know what this content type.
I only want users to even see it.
They can't do anything else but they can see it public by default.
They're not going to be able to access your content and in order to make this work we're going to need
to register and we're going to need to get our token.
So if our request was successful for registering or logging in then we're gonna get back our token.
We're going to save it in a local storage and that way if we need to set up some kind of request where
the user needs to be authorized again.
In our example that's going to be later on making worse but you can set up however you'd want.
You can again restrict the access for any content type you'd want.
Then we're gonna have to pass it in.
Then we're gonna have to say All right so we're making a get or post or any kind of request and we're
gonna also have to attach the headers.
And then within the headers we're going to have to attach our token.
And only then we're gonna be able to get our data.