In this video you're going to add a new route that allows users to log out of the application so they
have the ability to log in and generate a new authentication token.
And we have code in place to actually verify the authentication tokens.
And now it's time to figure out how these can get removed when the user is done to do this we will.
As I mentioned just be setting up a single new route over in the user router.
And I'm going to add it just below.
Sign up and log in right here.
We're going to set up a third route related to authentication that will allow a user to log out right
here.
That'll be router dot post and we're going to set up the following You are all forward slash users forward
slash log out.
Now this particular endpoint is gonna require authentication.
You have to be authenticated in order to log out and then we'll set up our callback function.
The root handler and I'll set it up as an async function where we get access to the request and the
response.
Now inside of here what we want to have access to is the particular token that they used when authenticating.
Remember if I have five different sessions where I'm logged in such as for my personal computer or my
phone and my work computer and I log out of one I don't want to log out of everything.
So I want to target these specific token that was used when they authenticated right here.
Now to get that done all we're going to do is make a one line change two off dot J S we are adding the
user onto the request so it can be accessed later.
Right here we're just going to add to the token on as well so request dot token is going to equal the
token that was used right here in the variable above.
Now once we save the program the other route handlers will have access to that token.
And right here we can use it to delete it correctly off of that user profile.
Now the first thing we're going to do as always is set up a tri catch statement.
And once we have that in place we can focus on actually removing a given item from that tokens array
and to do this we'll use the array filter method which we've used before.
Now the nice thing here is that since we were authenticated we already have access to the user data.
There's no need to fetch it again because right here request dot user is the user which means that all
I'm going to do is change request dot user dot tokens.
Then I'll use the same method to save my changes.
Now right here we're going to set the tokens array equal to a filtered version of itself.
So request dot user dot tokens dot filter and we'll provide our callback function.
Now right here we get access to the individual token.
Now remember that is the object that has a token property and the underscore I.D. property and down
below we can figure out what exactly we want to do.
And right here all we're going to do is return true when the token that we're currently looking at isn't
the one that was used for authentication.
So right here I'm going to return we'll look at the current token we are iterating over.
Remember that's an object with the token property.
So it's token dot token and we're going to check when it's not equal to the one that was used.
That is request dot token if they're not equal we're going to return true.
Keeping it in the tokens array if they are equal it will end up returning false filtering it out and
removing it.
Now nothing is going to get saved until we actually call save.
So right here I will use a wait with request dot user dot save and then we can worry about sending that
response back if things went well over going to do is send back a two hundred using response dot send.
If things didn't go well then we'll go ahead and send back a 500 response dot status.
Five hundred and right here using send to send that off now that we have this in place.
Users have the ability to log out.
Let's go ahead and save our work and make sure it's actually functioning as expected.
We're also going to set up a new request over in that task app collection so we can fire this off as
often as we need to.
So right here in post man we're going to add a new request to the task at collection right here I'm
going to call this one log out user.
I'll go ahead and save that to the collection and it's showing up down below.
I'm going to drag that up above.
Keeping it organized with my other routes related to authentication.
And then once I have that in place we can open it up and focus on actually customizing it.
Now here I want to use the post H TTP method and I do want to use my environment variable which we ended
up setting up in the last video.
Then it was forward slash users forward slash log out.
Now for this one I do need to be logged in and under authorization.
I already have inherent off from parent showing up so there's no need to change anything.
This request is actually done.
So what I'm going to do is save it.
And before I fire it off I'm going to make sure this token is working.
So over here I'll run read profile and make sure I can actually get the profile and then I'll log out
and try to do this again.
So over in the log out request all I'm going to do is fire it off as is I get my two hundred which is
a great sign.
And to verify that things are working I'll try to authenticate with that token once again over here
getting the user's profile.
I fire that off and what do I get.
I get a four a one unauthorized and down below I have my error message coming from off the DOT J S telling
me to please authenticate.
So there we go.
Once we have that off the middleware in place we can customize our other routes without a heck of a
lot of work.
Here we were able to create that log out route pretty easily since we already had access to the token
on request dot token.
And we already had access to the user on request not user.
All we had to do was alter the array and save things sending the response back.
Now what if you wanted to create a variation of this route that allows you to log out of all sessions
so you can see services like Netflix and Gmail that allow you to do this.
So I have my Netflix account and I give it out to a bunch of friends.
I'm sick of having to share the account so I log out of all sessions to kick them all out and I change
the password.
We can do the same thing here allowing a given user to log out wiping all of the tokens instead of just
the one they're actually using.
And down below right here that's going to be your challenge for the video.
So your goal is to create a way with a new route to log out of all sessions.
You're going to set it up as the following post forward slash users forward slash log out all.
Then you're going to set up the root handler to wipe the tokens array completely.
You'll send back a two hundred if it went well or a five hundred if it went poorly.
And finally you'll test your work so log in as a user five or six times.
Make sure you have a few tokens in that tokens array.
Use a log out all and they should all be gone.
You can check the database to make sure all of the tokens have been wiped.
Take some time to knock that out test your work and when you're done come back and click play
how'd that go.
I'll kick things off.
Just up above.
By setting up a call to Router dot post the following You are all forward slash users forward slash
log out all and this one is going to require authentication once again and then we'll set up our async
function right here.
Request and response.
Setting up the arrow function body.
Now we have to fill out the actual root handler itself.
And right here we'll start by using try catch as we've always done and then we'll move on to the actual
task of wiping the tokens array.
Now up above we had to use filter to filter out specific tokens while leaving others in place about
to wipe everything.
All we do is set request dot user dot tokens equal to an empty array.
Then we can go ahead and save those changes.
So I will await request dot user dot save.
And that's it.
Now we can just send back the appropriate response.
I'll use response dot send to send back a two hundred if things went well and down below response dot
status to send back a five hundred.
If the catch block runs and there we go that's all it takes to create a new route handler for supporting
the ability to log out of all sessions.
Now down below we need to test our work.
So what I'm gonna do is remove those challenge comments and save the user router over inside of postmen.
We'll go through the process of creating this new request.
Right here I have log out user if I click the menu to the side of it I can actually duplicate this and
then I can create a new request which I'll rename right here.
I'm going to go ahead and call that log out all or something similar.
And don't we need to do is change the path up above to log out all and we can save it.
Perfect.
So now we want to make sure we have a couple of authentication tokens in place.
What I'm going to do is log in a few times.
So right here I'll go ahead and log in a log in once twice and a third time.
And before I actually use log out all I'll head over to the database and make sure they're all showing
up over in robo 3D.
I have my users collection which I'll take a moment to refresh and one of these users should have a
bunch of tokens.
They only have one.
There we go.
The first one who has seven authentication tokens.
So we're going to go ahead and log out all and make sure all of those go away.
I'll switch back over to post man via this request.
Off we get our two hundred and now we'll go back over to robo three TI and refresh the data.
If I expand that first user again what do I see.
I see zero tokens in the tokens array which is fantastic.
So now users have a log out ability for individual sessions or for all of them.
And now users can perform all of the steps in the authentication process.
They can sign up.
They can log in.
They can use their log in token and they can log out from here.
We're going to continue adding more features to the application in the next video.
We're going to learn how we can hide additional data that's getting sent back.
Things like the user password and user tokens which we never want to send back to the client even if
that client is authenticated.
All right.
Let's jump right in to the next one.