In this video we're going to finish converting our user routes to use authentication down below.
There are a couple of important routes that aren't using authentication such as the ability to update
a user profile or delete a given user.
We want to make sure we're using authentication for these as well.
Now it might not seem like it but we're actually nearing the end of the section in this video.
We're gonna take care of all of the user routes and then in the next couple we'll focus on the task
related routes and setting up that association where each task is owned by a specific user.
For now though we're gonna focus on the last three routes in this file deleting a user by I.D. updating
a user by I.D. and then getting a user by I.D..
Now this first one is actually not something we need anymore.
We should not be able to get a user by I.D. unless it's our own user I.D. In which case we already have
a route that gets that done up above.
This is how we can fetch our own user profile.
I shouldn't be able to fetch the user profile of other users for the application so we have three routes
that need fixing and we're gonna take the easy way out with the first one and end up removing it altogether.
Now the other two are things we still want to be able to do.
Users should be able to update their profile and they should be able to remove their profile altogether.
So with these we'll do a bit of refactoring integrating authentication and then wiring it up to work
correctly.
We'll start with delete together and then we'll focus on update afterwords and right here the first
thing we're gonna do is add the off middleware into the mix.
So I'll be passing in off as the second argument moving our callback function to the third argument
position meaning that this is only going to run if the user is authenticated from here we want to adjust
the path this is taking in the I.D. of the user to remove.
And even if you're authenticated we don't want you to be able to provide the I.D. of the user to remove.
Instead we're going to remove you.
You should not be able to provide the idea of another user to delete them either accidentally or maliciously.
So right here the path will change to forward slash users forward slash me as a way to remove your own
user profile.
Now this means we will have to make a small change to the code down below.
We have request dot parameter dot I.D. which no longer exists.
The I.D. We're going to use instead is request dot user dot underscore I.D..
Remember we attached the user onto the request object and we do have access to it since we are using
the authentication middleware.
If we weren't using this middleware then we wouldn't have requested a user but we are.
So we do.
And there we go.
This is all we need to do to allow a logged in user to delete their own profile.
Now we could change things up even further.
In this case there's no need to check if there was a user with that I.D..
Since we literally just fetched them from the database when authenticating so let's go ahead and refactor
out these lines right here I'm gonna go ahead and comment them out using command forward slash or control
forward slash depending on your operating system and we're going to replace all of that with a single
statement down below.
Right here we're gonna be using the remove method on the Mongoose document.
So we have save for saving the data that we've changed and we've used that plenty of times before but
we also have on user the following remove.
Now this is indeed a synchronous.
So I'll use a weight with it.
So all we're doing here is removing the user whose authenticated it achieves the exact same result as
what we had above.
But in my opinion it's a nicer setup down below.
The last thing we have to change is what exactly we're sending back.
We no longer have a standalone user variable.
Instead we have request dot user and there we go.
Now we have the final version of this end point and we can test it out from postman so I'm gonna head
over to postman and go to my delete user request near the bottom.
Now this still has the old you are L structure so the first thing I'm gonna do is remove the I.D. and
replace it with me.
So forward slash users forward slash me.
I'll go ahead and save that request to make sure that we use the same you are structure in the future
and there's no need to worry about authentication since it's inheriting that from the parent.
Now we can actually fire this off and see what we get down below I get a two hundred.
Meaning that things went well and right here I can see the pro file of the user that was deleted.
If I send this off again I would expect things to fail since I've completely trashed that user account
and they're no longer in the database now because we've set up postman automation we can get back up
and running with a single request I create a new user using the create user request I'm now logged in
as them and I can continue experimenting with my other routes such as reading a profile.
So being able to work with postman and easily switch between requests is gonna be really important in
the long run with deleting user out of the way.
Let's go ahead and focus on the other route.
We need to take care of the ability to update the user profile so we'll end up making a similar set
of changes restricting it to the user who is authenticated as opposed to allowing you to update any
user if you know their I.D..
That's not what we want for our application.
You should only be able to update your own user profile when you're authenticated correctly.
Right here.
This is going to be your challenge for the video.
You'll be refactoring the update profile route shown below.
So first up we want to change that you are El structure.
We no longer want to accept an I.D. as part of that.
Next up we want to add the authentication middleware into the mix.
You should only be able to update a user profile if you are authenticated.
From there you're going to use the existing user document instead of fetching a new one by the parameter
provided we're no longer going to have that parameter and there's no longer a need to fetch the user
since we already have access to them on request.
So you'll use that instead throughout the entire function.
Any time we use user you'll have to use request not user instead.
Next up you want to test your work and postman so tried to update a user profile and make sure it works
as expected.
Take as much time as you need it to knock this out test your work when you're done come back and click
play
how'd you do.
Let's go ahead and kick things off with step number one.
We need to update that you are real.
No longer are we going to accept an I.D. instead it'll be forward slash users forward slash me for updating
your own profile.
Next up we have to add authentication into the mix to know which user we're actually going to update
since we're no longer accepting their I.D. as a U RL parameter.
Right here to get that done we just pass in the off middleware as the second argument moving our callback
to the third argument position.
Next up we have to make changes to the callback function code and we want to use the existing user document
on a request not user.
Instead of fetching a new one down below.
Now I can highlight user by just clicking anywhere inside of it to see all of the times we've used it.
Right here there are a few different use cases of it.
So we have to make sure we address all of those in order to complete step 3 successfully.
Everything up above can stay exactly as it is.
That's perfectly fine.
We're gonna start by removing this line right here.
We know need.
We no longer need to fetch the user by that parameter.
Instead we're just going to access request down user which already exists.
So right here we are setting properties on user that doesn't exist anymore.
Instead it is request that user down below we try to save the user.
It needs to be request dot user dot save.
From here we run a little code to figure out if the user actually existed.
We know they existed.
So this can be removed completely and we know they existed because they just logged in about 10 milliseconds
ago.
So from here we can now continue on down the list.
The last thing we do is we send that user back request Dot.
User is what we're going to send back.
And now that we have this in place our patch route is actually all done.
We can move on to the final step which is to test our work over inside of postmen right here.
I'll be removing the challenge comments which I have in place and we'll move over to post man and try
to update a user profile.
So right here if I read the user profile I can see the current information.
Let's go ahead and actually change that using update.
User down below.
Now once again I do have to remove the I.D. from the U.R.L. and swap that out with forward slash users
forward slash me instead.
And now I can use the body to determine what exactly I'd like to change.
Let's go ahead and provide some changes we'd like to apply.
I'll start by changing the age I'll go ahead and set that equal to twenty seven.
I think it's zero right now.
Let me double check.
Yes it is.
And I'll also change the name.
So right here I can go back to update user I'll update that name to the following.
Let's go ahead and use something like Mike.
And finally I'll also update the password.
I'll change the password over to something new.
Let's go ahead and use computer 0 9 8.
Perfect.
Now that we have this in place I'm going to fire the request off to task that things worked as expected
down below.
I do see the name of Mike and the age of twenty seven.
The only thing I'm not sure about is if the password got changed correctly.
So let's go ahead and try to log in once again.
I'm gonna take the password and copy it to the clipboard.
Though you could just memorize it.
We're gonna head over to the log in user request and this should now fail.
Since I've updated the password right here it is indeed failing which is excellent.
Now I'm going to take the old password remove it and put the new password in.
I'm going to send that off.
And once again it works.
So down below I can see I was able to log in with the new password and without the old one letting us
know that the update worked as expected.
So down below for that update user request I am going to go ahead and save it so we can use these settings
going forward.
Now I just change the password for logging in in order to make sure things work consistently.
I'll also change the password for creating the user though I could have just reverted the log in request
to using the same password I had used before.
As long as those two are consistent it'll be easy to switch back and forth.
Now that we have this in place all of the rounds in the user file are using authentication and they're
locked down in a way where a user can only manipulate their own profile.
They can't go off and mess with other users that are using the task manager application.
Now with the user routes out of the way it's time to focus on something we haven't touched on so far.
This section are task related routes.
We're going to start that process in the next lesson.
So let's go ahead and jump right in.