All right welcome to the final installment of this authentication code along all that we have left to
do is to add in the log out functionality and then also we're going to add in a middleware called is
logged in to check if the user is locked in or not.
So we'll get to that in time.
Let's start with log out so log out is much simpler than log in or register.
We don't need to have two routes.
We don't need a form.
All that we want is a simple link and when we click on that link it should sign out or log out the current
user.
So let's start with the link.
I'll go to the home page to begin an ad in a link to slash log out which doesn't exist and we'll just
say log out.
And let's also add in a link to log in since we haven't done that yet slash log in.
And now let's copy this and let's put it on all the templates just so we have those three links on every
page.
OK.
Now let's go back to our address and we need to handle the log out route.
So we need to add in and after that get slash log out and we can start nice and simple by just sending
something back.
RAZ And.
OK.
I will log you out.
Not yet and save.
And we should see this when we click on that link.
Let's start our server.
Let's try and log out now refresh the page and it doesn't matter if for long been or not we click log
out.
We get that response which is what we want.
Now what we need to do is actually log the user out which is really simple using Passport.
It's a simple line request that log out that's all we need to do.
And remember when we lock someone out we're not actually changing anything in the database.
There's no transaction there.
What's happening is that passport is destroying all the user data in the session.
It's no longer keeping track of this user's data in the session from request to request.
So if we save and then we also want something to happen at the end like a redirect.
So let's redirect to the home page.
This redirect to slash.
Once you've been logged out OK let's restart the server and just give it a shot.
So I'll refresh I'll start by logging in and I'll log in as Colt with the account I created with my
password as password.
I log in I get to the secret page.
Now let's click log out and it takes him back to the home page and that's it.
So log it's pretty simple.
We don't need any of the forms.
It's a single route slash log out and all that we do every time is request out log out.
And that takes care of everything for us.
That's coming from passport in the unit where we create our log in from scratch.
We'll actually be writing the method log out.
We'll be writing authenticate.
We'll be writing register.
But for now passport makes it super easy for us.
We do have a problem though which is that even though I'm logged out I just quit to log out.
I can still go to slash secret.
There's nothing stopping me from getting there.
So our code right now sends us to slash secret when we sign up.
And when we'd like again but I can still go there even if I'm not signed in.
Log out and I can still go to slash secret to fix that.
We need to add in a middleware in what we want to do is on this secret route before we do anything.
We're going to check if the user is logged in or not if the user is logged in.
Then will render this template if the user is not logged in then will redirect them to slash logon.
And the way that we do that is by writing a middleware.
So we're going to define a function down at the bottom here and this function is going to be called
is logged in.
And it takes three parameters request response and next.
And this is standard for middleware request refers to the request object.
Response is the response object.
And next is actually the next thing that needs to be called.
And we don't have to set any of this up just by adding it in as a middleware which we'll do in just
a moment.
Express takes care of it and it knows what function to call next.
But we'll start by defining the functionality here.
So is logged in we're going to check if a request is authenticated which is something that comes with
passport as well make sure we spelled that right.
Is authenticated.
Then we're going to return next which is a little bit weird looking.
And then I'll come back to that.
Otherwise what we'll do and we don't need an else because we're returning here.
So what we'll do is redstart redirect to the log in form slash log in and then we'll add this as a middleware
is logged in to our slash secret route which is right here.
And it's really simple we just have to add is logged in right here.
And then a comma.
So what this will do is when a request comes in a GET request to slash secret it's going to run this
before it does anything else.
It's going to run is logged in which she'll do this.
It's going to check is the request authenticated if it is return next and run next.
That's what the parentheses here are.
And next it's just going to refer to this right here.
So before we render secret we want to check if the users logged in.
Again that's what we're doing.
If the user logged in.
Basically keep going.
Move along you're fine.
Otherwise if the user is not authenticated then we have a problem and we're going to redirect you back
to slash log in.
And this other code will never run.
So if we redirect inside of is logged in we're done.
And this doesn't happen.
OK let's save restart the server.
Make sure we don't have any syntax errors.
Let's go back and let's start on the root page.
Make sure I'm not logged in and now I'll try and go to slash secret and it takes me to slash log in
automatically.
See that.
Now it's loggin colt with my password.
You called the password log in.
Now I can go to the secret page.
Now let's go back to the root and try to go to secret again and it works because I'm logged in so I
can go back and forth.
I can go to whatever routes I want sign up and then go back to secret.
But then as soon as i log out and I try to go back to secret it doesn't work anymore.
Let's just double check that or sign up works.
Let's make a new account called Tator and password will also be password and let's submit that makes
us a new account.
I can now visit secret and then I can log out.
And that destroys the session and I can no longer go to secret.
All right.
So we've covered a lot in this series five different parts to create this user auth.
And this is even using those tools that I said would help us out.
It's definitely a bit of an undertaking but it's obviously worth it.
Most web apps really benefit from having in because as we'll see and Yelp camp our next video we'll
be able to add log in.
And it's not just to put stuff behind a loggin wall but we can actually associate data with a user.
Right now we just have the secrets page hidden unless you're logged in.
But no camp will actually associate specific comments with a user so that we can see who exactly made
a comment.
So before I sign off here let's go back and just do a quick recap of the most important part which is
our middleware so is logged in is a function we defined.
And we can define as many middleware as we want and they all take these three parameters the request
the response and the next function.
And then if things are fine if we want to move on to the next middleware we just call next.
Just like that.
And in our case if things are not fine if the request is not authenticated that returns false then we
short circuit and redirect to slash like it.
All right.
Hopefully you enjoy learning about user authentication.
I'll see you in the next video