Next let's try logging in a log in as this time Potato Head password
then we'll try and edit this one and it works and we should be able to update this just fine so we can
try that out.
Let's get rid of the exclamation points.
Submit and it updates there's no punctuation at the end of grin at mine.
OK so we'll just apply it to update.
We don't want someone to be able to update something as well so it's not just about seeing the form
but it's about actually doing the updating we want to protect both of those and delete it.
Right now anyone can do it but as soon as I restart the server and I try refreshing.
Currently I'm not logged in if I click delete takes me back here as soon as I log in and remember that's
happening because of the redstart redirect back.
So then will do Taito head again.
Password log in.
Now if I try and delete this one it works just fine.
And now he's lost another precious campground and we're almost out of them to play with.
So that's our middle where we have it set up correctly now we have checked campground ownership which
checks the user logged in at all if they're not then just redirect back and eventually will have a different
error message so it will say something like You must be logged in first and then if they are logged
in.
But they don't own the campground then we'll have a different message that says you don't have permission
to do that or that's not yours to delete something like that and then the important line is the next
right here.
So if the campground author ID dot equals can't do Tripoli culture because we have to do Doddie course
because the the fact that this is a string and this is an object idea mongoose object so it's not comparable
to a string and thus to use the built in equals method that comes with monkeys.
Then we move on to next which is whatever code we have inside of the right handler.
So we run this if it works.
We run this.
Which is next.
Or in this case we run this.
Which is next.
And in the case of update we run this.
OK so we'll save.
We have one less thing that would be nice to do.
Which would be to hide these buttons.
If I'm not logged in I shouldn't be able to see an edit delete button.
Pretty much no web site out there that has this kind of authorization whatever show you that button
.
It's just a bad user experience if you think you can do something but you can't.
So we want to hide it and all we need to do is go to our template so that's the show template and inside
of here we need to find those two buttons right here.
Then we add an if statement and I'm just going to write an empty statement to start with like correct
brackets.
Just like that and will indent just to make it easier to read and all we want to do is check if the
logged in user owns the current campground on the show page and that's simple to do.
We can just add the exact same code that we saw right here in our middleware except it needs to be slightly
different but the same idea.
If I paste this in we can follow that rather than found campground in the template.
We call that campground author dot ID dot equals and we actually don't have access to request that user
ID but remember we do have current user that we setup.
And if you don't remember when or where we set it up I'll show you briefly.
It's inside of our apt.
Yes we go down to that and you take a look right here.
Read out local stuff.
Current User is request at user and that's added to every single template.
Every route will have current user available in the template equal to the currently logged in user so
current user does underscore ID.
Let's give it a shot.
Now make sure we add in the rest of the if statement parentheses.
And if we refresh.
You see that we have a problem and what happens is that we don't have a current user right now.
So because there's no one signed in current user does underscore ID is problematic.
So there's a simple way to check that you want to check first.
Is there a current user.
If there is then let's check if that user owns this.
So to prevent the error.
All we need to do is if current user and campground author ID equals the current user's ID remember
that if this is false.
So if current user is undefined if it's empty.
If it's something that is falsie we never move on to the rest of this because the way that an AND statement
works is that it requires both sides to be true.
So it's short circuits.
If this is false and we never evaluate this but if current user is anything any user object anything
that's not falsie whether it's the right user or not.
This will be true and then this is going to check if the user actually owns the campground.
So if we try that again refresh.
Right now we don't see the buttons but if I do log in as Potato Head
to more info I do see those buttons and just double check everything still works.
Let's call it Sunset Lake.
Submit and everything still works just fine.
Great.
So let's recap some of what we did here.
Most importantly in this last lesson we focused on authorization which is different than authentication
.
Authentication is just logging in checking to see if you are who you say you are.
While authorization is different permissions or security clearances whatever you want to think of it
as it's what a user who is logged in is able to do what they are allowed to do.
So in our case we went from having anyone at all being able to delete and update any campground.
But now only users who own a campground can delete an update and also the last thing we did was hide
the buttons.
Depending on if you're logged in or not.
And we protected three different routes that was added it does appear update right here and delete or
destroy.
And that was using our check campground ownership middleware that we defined for now it's just at the
very bottom of this file.
Awesome.
In the next lesson we'll focus on doing similar stuff for comments so that you can update a comment
and delete a comment and then we'll focus on authorization again making sure that only people who own
a comment can update it or delete it.