Welcome back.
In this video we're going to add in authorization to the comment routes that we just added in so edit
update and destroy the only one to use or to be able to actually edit or update something if that user
owns the comment just like we did for campgrounds.
We'll achieve that with basically the same code where we have a middleware think we called ours check
campground ownership but ours will be called check comment ownership and then we also want to make sure
that we hide and show those buttons so that we don't show a user a delete button that they actually
can't click.
They don't have permission to delete that comment.
Which is also basically the same code that we used for comments or for campgrounds.
And then lastly and this is the only thing that's really new is that I want us to refactor our middleware
.
So basically just move all of our middleware out into a new file and require that file will begin by
making sure that a user can't get to the edit route if he or she doesn't own that comment.
So let's go to the route instead of our comments here.
And let's go to Edit.
We want a middleware here that will do the checking for us.
So check comments ownership just like we did in the last video or in the last campground video where
we did check campground ownership and if we take a look at that code going to just copy the whole thing
over.
It's kind of long put it at the bottom with our other middle where we'll change that name check comments
ownership.
The first thing we do is check is the user log in is any user logged in.
If not just redirect them back and will show a message eventually that says please sign it or you have
to be signed to do that.
And that's a different error than you not being the correct owner.
So we don't want to just say you don't have permission to do that.
Always we want to say sign in first and then if you do sign in and you still don't own it then we'll
send a different message.
For now it doesn't matter because we don't have those messages.
So if you are signed in we need to find the comment comment out fine by Friday.
It's not request up tramstop ID request up tramstop comments Id change this to be found comment.
If there's an error redirect back that's fine.
Else let's change your comment to make it a little clearer.
And I keep saying comment.
I mean change the javascript comment not the actual comment model.
Then we need to check if the found comment author that ID equals request that user ID.
So let's take a look again at the model for comment.
Remember we have an author and that author has an ID and it's a mongoose I.D. So we can't do triple
equals just like with campground.
So if found comment out author ID dot equals that special method we're comparing it to the logged in
user's ID which is stored inside request that user thanks to passport.
So if that's the case everything is good which means we can move on and run the route handler next.
Otherwise redirect back and again the reason I separated all of this out even though it's redstart redirect
back three different times so that we can specify a different error message once we get to that in just
a few videos from now.
So let's now make sure everything else is good.
Check common ownership.
We have that up here.
We need to go to Edit route.
We added that in check comment ownership.
Great let's give it a shot and see what happens.
Good.
So everyone should be able to get here.
I'm not logged in right now so if I click it it takes me back here.
Perfect.
Now if I do log in as Sirius Black who created that comment and I try that again at it it now works
.
Let's just add some expert stuff in here.
Now that's not protected because that's the update route.
So we actually just do the exact same thing which is why it's so nice that we moved it into a separate
function because we could just have all of that code right here and then duplicated it back for update
as well.
Right here.
And for destroy.
But let's just leave it at that for now.
Make sure that it works.
So theoretically I could somehow end up sending an update request from postman or something like that
from some other app.
However you know a user would do that which is would be very rare but theoretically someone could do
that.
And without adding the check comment ownership to update it wouldn't be protected.
But we won't notice anything different here if I try at it.
Same problem if I log back in and you can just skip through this if you don't really care to see it
.
Not the most exciting part of this course watching me log in now if I edit update works fine.
And if I had signed out at that point or if my data was wrong or something weird happened it would then
redirect me back and eventually show a message.
OK so that's update now if I do click on delete.
When I'm not signed in
I can delete that comment which is obviously not what we want to happen so let's fix that.
Let's go to a page that does have comments.
This one doesn't have one.
Let me add a comment in once again not the most exciting.
Oh and I typed a comment at the password incorrectly.
Oh dear.
Let's try that one more time.
OK.
Let's go to Rocky Mountain high.
Add a comment in to me.
OK.
So I don't want a user to be able to delete this unless they're logged in.
It's exactly the same.
Super easy for us.
Just find the destroy route add or middle Waren and that's all we need.
So if we try it I just showed you that currently before we made that change.
Anyone can delete.
Now if I refresh I'm not logged in I clicked delete and it's still there.
Refuses to delete.
Great last big step is showing and hiding these buttons appropriately.
So let me sign in or sign up as someone else.
Let's sign up as Dumble door to door.
Password is also password.
Sign up.
Let's added comments in as well.
Now two different comments two different authors.
If I'm signed in this double door I only want to see the delete buttons here.
These should be hidden for me so to do that.
Take a look at how he did it on the show page for campground delete and edit buttons.
Which is right here.
This single line IF current user and campground author data equals current user ID then we show this
very very similar except for a few changes.
First of which is it's not campgrounds at author dot.
It's comments author and that's defined here in our foreach.
So whatever this is in our case for each campground comments array call it comments display the author
display the text and then check if there is a current user.
And if that current user's ID is here which is stored.
There's a lot of moving pieces here but I will review this briefly.
This is coming from that one line that we added to Abdoulaye us up top that add in.
Where are you right here.
Current User to every single one of our templates.
Current User equals request user and request users coming from passport.
It has the user information so current user.
If there is one we have to do that check if there is one because if we don't have this first part and
all we have is this if there is no current user it will give us an error saying current user is undefined
.
OK so common that authored that ID.
The last thing we need is to add in our closing bracket or a curly brace for the if statement.
No equal sign.
So this is all enclosed in that if statement.
Let's give it a shot to start.
If I were fresh it will log me out and we expect to see no buttons.
Perfect seinen will do double door.
Go back to Rocky Mountain High and we only see those buttons.
Perfect.
Make sure this still works.
Looks good but still it also looks good.
Now let's sign in as Sirius Black
.
Now we expect to see the buttons and we do.
Perfect and I can also delete this now.
Let's delete it.
I want to leave that campground because campgrounds are precious.
We need this takes a while to add a new one back in