Okay, so now that we have all of our controller methods and routes for our users, I want to start
to work on each function and we're going to start with the auth user, which is our login.
So it's this route right here.
API users login and I have that in my postman tab right here.
Let's make that a little smaller if possible or not.
And if I send I just get auth user.
Now when you send your your login, you're going to need to attach some body data.
So if we go to body you can either send raw Json data or this form URL encoded value or key value pairs.
So if I put in like email and I want to use john@email.com and I already have users in my database because
of the cedar data that we created a while back.
So if I look in Compass and you look in users, you'll see I have three users, I have Jane, Jane at
email, John at email and admin at email, and all their passwords are one, two, three, four, five,
six, but of course their hashed in the database.
All right.
And if you don't have that in your database, you can just run the script, which if we look in our
back end Package.json, you can do NPM run data import and it will then seed the data and add it to
your database.
Okay.
So I want to log in with this John account.
So let's also add a password of one, two, three, four, five, six.
Now if I send it at the moment I'm still going to just get auth user because that's all we're doing
here, right?
We're not checking anything.
We're not getting any body data or anything like that.
Now, I'm sure that a lot of you already know this, but to get the data that's sent in the body, we
use this request object which has a body object on it.
So if I say console log request dot body.
And if I send the data here, I send my request, and then I look down in the console, notice that
it says undefined.
Now, the reason for that is because we haven't set up the middleware yet for parsing body data.
So we have to add that in our server.js.
So let's go into Server.js and we're going to go right under where we created the app variable here
and let's say body parser.
Middleware.
And to do that we're going to say app dot use and we're going to pass in here express dot Json.
It used to be a third party body parser that you had to install, but now it comes with it comes out
of the box with Express.
Now that's for just raw Json.
We also want to be able to do the URL encoded.
So let's say app dot use.
And we're going to do express dot URL encoded URL encoded, and we're just going to pass in an object
with extended.
And we're going to set that to false.
I'm sorry.
We're going to set that to true.
Okay.
Now these two lines of middleware should allow us to get that body data.
So once again, I'm going to send with the email and password in the body.
And then if I come back over here, you'll see I have an object with the email and password.
So now we can close up Server.js.
Come back over here and we can proceed with what we want to do here.
So instead of using request dot, body dot, email and request dot body dot password, I'm going to
deconstruct both of those from request dot body.
So I should be able to say const and then in curly braces, take out the email and the password.
So now we have that.
So the first thing we want to do after we we get the email and password is check for the user, make
sure there's a user that has that that email.
So let's say const user, set that to await and then take our user model and we're going to call find
one because that's what we want to do is find one record in the database.
Or one document, I should say, and we want to specify, we want the email to match the email that
is passed in here.
Now, since these are the same, I can get rid of the second one, so we can just do that.
Okay.
And then let's do this.
We'll say if.
If there is a user that matches, then let's respond.
So res.json.
And we're going to pass an object that has the underscore ID, which we'll set to user dot underscore
ID the name.
So.
User dot name.
The email.
So user dot email and the is admin.
So user dot is admin.
So that's what we want to send back.
And ultimately we're going to want to set a token, but I'm not getting to that just yet.
Now if there's not a user.
So we'll just put an else here.
If there's not a user, then I want to first of all, set the status to 401.
Because that means unauthorized.
So status 401.
Status and then we can throw an error.
So say throw new error because remember, we created our own custom error handler.
And we just want that to say invalid.
I will say invalid email.
Or password.
You don't want to let them know which one was invalid because that's a security issue.
That would make it so that people can figure out which emails are actually registered or not.
So whether the email is wrong or the password is wrong, we want the same error message.
And then down here this res.send we can just get rid of that.
So let's see what we get here.
I'm going to go ahead and send with the wrong password, so I'm going to take the six off and then send.
And let's see, why did that?
Oh, we didn't validate the password yet.
That's right.
So let's actually let's do a wrong email.
So I'll do like whatever one email.
Okay.
So now we get invalid email or password.
The password doesn't matter at the moment because we haven't we haven't implemented that yet, but it's
going to check for the user.
And if that user doesn't exist, then we're going to get our message and we're also going to get a stack
trace because we're in development.
Remember, in our error handler, we specified that we want a stack trace if we're in development.
Now, if I search for a user that does exist, like John at email, then I'm going to get the data back.
So the next step is to integrate the password checking.
Now to do that, we have to use Bcrypt because what we're getting as a password when we send our request
is just plain text, but we have to match it to the hash and the database.
So we use Bcrypt for that and we could do it right here.
But I think a cleaner way to do it is to add it to the the model because you can actually do this within
the model.
So let's go to user model and we do want to bring in Bcrypt.
So up at the top we're going to say import Bcrypt and make sure that you don't bring in bring in it
as Bcrypt.
JS It's going to be Bcrypt if I can spell that right from.
And then here we want to put Bcrypt JS and then down here let's go right above where we export the model
and we're going to add on to the user schema.
We can add a method by saying dot methods dot, and then whatever we want to call this, which I'm going
to call it match password, and we're going to set that to an asynchronous function and this is going
to take in an entered password.
So whatever the user enters, which will be plain text.
Okay.
So it's going to take that in.
And then we basically need to compare that to the hashed password.
So we're going to return from here, let's say return.
And then we want to await on Bcrypt dot, and there's a method called compare.
And compare is going to take in the plaintext password, which is entered password, and we're going
to match it to this dot password, which is the password that's currently stored in the user database
in the database for this user.
Now, just doing this doesn't do anything.
We need to actually use this match password in our controller.
So let's go back to our controller.
And we're just going to add here where we're just checking for the user because obviously we don't want
to just see if the user exists.
We want to match the password as well.
So I'm going to say double ampersand.
So and and then in parentheses we'll say we want to await on user now, since I added this method onto
the user schema, I can access that method on the user object.
So let's say user dot match.
Password and we're going to pass into that the entered password.
Which comes from the body.
Okay.
So again, it's getting passed in the entered password and then we're going to compare it to the password
of that user of the hash.
And everything else should be good.
So let's save that.
And now let's try to do it with the wrong password.
So this is the wrong password I'm going to send and you'll see it says invalid email or password.
I have the correct email, but this is not the correct password.
So let's add a six, which is correct.
And now it works.
Okay, Now all we're doing is getting the data back.
We're not actually creating any Json web tokens or storing a cookie or anything like that.
We're going to do that soon.
But I just wanted to get the basic logic down where we're validating the user's email and checking the
password.
Okay.
So in the next video, I'm going to talk a little bit about how Json web tokens work and then we're
going to implement them.