So where do we call createAuthSession?
Well, after logging a user in and after creating a user,
so after going through that signup process,
and therefore, it's in that signup server action function,
right before I redirect
where I wanna create such a new session.
So it's in here where we can call createAuthSession.
And for that, of course, we must import that function
from that auth file and createAuthSession then wants the ID
of the user for whom the session should be created.
Well, here we can get that ID from createUser
because there in the end I return that ID.
So in the end, I will get my user ID here
and I then wanna create that AuthSession
and also redirect if everything worked inside
of that try block.
So now we can pass that user ID to createAuthSession
and that then yields a promise, which I'll await
and then there thereafter I'll redirect.
So with that, I am now creating such a session
whenever a new user is created.
And to see that in action, I will delete
that training.db database file
so that the next time we restart the dev server,
a new database will be created
so that all existing users are cleared.
And I then will stop my development server
and restart it so that this new database is created.
And if you then go back to your application
and you create a new user
with a valid email and password, we are redirected.
But if you now open your developer tools
and there you go to the application tab
and then to cookies,
and you select your address, localhost:3000,
you should find a cookie there, which is that cookie
that was created by Lucia.
And that value which is stored in that cookie is,
in the end, that session ID.
So that's now this auth cookie which we sent back with help
of that cookie's function, which was configured
with help of Lucia.
And the browser will automatically attach that cookie
to any outgoing requests.
So if I go to the network tab here, for example,
and I reload this training page, you will see
that on this first initial request
to that page under headers,
if you go to the request headers,
you will see that this cookie is added.
So this auth cookie was automatically added
and therefore, if we wanna protect this page here
and we wanna make it only accessible to logged in users,
we need to check for the existence of that auth cookie
and verify its validity.
That's how we can protect this page.
And that's therefore what I'll do next
before I then thereafter
will also add a log out functionality
and a log in functionality, which is still missing.
At the moment,
we only get a new cookie if we create a new user,
but we'll take care about logging users in soon.