All language subtitles for 019 Adding Missing Authentication and Authorization_Downloadly.ir_en

So, we're currently in the process

of putting some finishing touches on our API,

and one of the things that we need to do now

is to fix some of the authentication

and authorization in all our resources.

And we're gonna start here with our tour resource.

And since all the authentication

and authorization stuff is always defined

on the route declarations,

well, we're gonna work here on the tour routes file.

So, this tour API that we have here

is basically what we want to expose to the world.

So for example, we might want to allow

other travel sites to embed our tours

into their own website.

And so that's what this API is basically for.

And so therefore, we will not have any authorization

on get tour requests.

Right?

And so we should actually get rid of the one

that we have currently.

Right?

So, this one.

So on getting all the tours,

right now we have to protect it,

and so only authenticated users can use that.

Okay?

But again, that doesn't make much sense,

because you want to expose this part

of the API to everyone.

So, let's get rid of that.

However, the actions of creating or editing tours,

we only want to allow lead guides

and administrators to perform these actions.

So of course, no normal users,

and also no normal guides.

So, just admins and lead guides.

And so let's put that here actually.

Authcontroller.protect,

and authcontroller.restrictto.

Admin,

and lead guide.

Give it a save here,

and that looks just fine.

And next up we want to do the same with editing.

Right?

So we already did that actually in the leading,

and so let's just copy what we have here to patch as well.

Give it a save, and now that actually looks perfect.

Okay?

So everything else,

even getting just one single tour here,

is of course free to everyone, okay?

And the same goes for getting the top tours,

and also getting the tour statistics.

Now here, about the get monthly plan,

well we also might want to restrict that.

Only, for example, to everyone except normal users.

Okay?

So that's copy this one here as well,

give it a save, and then also add the normal guides.

Alright?

And so, that looks perfect at this point, I think.

Okay?

So basically, our tour router is now completed.

Perfect.

And I'm not going to test all of this

because we already know that it works.

Alright?

So, let's close this one

and move straight to the next one.

So, these first routes here

are of course open to everyone.

So, signing up, logging in,

forget password, and reset password.

For none of these you need to be logged in.

Right?

But, you need to be logged in

so to be authenticated to update your password,

to get your own information,

to update or to delete your own account,

and really for all these other operations

here as well.

So we don't want the public to basically get information

about all the users.

We also don't want anyone to delete users,

or to update users, and really none of these

operations here should be free for the public.

Okay?

So for all of these routes here,

starting from this point,

you will always have to be authenticated.

Alright?

And so, we could now go ahead and add

this authcontroller.protect to all of these routes,

but actually we can do better than that, right?

So in order to do that,

let's keep in mind that this protect function here

is really just a middleware.

And also remember that middleware

runs always in sequence, right?

Now with this router that we have here,

that we created in the beginning,

is kind of like a mini application.

Remember that?

And so just like with the regular app

we can use middleware on this router as well.

Okay?

And so, we can do something like this.

Router.use,

and now authcontroller.protect,

and that's it.

And what this will do

is to basically protect all the routes

that come after this point.

Okay?

And again, that's because middleware

runs in sequence.

And so after these four middleware functions,

because remember that technically

this is still also middleware,

then the next middleware in the stack is this protect.

And this will then only call the next middleware

if the user is authenticated.

And the next middleware in this case is this patch here.

Okay?

And so, again, what this is means

is that all of this routes

to all these middlewares, technically,

that come after this one are now protected.

And so, we can go ahead and remove this protect

from all of them.

Okay?

And just to prove you that this now still works,

let's just go ahead and get the me information.

So basically the current user.

So if I now run this,

you'll see that it still works.

And if I take away the authentication,

then it says we are not logged in.

And so that's exactly what that protect middleware does.

Right?

So, it's now going to be back to working.

So, perfect!

That's a nice little trick in order to protect

all of the routes at the same time,

typically by using a middleware

that comes before all these other routes.

Okay?

And for example, if we now move this

a little bit up, like this for example,

then we would also need to be logged in

in order to use forgot password.

Right?

So, let me just prove that to you.

Okay?

And so usually, of course, we do not need to be logged in

in order to forget our password,

because that wouldn't make any sense, right?

But right now, since we move that middleware

a bit up, it says "you are not logged in".

Okay?

And so really, that proves that this authcontroller here

is doing it's job.

So, protect all routes --

after this middleware.

Okay.

Now also remember how we said that

all of these actions here should only be executed

by administrators,

and so now we can actually use the exact same technique

that we used up here to protect all of these routes.

So, router.use,

authcontroller.restrictto,

admin.

Okay?

And so now, only admins will be able to get all users,

to create new users, to get users again,

and to patch and delete users.

Alright?

And so from this point on,

all the routes are not only protected,

but also restricted only to the admin.

But of course, the ones that come before everyone

who is logged in can access them, okay?

So let me just prove that to you.

So, I'm going to log in, not with admin,

but with testuser.

Okay?

And so we got logged in successfully,

now let's try to see all the users.

And now it says you are not logged in.

Well, we are actually logged in,

but we forgot to add the authorization here.

So, bearer token, send it again,

and now we see you don't have permission to perform.

But now, when we change this to the administrator,

so we log in as an admin now,

and now as we get all the users,

then of course it works.

So, perfect!

And that actually finishes the authentication

and authorization for these users as well.

But just to reflect that in Postman,

let's actually go back and so basically

put the authorization here, everywhere.

Okay?

And again, that's because later on

we're gonna create an API documentation

based on the collection that we created here.

And then, it's important that we actually mark

this one here as protected.

Save it.

Save this one as well.

And the same for update and delete user.

So, bearer token, save,

and the same for update.

Alright, and actually since we're doing that,

let's do the same with all the others.

So, not the reviews,

that one is for a bit later,

but really for the tours.

So here we no longer need any authentication,

so let's save that.

Forgetting we also don't need any authorization,

but for creating we now need the bearer token.

Okay?

Also for updating, and so it makes sense

to protect them here in Postman as well.

Now this one already had it,

because we actually used this one to test it

in the first place.

So this one did not have it, but the get monthly plan,

we protected this one as well.

Add the bearer token here as well,

and so I believe with this

we are really completed now, with these, too.

And so what we need to do to finish now this part

is here, fix the same thing on the reviews as well.

And the first thing that I want to do

is to basically protect all of the routes

which have to do with reviews.

So, we want no one who is not authenticated

to get, or to post, or to change, or delete any reviews.

Okay?

We say router.use,

authentication controller.protect.

Okay?

And so that means that from this point

no one can access any of this route

without being authenticated.

But we can remove this part here, okay?

And so now with authentication out of the way,

let's think about authorization.

So, first of all, only users should

be able to post reviews.

No guides, and also no administrators.

And so this part, we actually already have that here.

Okay?

Then, admins should be able to update

or to delete reviews, just like regular users,

of course, so that they can then edit

or delete their own reviews.

And finally, guides can not add, edit, or delete reviews.

Since the guides are the ones who are performing the job,

so it would be weird if they could post reviews

themselves, or edit other peoples' reviews, right?

And so let's put what we just described into code.

So, basically patch and delete

are restricted

to users,

or actually just user, and admin.

And then the same thing for deleting.

Okay?

And so you see that now guides and lead guides

have nothing to do at all with reviews.

All they can do is to really get reviews,

but not changing or posting them at all, okay?

And so, quickly now in Postman,

let's put that here as well.

So create new reviews already has the authorization,

get all reviews also needs it now.

So, with the bearer token, save that,

here, the bearer token as well.

Now write, and also get one single review.

Actually let's nicely order this as well,

so that all of them are kind of in the same order.

And now about these two here, they actually

are also protected.

Right?

Because ultimately it's the review handlers

that are actually called for both of them.

And so here we also need to add that bearer token.

Okay?

So now, basically, the only way of getting access

to data about reviews is to call all of the tours.

Right?

At least for people that are not authenticated.

Okay?

So, let's close all of this,

and so I think we're now good to go,

and we actually finished this part as well.

Let's just clean it up here a little bit.

And yeah, I think that's it.

So with this we actually finished the authentication

and authorization parts of all our three resources,

so we're really close to finishing our API here.

There's only a small amount of things left to do,

and so we're going to do all of that

in the rest of this section.