So, the password must be encrypted before it gets stored, that's really important.
Therefore this code needs to be tweaked and a package needs to be installed that helps
us with hashing the password.
And I'll install that package manually, I'll quit the server and install the package
manually because I know which package I want and that's bcrypt.js, that's the name
of the package.
There also is bcrypt without js but I want this version which is simply a bit easier
to use in this application.
So that will install this package and with that installed I now want to tweak this code
here to take advantage of this package.
And actually I also want to add a new function to this file which should be exported which
can be used to validate user passwords.
But I'll start with this function, I'll highlight it and add my instruction here,
hash the password before storing it.
I'll also add a reference to the package.json file here in hope that it understands that
it's the bcrypt.js package it should be using.
And with that I'll hit enter and see what I'll get here.
So yeah, it's importing this package and then it's applying some changes here to generate
a so-called salt and then hash the password and then store the hashed password.
Now I actually here want to use the async version of hash which also exists which uses
a promise, it's just a different way of building this.
So I'll say use the async version of hash instead of hash sync.
And I'm telling the AI to make these changes because there are different places in the
code that need to be adjusted when using the async version.
For example this async keyword must be added in front of the function keyword.
So with that, that's looking good to me, I'll accept this, great.
I have this function, now I also want to have a function that can be used to verify
the password in the database and compare it to a plain text password.
Because of course since we're now storing hashed passwords in the database we need a
way of comparing those hashed passwords to plain text passwords.
And the bcrypt package offers a function we can use for that but I want to wrap that function
in my own function here in this user model file.
And I'll tell the AI to do that for me.
Add a function I can use to verify user credentials.
Maybe that's enough, let's see.
Verify user credentials, expects email and password, reaches out to the database, selects
a user by email, returns null if we don't find a user and if we do find a user it uses
this compare function which I meant to compare the password and then it either returns an
object with user ID and email if a user was found for the given credentials and the password
is correct or it returns null.
It throws an error if something goes wrong after logging a little error message here.
Now actually I don't need that kind of unnecessary error handling here.
It'll throw an error if something goes wrong anyway so we can handle that elsewhere so
I don't need that here but I'm happy with the rest of the code and I'll accept this.
Like this.
So now we have verify user credentials and now back in the user's controller we can use
this function in the login function.
We can use this verify user credentials function to verify the credentials in here and for
that again I'll select this entire function and pass some editing instructions to cursor.
Use the and I'll actually point it to my verify user credentials function because you can
also reference specific code from other files.
I did that by typing at and then code and then searching for verify user credentials
to tell cursor to use the verify user credentials function and that should actually be all.
No more details should be needed I think.
And it goes ahead and adjusts the login function, adds the async keyword which it will need
because verify user credentials returns a promise and rewrites the code.
to verify the user credentials, await this,
check if it did not get back any user data,
in which case it knows that verification failed
and it sends back an appropriate error response
with an appropriate error response status code.
Otherwise it sends back login successful
with that user data, like this here.
And it then also catches any other error
and sends back a 500 status code.
So yeah, we can accept this here.
Looks good to me.
And with that accepted here,
we can test this and give this a try.
Now I will delete my database SQLite file here
to clear the database because I had that user
with the plain text password in there and I don't want that.
And I'll then thereafter restart my development server
with npm run dev.
And then again, give this a try.
Send this signup request, get back this success response,
but actually here, something's wrong.
I got back an empty object here
instead of the actual user data.
So that's something we'll need to investigate.
But at least we now have the hash password in the database
if we explore that database.
That's not the password I entered instead.
That is indeed the hashed version.
Okay, so that's looking good.
Now with that, we can also test login real quick
before we fix this problem
with the wrong data being returned.
So I'll send a new request in a new tab
to localhost users login.
Also add a body here, a raw body in the JSON format
and essentially send the same data I sent for signup
because we still need an email and password
also when logging in.
Now if I click send, I get an error
which occurred during login though.
So something went wrong here
and I got an error here in my terminal as well.
And that's there for what we'll debug next
and we'll then also fix this error here
regarding the wrong data being sent back.