Yeah, but with that, that's looking good, hopefully that should do the trick.
Now to test it, I'll delete this database file to clear it and I'll restart the server
to reinitialize the database with npm run dev and then we can give this a try.
Now first of all we need to create a new user since I deleted the database so I'll resend
that post signup request here with my dummy user data like this.
Now I get back a token here as well which I can use and then we can get events.
That doesn't yield anything of course so we can post a new event with the same data
as before, doesn't matter, but with a different token so I will replace that token value
here with my new token, send this and it's stored and now create a second user with test2
at example.com as an email address so that I get a different token for a different user,
might look similar but it's a different token and with that I'll now try to edit this event,
so this event with the id 1 which I just created, I'll use that token of that second user here
and even though that's a valid token and therefore the user will be authenticated, it should
not be authorized to edit this event because the event was created by a different user.
So indeed I get this error, forbidden, you are not allowed to edit.
The same should happen if I try to delete it, if I try to delete the event with id 1
with that token, does not work.
If I now log in with my main user who created the event and I get the token of that user
and I now try to edit it, so if I use that token now for this put request and I click send,
that works and if I get all events we should now see the updated event there, yes we do.
So that works and that's authorization added to this app, making sure that only the user
who created an event can manipulate it.