Now, before we continue with now protecting
some pages, and exploring sessions, and cookies,
I wanna go back to the signup route again,
the post-signup route.
Because there, I now want to add some extra logic
that is quite important.
I wanna, for example, ensure that the user is not able
to get any further if incorrect data was provided.
So for example,
I don't wanna store an empty email address in my database.
And I also wanna make sure that if a user
with a certain email address has been created before,
you can't create another user with that email address
so that the email address is unique
and you can only have one user per email address
in the database.
Because at the moment, nothing would stop
me from signing up again with that same email address
that already exists in the database.
And that is definitely something I wanna avoid.
But first things first, as a first step,
let's validate this user input.
And let's for example, ensure that the entered email
is equal to the entered confirm email.
For this, I'll simply add an if check here
where I will combine multiple conditions.
For example, here, I wanna check if not entered email,
which means entered email is false;
or if not entered confirm email, or if not entered password.
So with that, I'm checking if we maybe don't have an email,
don't have the confirm email, or don't have the password.
I also might wanna check if the password is long enough.
So I wanna check if entered password is maybe,
let's say, it's shorter than six characters.
That could be a threshold, which I wanna have
where I also wanna block the signup process.
I also wanna add a number condition here
and check if the enteredEmail is maybe not equal
to the enteredConfirmEmail.
Because the idea behind having that confirmEmail
is that we catch typos that user might have introduced
where the two email addresses might not match.
And last but not least,
I'll add another condition here where I check
if not enteredEmail includes,
which is a built-in method we can call on strings, an @.
So if it does not include an @.
If either of these conditions is met,
that's why I have an or, it's enough.
If one of these conditions is met,
then I know that I have some invalid input.
Because for example, the password is too short,
the email doesn't have an @,
or the email addresses don't match.
So if either of things is the case,
then I don't wanna continue
because then I have some invalid data.
And I definitely don't wanna create
a user with invalid data in my database.
So then I wanna return
and actually redirect back to the sign up page here
so that the user is able to enter correct data.
And for the moment, I'll leave a little info message
from me here where I say incorrect data.
So that's the first step,
some basic validation that can be added here.
And you can refine this and add more conditions,
but this should be a good set of validation rules.
Actually, here for the entered password,
I wanna make sure that I call trim
on it so that I remove access white space
so that entering six blanks would also not work.
Because trim will remove blanks that are inserted
at the beginning or at the end of a string.
So that's a little adjustment I'll also make here,
trimming that entered password.
But now with that, I got this validation.
As a next step, I wanna make sure that we don't create
a user which we already have.
So we don't use an existing email address again.
And therefore here, before we start hashing the password,
I wanna check if we got an existing user here
for the provided email address,
which in case of signing up would be bad.
So here, I will await db.getdb.collection users.
And then we find one user where the email
is equal to the entered email.
And it would be bad if we do find one.
So that's a little query we run here.
And if we then have an existing user, that's bad,
because that means we have a user
for this email address already.
And in this case, I'll therefore redirect again,
And I'll redirect to the signup page,
and return so that no other code thereafter executes.
And I will console.log user exists already.
So now with that, we can save all of this.
And now, if we go back, and test this,
and I do try to sign up with an existing email address,
this won't work.
I'm redirected back to sign up.
And if we see this in the database,
the user is still only exist once.