Now we are handling problematic user input,
and we do have
the authentication flow that does allow us to log in,
if we have valid credentials.
Now it's time to make the next step
and work on this administration area,
where administrators can add
new products and so on.
For this of course,
we also need a way of differentiating
between normal users
and administrators.
We don't have that yet.
And we also might want to work,
on our navigation bar a little bit,
so that we can navigate to different areas.
Like for example,
the manage products area
with these.
So couple of things to do let's first of all,
start by actually having administrators.
And right now, of course,
every user that signs up is a regular user.
We have no way of telling administrators and users apart.
This happens on purpose here.
I mean, after all,
this is a user facing website here or it soon will be,
and I don't want to make every user
an administrator by default.
Instead, this is my personal online shop.
So what I will do here,
is I'll not build a fancy web
interface for managing users,
you could do that as an extra challenge,
but instead I will just directly go to the database
and turn a user of my choice, myself,
into an administrator by adding an extra flag there,
like an is admin field,
for which I can then check in my code.
Now for this here,
I use the Mongo shell to connect to my Mongo DB database,
which is running on my system.
I'm using my online shop database,
which is the database we are interacting with in this
website we're building.
And there, of course we can,
first of all, find all the users we have.
And in my case, I created two users.
Now I do want to turn this first user,
myself,
into an administrator,
and to do that, I'll grab the id of that user,
this entire object ID thing,
and then run DB users dot update one to update one user.
And then I pass a first parameter value,
which identifies the user.
And here I said,
ID equal to that object ID
and then separated by a comma.
I have a second object, which describes the update.
And here we use dollar sign set.
As you learned earlier in the course to set specific fields
on that user object to a new value.
And I will pass an object to set where I then described the
fields that should be set to a new value.
And I won't change any of the existing fields here.
Instead, I just add an is admin field and set this to true.
So only that user with that ID will have,
that is admin field, which is set to true then.
If I hit enter you see this is confirmed,
and if I now find all users again,
we see that here we have the is admin field.
And we only have that on that user.
Therefore in the future,
we can check for that field
and then know that this is an administrator.
And that's what I'll do next.
Back here in our code,
I will go to this check off middleware,
where I'm already getting the user id's.
There, I also want to find out
if a user is an administrator.
Now to do that,
I need to get more data about that user,
because at the moment,
we're only storing the user ID in the session.
Now I will actually go to the auth controller,
to the log in function,
where we do populate our session data,
because there in the end,
after we checked for all the credentials,
we create that user session.
So if we now go to this utility function here in
authentication JS,
where I create the user session,
Here I'm storing the user ID.
And here I now also want to store the,
is admin flag into session
and get that from the user object,
which I'm getting, where I access is admin.
And for most users, this will simply be undefined.
Since most users don't have the is admin field in the
database, but for the administration user,
with that password, and with that email here,
we will have true instead.
So that will then also be stored into session.
And back in check off,
we can therefor extract this.
Here,
I can set res locals
is admin,
so that we have does own this global variable that's
available in all the templates,
equal to rec session.is admin,
which is either undefined for most users
or true for some users.
And now we can work on the navigation and unlock more
options for administrators, then we do for other users.
So in the included header.ejs file,
we can now work on the nav items.
In here in this unordered list of nav items.
I at the moment only have to log out button if you are
authenticated.
And that's good.
I want to have that button,
but now I want to have more options for administrators and
other options for non administrators.
Now let's maybe start with the non admin options.
All users actually, no matter if they are logged in or not,
should be able to view all the products,
because you should be able to
browse the products without being logged in.
So I'll add a new list item here with an anchor tag that
leads to slash nothing
which says shop, where you can view
all the products.
Actually,
you should also be able to add products to the cart,
to the shopping cart,
and to view your shopping cart
without being logged in.
This might sound like it shouldn't work,
because our shopping cart clearly
has to be connected to a specific user,
but we will be able to connect that to a user
with help of sessions.
So therefore, we can actually add a cart link that leads to
slash cart, which will also always be accessible.
Now, we then also have a couple of links or
one link at least,
that should only be accessible
if you are logged in.
And that is the link to the orders.
So here I'll add an orders link,
and that is a link
that should be protected with this kind of check.
So I'll repeat this here.
Check if you are authenticated and only show this orders
link, if you are.
I'm not moving it into this existing check block here,
because in between,
I want to have a couple of other options,
which you only see if you are an administrator.
So here I want to check if locals.is admin is truthy.
So if it's true to be precise and in that case,
and only in that case,
I want to show some administration exclusive options.
So in here we have more list items.
For example,
we might have a link to let's say,
slash admin slash products.
And we will add routes for all those links later,
where we say manage products.
That could be one link,
which you only see as an administrator.
And right now, by the way,
it won't work since we're not supporting this route yet,
but that is something we'll change.
We might also have a link to slash admin slash orders
where you can manage all the orders
that have been placed by customers.
So that's now administration exclusive.
And actually, if you are an administrator,
you should not see the regular shop links.
So here, for example, for orders,
I'll not just check if you are authenticated,
but also if you are not an admin.
So,
and not is admin,
because if you are an admin,
you're not a regular user and you then should not be able to
see the regular customer facing orders part.
You're only having your management options, in that case.
You should also not see these links here.
So here I'll also check if,
not locals is admin.
And I only show these navigation items here,
if you aren't an admin.
So here,
let's make sure,
we always include that in such a block.
So that you see the regular shelf only
if you're not an admin.
So if you're logged in as a different user,
or if you're not logged in at all actually.
The log out button should always be visible.
And now last but not least,
there are only two navigation options left,
which you should see if you're not logged in.
And that are the options
to visit the sign up and login pages.
So here we have a link to sign up,
which says sign up,
and we have a never link here,
which leads to slash log in
which says login.
And these should only be visible if you're not logged in.
So here we'll check if not locals is off,
if you're not logged in,
then you will see these two links.
Otherwise, if you are a logged in user,
it makes no sense to log in again.
So then I won't show these options to you.
And that's now the navigation part
with a bunch of checks and rules.
And here I'm missing an if statement in the first check.
Now that's valid.
And with that,
we should ensure that different options are shown to
different users.
Still, we have no styling,
but at least we have the proper options in place now.
Hence now,
if you go back and reload as a logged in user,
you can tell,
I see the shop,
the cart and the orders.
And I logged in before
I added all the administration checks,
so right now,
this is a non admin user.
If I do log out,
I see shop and cart and sign up and log in as I should and
sign up and log in also work.
And if I now do log in as the administrator here
like this,
then I only see my management options and log out.
So that seems to work.
Of course,
what's not really working is the look of the navigation.
That's something we want to change because that of course
should look a bit prettier.