All right.
And once we have the test user in place, like I already mentioned in the previous video, we want to
restrict the access and we're going to do it in the following way.
So in the authenticate user middleware, right after we verify the token, I'm going to create a new
variable and I'm going to call this test user.
And essentially I want to grab this user ID, which of course is coming from the token, and I want
to check whether that is equal to my test user ID.
And of course, if it's the case, then the value will be true.
If not, it's going to be false.
Now, regardless, I'm going to add this to my req dot user object, this test user property.
And then right after that, I'm going to set up another middleware where essentially I'll check if it's
a test user, then I'll throw a bad request error.
And effectively I just want to add this middleware to the routes that I want to protect from the test
user.
Again, the main goal of the test user is just to view the application so the person can come into the
application and take a look at how the stats look like the jobs and rest of the stuff.
But I don't want the user to modify the profile or delete the jobs or even create the job.
So let's start working on that.
We want to navigate to the middleware, to the auth middleware.
And like I said, right after we get back the values from the token, I essentially want to create a
new variable.
And you know what?
As a side note, there's going to be a bad request error, so we might as well import it here.
So at the moment we have these two, but I also want to grab the bad request error and effectively the
variable is going to be test user and I'm going to set it equal to my user ID and now I need to grab
the value of the test user ID.
Now we can get it in multiple ways.
You can obviously use the thunder client, you can log in and get the current user.
You can also log it on the front end or you can simply navigate to Mongo.
And then you're looking for the test user notice this is going to be my test user and then I want to
grab this value over here.
So essentially I want to grab this string and we want to set it equal to.
And of course, if.
They match, then test user is going to be true.
If not, it's going to be false.
Like I said, regardless, we want to add it to the test user.
And now let's set up another middleware.
And if you're wondering, well, how we're going to access the user, well, remember, the authenticate
user is pretty much one of the first middlewares that we have in all of the restricted routes.
So of course we'll add the check for test user after that.
So let's go here with export then const and I'm going to name my one check for test user since it's
a middleware, I'm looking for three things, so req res and next.
And in here, like I said, I'm going to have a condition where basically if it's a test user, then
I'll throw the bad request error.
If not, then I'm just going to go with next.
So req user and then test user.
If that's the case, I want to go with throw a new bad request error.
And let's just write over here, demo user read only.
And then if everything is correct, if it's not a test user, then of course we want to pass it on to
the next middleware, which might be a controller.
And once we have this setup in place, now let's look for the routes.
So we're looking for first the job router and then also we'll add this to the update user.
Now I don't want to add it.
In the server because I want the test user to be able to take a look at the jobs.
Now, we haven't created those jobs yet.
This is something that we'll work on next.
But eventually, yes.
Test user is going to have some random demo jobs.
Hopefully that is clear because at the moment, of course, we just created a user so there are no jobs.
So in here we want to look for.
Our check for test user middleware.
So check.
Test user.
Then let's bring it down.
And now let's go one by one.
So as far as getting all jobs, I want test user to be able to do that.
So I'm not going to add it here, but I do want to restrict access to a test user to create job functionality.
So before we even validate what values are coming in, I want to check for test user.
And remember, if it's a test user, then essentially we'll just spit back this error.
Now, if it's a regular user, then of course everything is going to be correct because test user is
going to be false and we're using next to pass it on to the next middleware.
Now what is in our case, next middleware?
Well, that is validate job input.
And if that is correct, then we finally get to create job.
Hopefully that is clear.
And then one by one, let's add it also to patch and delete.
So as far as viewing the job, the single job, well test user can do that, but he or she won't be
able to edit or delete.
And as I was talking, I actually added to getting a single job.
So my bad.
Let me remove and let me add it over here.
And right after the job, one, I want to restrict the access to update user.
So let me navigate to user router.
I already have here authorized permissions, so I just want to import the check for test user and essentially
I'm just looking for the update user request.
Now when it comes to current user, remember this is a public route.
So of course we do want to access we want to get the cookie.
Now when it comes to admin and app stats, well, remember is going to be restricted regardless since
the user role is not going to be an admin and therefore only here we want to add that functionality.
So let's go with check for test user and let's add a comma and of course we can navigate to a browser
and test it out.
So let me navigate to my application.
This is my zippy, and then if I try to add a job and as I note, of course it's complaining that I
haven't provided all of the values, so let me write over here position.
And then company.
Since I know that it's going to fail if everything is correct, notice the more user read.
Only now we don't have jobs at the moment, so we cannot test again.
This is something we're going to set it up.
And if I'm going to go to profile and do the same thing, demo user read only.
So this user will be only able to take a look at the jobs as well as the stats page.
And with this in place now we can start setting up some mock data.