Awesome.
And once we're done with alternative approach.
Now let me showcase why we would want to check for permissions.
So at the moment, life is great.
I'm logged in as John and I can successfully update my jobs.
Take a look at all the jobs, yup, I have Google Earth.
So if I go back to the job and then if I go with Google or Apple or whatever, everything is going to
work.
But here's the major news you in our setup where if I go here with logging user.
And if I'm going to go with Peter and if I send and get back the token.
And if for some reason I have access to John's job, Javadi, I can actually edit it and go here with,
Wow, this works.
Technically, it shouldn't.
So if I send it back here, notes have.
While this works now, I'm not going to be able to get, of course, John's jobs.
Clearly see that I don't have the list over here, but I can clearly edit John's jobs.
And let's talk about why is that happening?
Well, if we go back to our application in the, we can clearly see that we're checking for authenticate
user.
So here's the problem.
Beta is authenticated.
It's a valid user, but he should never, ever, ever have access to John's jobs and edit them.
Now you can make an argument where, OK, but why don't we do it?
Like with get our jobs, we're essentially not only I look for a job.
We're here where I say underscore it is equal to job 80.
But I also want to add here created by basically two options over here.
And technically, you would be correct.
But what about the situation where of the admin wants to modify something regarding the content?
So imagine if I have admin Susan now.
She did not create the job.
So her idea is not going to be equal to the created by and if, let's say she wants to access that job
and added she won't be able to.
So yes, in our scenario, that would work where I would say, OK, get me not only the job based on
theory, but also on the user I.D. and not worry, Peter won't have access to the job.
But again, it's not going to work if you have the admin.
Now what is a better approach that is to set up permissions where long story short, we're going to
do something like this, where I'm going to check the user I.D. available on the record user and whether
it matches the one in the job, whether it matches the user I.D. available in the job.
And this is what we're going to do in next video.