Okay, so how we can restrict the access?
For a test user.
Basically, we don't want the test user to do any kind of CRUD functionality, essentially read.
Well, we could go back to auth middleware on a server.
So and where it is, where it is middle over here, off.
And then remember, each and every time the request comes in, we check.
For what?
Check for token.
And in a token.
What do we have there?
You have user ID.
We could come up with another property, and if the user already matches whatever our test user is,
then we set that property to true.
In my case, I'm going to go test the property.
And if it's a test user, we can create another middleware.
And if it's the case, then we just return a error.
We say, Listen, this is best user read only, and then we add that middleware every route we want
to restrict access to.
So I know this was a bunch of words.
So let's just start where first I want to come up with the property name.
I'll say test user.
Now what is test user equal to?
Oh, it's equal to use already.
And we just want to make sure that it matches the best user.
So let me go back here to the Mongo.
This is my test user and again, we'll grab the ID.
Now, if you're wondering, well, can we make this simpler and let's say set up with the email?
Technically, we can just keep in mind that when we're setting up the JWT.
I believe it was in a user.
Right?
We only pass the I.D..
That's it.
So this is what we place it inside of it.
So if you want to check the email, whether it matches test user.
At test dot com or whatever value you have.
You also need to adhere to email.
Since I only have the ID, that's where I'll be checking for a test user.
So this is located in the payload.
And then we'll say payload user ID, remember, that's the property over here.
Like so now we're getting it and I'll check whether that is equal, whether that is equal to my test
user.
Now let me move this sucker down.
Remember how we're creating this user object?
And then the second thing is going to be my test user property.
That's it.
That's all we want to do.
So this one will be either true or false.
So now, of course we can.
Create another middleware.
Which basically will check for the property for that test.
User one And if it's true.
Then we'll send back the bad request right from the get go.
Now, if you're wondering whether test user exists, can simply go to any of the controllers.
Let's say jobs one where we're getting all the jobs.
Let me see.
Which rout was it?
This was created.
Get all the jobs, for example.
Right.
So this is in the user object.
So let's go here and let's just log what we have in the rec that usr.
And then let me go back to the Job II and take a look over here.
And if I go back to the server notice so this is my user already, this is what we're using to get the
jobs that are associated with user.
And also we have this one if test user.
True.
So like I said, the next step now is set up the middleware that effectively just checks for that property.
And if it's true, then we'll send back right away.
The bad request won the 401.
And then we'll stick that middleware in front of the all the routes we want to restrict access to.
So it's not going to be for all the routes.
I mean, at that point, then it doesn't make sense to create the test user.
But for certain routes, yes, we'll restrict them to the test user.
So let's go here with middleware.
I'm going to call this test user middleware, and we first want to get the bad request.
So bad request, we just need to remember about the index.
Just.
Let's go over here with us then.
Let's come up with that function test.
The user is equal to rec, whereas.
And next three things, and then we'll check if req user test user, we can clearly see that it is available
now in our.
If it's the case, then we'll go through new and then batch request.
So we go with 400, we'll say test user.
And will add read only.
Maybe exclamation point as well.
And then if it's not the case, if it's not a test, then we simply go with the next.
And now we want to go to all the roots.
Then we want to restrict access to.
So first, I guess let's go to bum, bum bum, bum, bum, bum, bum.
Let's start with jobs.
I guess.
Or you know what?
No, it's going to be faster if we go with our throats because we already have the middleware here.
So let me copy and paste and we'll just say, Here, test.
There.
And then it's not coming from Earth.
Of course it's coming from past years and where we want to place it.
Well, we want to place before update user.
Right.
So first we authenticate the user and then right after that we'll check for test user.
That's the case.
Then we send back the response.
Now here it complains that does not provide default.
And probably.
Yep.
Of course, I forgot to export this one.
My bad export default.
And then we go with best user.
So we export the function.
Now looks everything is working.
So now let's see whether we can update something.
I'm going to go to the profile.
And I my test is and let's say I'm going to try to change the name.
If everything is correct, I should get back to 400.
Yep.
We have a test user we don't like, so we have successfully restricted the access to the test user.
That's the user cannot change the profile.
Because otherwise, I mean, it wouldn't make sense.
So now we simply want to do the same thing with the rest of the rounds.
Now, in the off controller, pretty much everything stays the same.
The author out.
Sorry, we'll just use it here.
We want to add this one, though, to the jobs.
We want to go back.
We want to import it in the same folder so the path does not change.
And then we want to decide.
So we don't want the best user to create the job.
But we do want that all jobs.
So that stays the same show That stays the same.
But in here we go.
Test.
User.
As well as over here.
First user, let's say this and now let's check it out.