1 00:00:00,600 --> 00:00:08,130 In this video, let's create a controller to delete a post so inside the controllers and post, let's 2 00:00:08,130 --> 00:00:11,340 locate the controller, which is this one. 3 00:00:11,790 --> 00:00:19,440 So here, let's add commands by saying delete posts and we are going to use Mongoose method called find 4 00:00:19,440 --> 00:00:21,400 by ID and delete. 5 00:00:21,420 --> 00:00:34,200 So going to be as const deleted post is equal to await the post model dot find by ID and delete and 6 00:00:34,200 --> 00:00:41,510 are passed in the ID which can be found and rec the params dot id and that is it. 7 00:00:41,520 --> 00:00:47,910 But for the deleting of a post, I don't want to send back the post that has been deleted, but if we 8 00:00:47,910 --> 00:00:49,410 want to do that, why not? 9 00:00:49,410 --> 00:00:51,120 You can go ahead and do that. 10 00:00:51,120 --> 00:00:59,040 But I'm going to send a message by saying that post has been deleted successfully. 11 00:01:00,730 --> 00:01:01,240 All right. 12 00:01:01,240 --> 00:01:08,050 So let me use the data here and then let me pass in next to handle any error here. 13 00:01:08,050 --> 00:01:16,390 So inside the catch our code next pass in the app error, and then the message has error message. 14 00:01:16,570 --> 00:01:21,700 So let me remove the response and this is what I want. 15 00:01:21,820 --> 00:01:28,900 So let's get back to the deleting and remember this one going to be a protected endpoint, meaning that 16 00:01:28,900 --> 00:01:32,890 unless you are logged in before you can delete a post. 17 00:01:33,070 --> 00:01:41,560 So let's get back to the root and post and post the gist and let's look at the delete, which is this, 18 00:01:41,560 --> 00:01:44,590 and let's pass in the middleware called protected. 19 00:01:45,310 --> 00:01:52,630 So let's get back to the tender client and let me find all post first before I can take the ID. 20 00:01:53,020 --> 00:01:55,090 We have all the post here. 21 00:01:55,120 --> 00:01:59,620 Let's say I want to delete the first one called No Node.js. 22 00:01:59,710 --> 00:02:08,530 So let me get back to delete here and pass in the ID and click on send and you can see post has been 23 00:02:08,530 --> 00:02:10,270 deleted successfully. 24 00:02:10,539 --> 00:02:12,880 But here is a problem guys. 25 00:02:12,880 --> 00:02:21,010 It means that any log in user can delete any post from our endpoint and we need to avoid that. 26 00:02:21,010 --> 00:02:25,240 Let's go ahead and register a new user and I'll show you what I mean. 27 00:02:25,240 --> 00:02:29,230 So let's get back to the users and register for this one. 28 00:02:29,230 --> 00:02:37,420 I'm going to register email and then the email is going to be as email at gmail.com hit send. 29 00:02:37,930 --> 00:02:40,600 And I have been registered successfully. 30 00:02:40,600 --> 00:02:44,530 So let me go ahead and look in before I can create a post. 31 00:02:44,530 --> 00:02:51,940 So I'll click on, log in and I'll provide the email password for five and hit send. 32 00:02:52,330 --> 00:02:58,480 Now I have logged in as IMA, but not John, so let me go ahead and create a post. 33 00:02:58,480 --> 00:03:01,180 So inside the post, which is this one. 34 00:03:01,180 --> 00:03:04,930 Now I'm going to create a post in my name that is email. 35 00:03:05,080 --> 00:03:10,320 So in here I'm going to create a post called Main Stock and call. 36 00:03:10,360 --> 00:03:12,550 This one is great. 37 00:03:13,540 --> 00:03:15,130 And we're going to be. 38 00:03:15,160 --> 00:03:15,820 Category. 39 00:03:15,850 --> 00:03:16,560 JavaScript. 40 00:03:16,570 --> 00:03:17,260 That's okay. 41 00:03:17,260 --> 00:03:20,920 And I want to send the same image so I'll hit send. 42 00:03:21,680 --> 00:03:27,170 I got this error, meaning that I'm not providing the title, so let me check the title and hit send 43 00:03:27,170 --> 00:03:27,650 again. 44 00:03:28,570 --> 00:03:37,600 And you can see that it has been created successfully and the user is IMA with the ID of 843 at the 45 00:03:37,600 --> 00:03:38,100 end. 46 00:03:38,110 --> 00:03:43,180 So let's check if indeed is the ID which is the same as this. 47 00:03:43,390 --> 00:03:47,740 So this means that this post was created by IMA. 48 00:03:47,770 --> 00:03:50,860 But let me go ahead and look in as John. 49 00:03:51,940 --> 00:03:52,920 Which is this. 50 00:03:52,930 --> 00:03:58,510 So when I look in at this now, I have log in as door with this email. 51 00:03:58,540 --> 00:04:03,010 Now, because I've looked in, I can delete emails, posts. 52 00:04:03,190 --> 00:04:08,820 So let's get back to find all posts and let's find the main stock, which is this. 53 00:04:08,830 --> 00:04:15,670 Remember, this post was created by email, but I can go ahead and delete so I'll copy the id. 54 00:04:15,820 --> 00:04:18,550 Remember I have log in as do. 55 00:04:18,579 --> 00:04:26,890 So I'll provide the ID here and I'll hit send and you can see that I'm able to delete a post owned by 56 00:04:26,890 --> 00:04:27,610 somebody. 57 00:04:27,700 --> 00:04:29,260 So let's avoid that. 58 00:04:29,260 --> 00:04:33,490 So inside the controller for deleting, let's have some step. 59 00:04:33,790 --> 00:04:37,570 Step number one is we are going to find the posts. 60 00:04:37,570 --> 00:04:43,960 So I'm going to be asked that, find the post and I'm going to be as concerned. 61 00:04:43,960 --> 00:04:53,290 Post found or post for shots is equal to await the post model dot find by ID and the ID can be found 62 00:04:53,290 --> 00:04:55,900 under red dot params dot ID. 63 00:04:56,200 --> 00:05:03,310 Now, after finding the post, we are going to check if the post belong to the logged in user. 64 00:05:03,310 --> 00:05:04,870 So the comment goes like this. 65 00:05:04,870 --> 00:05:13,210 Check if the post belongs to the user, meaning the log in user and going to be as if remember on the 66 00:05:13,210 --> 00:05:17,440 post we have a field called user, which is this. 67 00:05:17,530 --> 00:05:25,090 We are going to check the value of this user If it is equal to the ID of the log in user, then that 68 00:05:25,090 --> 00:05:27,070 post belong to that person. 69 00:05:27,070 --> 00:05:38,110 So in here we are going to check if post dot user remember it's an ID if it is not equal to the log 70 00:05:38,110 --> 00:05:42,040 in user, which is rec dot session. 71 00:05:43,560 --> 00:05:45,780 Dart user of. 72 00:05:47,400 --> 00:05:54,870 Then you go ahead and then return from this function by calling next, and then you provide the up arrow 73 00:05:54,870 --> 00:06:00,660 and pass in the message by saying that you are not allowed to delete this post. 74 00:06:00,670 --> 00:06:03,840 So the message goes like this. 75 00:06:04,620 --> 00:06:06,900 And now provide the status code. 76 00:06:06,900 --> 00:06:09,720 As for oh three, not authorized. 77 00:06:10,170 --> 00:06:10,890 Perfect. 78 00:06:11,370 --> 00:06:16,980 This expression will always retain force because we are comparing an object. 79 00:06:16,980 --> 00:06:21,950 Remember the value of the ID in a DB is an object but not a string. 80 00:06:21,960 --> 00:06:30,660 So unless we convert to string as to string, likewise the log in user also to string. 81 00:06:30,660 --> 00:06:32,160 And that is it. 82 00:06:32,310 --> 00:06:39,090 So let me go ahead and log in as IMA and create a post and let's see the message. 83 00:06:39,180 --> 00:06:41,280 So I have logged in. 84 00:06:41,280 --> 00:06:50,640 Let me provide the actual password for five sent and let me create a post with the same data and hit 85 00:06:50,640 --> 00:06:51,180 send. 86 00:06:51,750 --> 00:06:54,690 And here I have the user ID here. 87 00:06:54,720 --> 00:06:58,560 So if I look in as do. 88 00:07:00,340 --> 00:07:03,140 Now I have looked in as though. 89 00:07:03,160 --> 00:07:08,320 So let's go ahead and then delete a post that has been created by Emma. 90 00:07:08,470 --> 00:07:10,720 So let's find a posts. 91 00:07:10,900 --> 00:07:14,800 And this is a post that I just created in the name of Emma. 92 00:07:14,800 --> 00:07:18,190 So I will copy the ID and delete. 93 00:07:18,190 --> 00:07:20,920 Let me place the ID here and hit send. 94 00:07:21,950 --> 00:07:23,270 And here you go. 95 00:07:23,270 --> 00:07:30,080 You can see that you are not allowed to delete this post, meaning everything is working fine. 96 00:07:30,110 --> 00:07:33,890 The next video, Let's go ahead and update a post.