So at this point, we've received the user input, we've retrieved the user and sent back an error if
we can't, and now we want to validate the user's password and of course, that's going to be culled
from create auth token right about here.
So let's go over to Helper's Dargo and let's create another method or another function.
So again, it'll be a function with the receiver of the application and we're going to call this one
simply password matches.
And it's going to take two arguments.
The hash which we pulled out of the database, that will be the hash of the user's password that we
have stored in the user's table.
And then it will actually take the password that the user entered on the form.
Both of those will be in the form of strings and we're going to return a bool.
True.
If we are able to log the user in and false if we're not able to log the user in and potentially will
return an error as well.
So this is a pretty straightforward process and it uses the decrypt package, which sometimes for reasons
I've never understood, Visual Studio Code has difficulty importing, but we'll give it a try.
So we'll check for an error.
And we're going to call Decrypt right there, dot compare hash and password and it takes two parameters.
And both of those have to be in the form of bytes of a slice of bytes.
So we'll simply cast to a slice of bytes.
The first argument is the hash, what we looked up at in the database.
And the second argument is also a slice of byte, and it is the password that the user entered on the
form.
And then we need to close this and check for an error if error is not equal to nil.
Now, in this case, there's a bunch of different errors we could possibly have, and I'm only going
to bother looking for two of them.
OK, and there are the two that really matter in the vast majority of cases.
So the first one, we're going to use a switch statement to check these will switch on case errors.
DOT is.
So if the error is and we're passing it, the errors we look at and then we'll use a constant from the
beaker package B creped.
Error mismatch password, and there's a tier error, mismatched hash and password, that's the constant
we're looking for.
OK, so if that's the case, will return false and No.
Otherwise, the next case will just make that the default and in this case will return false.
And the air, something went wrong.
Whatever it may be, but if we get past all of that, if we get past this if statement, then we return.
True.
Which means the passwords match.
So what this method compare hash and password does is simply look at the hash that we know is a valid
hash.
Then it takes the password and creates tries to create a hash from that.
And if those two actually match, then we have a valid password.
So that's all this does.
Very straightforward.
So let's go back to Handler API and it looks like there is an error and the error is once again, it
can't be imported.
I really don't know why it has difficulty doing that.
So let's go to our go mode and let it do a quick fix for us.
And it says here, Goaland Krypto is not, so we'll just choose quick fix it doesn't import it in there
for reasons I've never understood.
Hopefully they'll fix that by the time you take this course.
But I can fix it simply by rolling over a quick fix and clicking quick fix and choosing the menu item.
And that does the import for me.
Now, when I go back to Helper's, that error goes away.
So I think that's a bug in visual studio code, but that's how you fix it.
Pretty straightforward.
So now we can go back to Handler's API and we can validate the password.
So valid password, which I'm going to get back from the call to the function we just wrote, and potentially
an error or assign the value of AFG password matches and requires the hash which we got from the database
so that the user got password and requires whatever the user entered as a password, which is just user
input
password and we check for an error.
So if error is not equal to nil,
then we'll just send back the invalid credentials and just copy this.
Now, at this point, we might have a valid user, but we need to check to see if valid password is
true.
So we just say, if not valid password, then I'll just return those errors once again, invalid credentials.
So what that might mean is that the user entered the correct email address but didn't enter the right
password.
So we just sent back invalid credentials.
And that's all we have to worry about.
So the next step is to actually generate the token and send it back as part of this response.
Now, there's a couple of other things I wanted to draw to your attention back in Helper's Dargo.
In invalid credentials, I actually had left the quotation mark out of the Dreesen message, which was
a typo on my part.
And the other thing I left out, I was really sloppy for the last day or so is I hadn't actually added
the header HDB status bed request to the bed request function.
So I've added both of those in there and that was just an oversight on my part and I apologize for it.
So in the next lecture we'll get started on generating the token we need to send back as part of our
payload when all of these checks pass.