In this section of the course, we want to get started on protecting roots on the front end, as you
recall, we already have middleware for the backend that allows us to check for a valid barer token,
but we actually don't have any such protection on the front end.
And of course, if you're building an application using react or view or something like that, this
isn't appropriate for you at all because those are single page applications.
But if you're building a multipage application, this is actually quite helpful and fortunately, it's
pretty easy to implement.
So I'm going to go back to my idea and I'm going to open up our existing middleware in the API folder.
OK, and I'm going to copy this entire function.
And now I'll close that and I'll go back to the middleware for the front end and I'll actually paste
that in there and we'll make some changes to it.
OK, so obviously this stuff doesn't work at all, so I'll get rid of this.
And what I'm going to put here instead is a really simple check.
I'm going to check to see if a certain value exists in the session.
And fortunately, that's really easy for us to do because we have that receiver app and that store secession.
So we'll simply check to see if not after session.
And I'll call the method built into that exists and then returns of Boolean.
And it requires two parameters, the context which we get from our context and what we're looking for
in the session.
And I'll look for something called user ID.
I'm going to assume that we're going to store the user ID in the session and if we find it, the user
is authenticated and if not, that user is not authenticated.
Really simple stuff.
OK, so if that's true, sorry.
If that's not true, if we can't find it and it resolves to false, then we'll just do a redirect redirect
and we'll redirect the user from using W in our as you have to take them to the login page.
And of course you can do whatever you want there and it needs some status.
And I'm just going to go with http dot status or temporary redirect.
Temporary redirect like that.
OK, and we return because we don't want to go any further.
So that is some middle where we can now use.
So let's open up our routes on the front end.
And what we want to protect, of course, is this one route, the virtual terminal page.
These two don't exist anymore.
Actually, they still exist.
I'm going to comment them out because we're not using them anymore.
And all we have to do here is the same sort of thing we did on the routes for the API marks dot route.
And we're going to go to slash admin, which means we're going to have to change some new URLs.
But that's pretty simple.
And we call function or funk, that's the danger with working with JavaScript and go, I'm always typing
func in JavaScript and function and go, but there you go.
And we'll pass it mux, which is a cheat mux or don't root for there.
And inside of here we'll just use that middleware.
So we say use or muxtape use after all.
And of course this is a different app off than the one on the back end.
And I'll just move this route from here right up to here and I'll leave these ones here.
But commented out in case you want to refer to those handlers at some point when you're reviewing the
source code.
So the next thing we have to do is to update this path again.
Virtual Terminal should now become admin's virtual terminal because we're actually preparing this to
the route.
So we'll go to the Base Lab. We'll find the link to the virtual terminal, which is.
Right there will just change that to admin now to find the rest of them.
I'm just going to go to my command folder and say find in folder and look for virtual Dasch terminal.
So Route's API, that's fine.
We'll ignore that one.
Handlers redirect to virtual terminal receipt.
That's not being called.
So it doesn't matter.
This one is fine rootstock.
Go still get virtual terminal.
That's fine.
And Bachelard and terminal page.
So terminal page there.
There's a link right there.
So let's open that one.
That's the button.
We put in a couple of lectures ago and that becomes admin's virtual terminal.
So now I should be able to start my application.
Let's make sure it's stopped.
It is.
And started.
Now let's go back to our Web browser and reload the homepage and I'll log in and log in as admin at
example, dot com with a password, password log in.
Now, at this point, even though I'm logged in, if I click on virtual terminal, I should get taken
to the login page because I don't have a user ID in my session.
We'll have to add that to the login logic before too long, but let's make sure that the protected routes
actually work.
And there we are taken back to the login page.
That's exactly what I wanted.
So in the next lecture will implement the logic that when a user logs in every store that value in the
session and when they log out, of course, we'll have to remove that value from the session.
But that's not terribly difficult and we'll get started on that in the next lecture.