‫Okay.
‫So we're able to register a user, create a session, essentially log in after registering log out.
‫Now we need the ability to log in from from nothing.
‫So what we're going to do is have a method called authenticate.
‫So before we add that let's go to the login form.
‫So views listings and it's going to be sorry not listings users login.
‫And if we look at the form tag here it has nothing in it.
‫So we need to add a method which is going to be post and an action.
‫Which is going to be let's say slash auth and I'm going to call it.
‫We'll call the root login.
‫So auth login.
‫And then let's create that root.
‫So down here I'm going to copy that and let's say.
‫Auth login and it will call user controller.
‫And I'm going to call the method authenticate.
‫Just because that just makes a little.
‫Bit more sense to me.
‫We're authenticating a user.
‫I guess login is fine too.
‫So whatever you want to call it really doesn't matter.
‫It's just preference.
‫So in the user controller let's add that.
‫Authenticate a user with email.
‫And password.
‫And return void.
‫Authenticate.
‫All right, let's just try it.
‫Just make sure that the form actually submits.
‫Okay.
‫There we go.
‫Good.
‫So let's see.
‫Let's start off by obviously getting the data.
‫So we'll put that we'll put the post variables into regular variables.
‫Let's say email equals.
‫Post.
‫Email.
‫And the password.
‫Obviously the password comes in as plain text, but when we match it we have to match it with the hash,
‫and PHP makes that easy.
‫Using the password verify function.
‫So let's also create our errors array, just like we do with all our forms.
‫And then we're going to do some validation.
‫We're going to validate the email.
‫So let's say if not.
‫Validation.
‫Email pass in.
‫The email.
‫Then we're going to take our errors array.
‫And we're going to add email as the field.
‫And then for the value we'll say please enter a valid email.
‫So that takes care of that.
‫Then we want to validate the password length as well.
‫So I'll just grab this and let's say validate string.
‫So we're going to call our string method on the password.
‫Okay.
‫We don't have to call string on the email because obviously in order for it to check if it's valid,
‫it has to.
‫There has to be something there.
‫So password we just want to make sure that they actually enter something.
‫So password and let's say.
‫Password must be.
‫At least six characters.
‫Okay, so now let's check to see if errors is not empty.
‫So not.
‫Empty errors.
‫And if it's not empty, then we want to load the view again.
‫And that view is going to be user slash login.
‫And then we want to pass in an array with the errors so that we can display them.
‫And then after the load view, we'll just exit.
‫Okay.
‫So that's the first part.
‫Now let's go into the login view.
‫And we need to display the errors just like in the create.
‫Let's see.
‫We have this right here the partial.
‫We need to load that in the login as well.
‫So right under the age to just pass that in.
‫Now let's just go to this login page.
‫Refresh it and let's put in.
‫I'll just say test and password.
‫I'll do something less than six characters.
‫Okay, so the HTML five is validating the email address.
‫So if I want to test this I'll just change the type email to type text.
‫And then we'll try that again.
‫All right, so please enter a valid email.
‫Looks like the password didn't.
‫Didn't show though.
‫Um.
‫Oh, we need to pass in because by default the min is one, right?
‫So we want to say six for that.
‫Actually, let's do a max as well.
‫We'll say six and 50.
‫So now.
‫There we go.
‫Password must be at least six characters.
‫Okay, so now that we have that the validation, let's first check to see if the email exists.
‫We have to do two checks.
‫We have to make sure the email exists first.
‫And then we'll make sure that the password matches.
‫So let's go under this.
‫If where we check if the errors are empty let's just put a.
‫Comment here.
‫Check for errors.
‫And then let's say.
‫Um, check for.
‫Check for email.
‫So I'm going to pass in params or not pass in, but I'm going to create an array called params.
‫And then we're going to have email set that to email, because we're going to have this in our query
‫as a as a bound parameter.
‫So let's call this variable user.
‫And we're going to make our query.
‫So this DB query.
‫And the query we want to run is going to be select all from users where the email is equal to the placeholder
‫email, and then we pass in our params.
‫So you should you should really be clear on how to make queries.
‫Now it's pretty simple.
‫Anything that's user input is going to be a named parameter.
‫You're going to put that in the params array, and then you're going to pass that in after the query.
‫So pretty simple.
‫And then of course we need to call fetch since we're fetching this data.
‫And it's just one one user.
‫All right.
‫Now let's say if.
‫Not user.
‫So if the user doesn't exist, then we know that those are incorrect credentials.
‫So let's say errors and we'll use the email key.
‫And set that to incorrect.
‫Credentials.
‫We'll make this lowercase so incorrect credentials.
‫And then I'm going to load the view again just like I did up here.
‫So let's do this.
‫All right.
‫So let's try that out.
‫I'm going to go to this form again and let's do test at Test.com, which we know well that isn't a registered
‫email for me.
‫And then we'll do the password login and we get incorrect credentials.
‫Good.
‫So now the next step is the password.
‫So let's go under this.
‫And let's say check, check if.
‫Password is correct.
‫So to do that, remember the password that's being passed in is obviously plain text.
‫The password in the database is hashed.
‫So there's a very simple way to figure out if those two match.
‫And that is using the password underscore verify function.
‫So that's going to take in the plain text password.
‫And then it's going to take in the one in the database that's hashed which we can get from user.
‫Because if we're past this point that means the user exists and we have access to all of the user fields,
‫including the password.
‫So now we're going to check if that matches.
‫Actually, this is checking if it doesn't match and if it doesn't, then again, we want to just load
‫the view and we're going to say incorrect credentials.
‫Now this is something that I think is pretty important.
‫You don't want to have separate messages here.
‫You don't want to say, oh that email doesn't exist.
‫And then here say that password is wrong, because then people can check to see if an email exists.
‫And that's just that's just security, a security flaw that you don't need.
‫I mean, chances are it'd be fine, but why take that risk?
‫Just have the same message.
‫That way people can't tell if the user exists or not.
‫Okay.
‫So yeah, I think that I think that's good.
‫Now if we get past this, that means everything is past the email matches and the password matches.
‫So now we can set the user session just like we did with the register.
‫In fact I'll just copy that.
‫So up here.
‫In create the register.
‫I'm going to grab this let's say set.
‫User session.
‫So grab that and the redirect.
‫And we'll put that right here.
‫Okay.
‫So this needs to be a little different because right now what we're doing is fetching the user from
‫the database.
‫So we don't have this user ID anymore.
‫Here we're going to say user ID.
‫So the user coming from the database ID and then the user coming from the database name.
‫User email.
‫User.
‫City.
‫And user state.
‫And that will set the session and redirect.
‫All right cool.
‫So let's try this.
‫So I should have let me just check with workbench.
‫So if I search my users yeah I have a Brad at Gmail.
‫So I'm going to use that.
‫Brad at gmail.
‫And remember the passwords hashed.
‫It's 123456.
‫Or it should be, if I remember correctly.
‫But in the database it's hashed.
‫So it's going to match this.
‫This is just dummy stuff.
‫This other I mean I know those are plain text passwords.
‫I mean you could delete those if you want, but we do have the users connected to a listing.
‫Although we might I might change that later on.
‫So let's just try this login.
‫And there we go.
‫We have welcome Brad Travis.
‫And we can log out.
‫Cool.
‫Now, actually, you know, what I'm going to do is, I mean, it's up to you if you guys want to do
‫this, but I'm going to take this hash right here.
‫And I'm going to add it to these other.
‫Just so.
‫Just so it's hashed.
‫And we have to click apply for this to work.
‫So apply.
‫Okay.
‫So that was changed in the database.
‫Now let's go back to.
‫In and I'm going to try user one at.
‫Gmail.
‫And now notice up here it says welcome John Doe.
‫So the session set for me is for this user, John Doe.
‫All right.
‫Cool.
‫So I think that what we'll do next is authorization.
‫Because right now, yes, we can authenticate.
‫And that's great.
‫But what is it good for right now?
‫I mean, it doesn't we're not doing anything with that user.
‫So we want to be able to make it.
‫So only logged in users can for instance, create a post.
‫And then we want to make it so only the user that owns the post, or I should say listing can edit and
‫update that.
‫So we're going to use middleware so that we can add it to our routes.
‫Right.
‫So if we have in our routes file for instance let's say listings create.
‫And we only want that page to be available to authenticated users.
‫I want to be able to pass in an array where we can say only auth users can can access that okay.
‫So we're going to this will be the should be the last refactor of the router.
‫So we're going to get into that next.