‫So now we're going to create some middleware to authorize users for certain routes.
‫Now middleware is essentially software or code that sits between a web application and web server.
‫And it acts as a bridge to process and manipulate requests and responses.
‫So our middleware will look at the incoming request route, and it will look at the roles that are sent
‫with that and determine how to route that request.
‫So should it.
‫If the user is not logged in and the role is off, then it needs to redirect them back to whatever the
‫login page.
‫If they're if it's made for guests and the user is logged in, then redirect them to the home page,
‫something like that.
‫All right.
‫Now.
‫So that makes it middleware is it's kind of sits between the request and the response and what we want
‫to do with it.
‫So let's create this in framework because it is a core part of our application.
‫And I'm going to create a folder in framework called middleware.
‫Because you can have other middleware for logging, for validation for many things.
‫So ours is going to be called authorize dot PHP.
‫And that's going to be the name of our class.
‫Now I'm going to give this a namespace.
‫So middleware will have its own namespace at framework.
‫Framework slash middleware.
‫So that's what we want to use as a namespace.
‫And we're going to use sessions in this class.
‫So we have to make sure we bring in framework.
‫Slash session.
‫And then we'll create our class of authorize.
‫I don't know why I did that.
‫So class authorize.
‫And then basically we're going to have two methods here.
‫One is going to be called handle.
‫That's the main method we're going to call.
‫And that's going to take in a role which could be auth or guest or whatever.
‫And then we have to decide if the user or figure out if the user is authenticated and figure out which
‫where to send them.
‫So let's create that.
‫We'll create a little comment here.
‫Let's say handle the.
‫Handle the users.
‫I guess redirection or handle the users.
‫Request any way you want to put it.
‫And let's give it a param, which is going to be a string, which is going to be called role.
‫And it's going to return.
‫This is actually going to return a boolean.
‫So let's say return bool.
‫So public function.
‫Handle.
‫And this is going to be called in our router.
‫So we do have to refactor our router a little bit.
‫This is going to get passed in role.
‫And then I'm going to create another method right above it that will just figure out if the user is
‫actually authenticated if they're logged in.
‫So let's.
‫Add that and say check.
‫If.
‫User is authenticated.
‫We could do it all in one function, but I think it's a little neater to break it up.
‫Let's see.
‫And that's going to it's not going to take in anything and it's not going to.
‫Return anything.
‫Uh.
‫I'm sorry.
‫It is.
‫It's going to return a boolean bool.
‫So now let's say public.
‫Public function is.
‫Authenticated.
‫And all we have to do here is simply return using our session class.
‫We can just say has.
‫And pass in user.
‫So do we have that user?
‫Does the user have a session?
‫If it does, it will return true.
‫If not, it will return false.
‫Now what we want to do is in the handle we're going to do a check.
‫Let's say if the role is equal to guest.
‫And.
‫This.
‫Is authenticated.
‫So basically what we're saying here is the role is for the root is meant to be for guests.
‫And but I should say we're authenticated.
‫So we don't want that.
‫Right.
‫So if they're logged in and the login form is supposed to be for guests, then we don't want them to
‫access it.
‫So what do we want to do.
‫We want to let's return a redirect and we'll redirect them to the home page okay.
‫And then let's do else if.
‫So else if the role is.
‫Equal to auth and they're not authenticated.
‫So we'll say not this.
‫Is authenticated.
‫Then let's return.
‫Redirect.
‫Which is the same as doing a redirect and then a return.
‫So then we'll redirect to slash auth slash login so that they can log in so that they can access that
‫authenticated route.
‫Okay.
‫So hopefully that makes sense.
‫Now where we're going to use this is going to be in the router.
‫So make sure you just have this and then we can close it up.
‫Let's go to our router which is right here.
‫And in order to use this we have to add at the top here use.
‫Framework middleware authorize.
‫So you can see this is starting to look more like Laravel or Symphony, just much, much simpler.
‫Now, when we pass in, I'm going to just go to the roots PHP file.
‫And when we pass in something like let's say for the create form, we're going to be passing in an array
‫of roles like auth.
‫So we want that to get passed in.
‫To the method to get right because that's what it is.
‫It's the Uri, the controller and the middleware array.
‫So the Uri, the controller and.
‫The middle don't want capital middleware array, which is going to be set to just empty by default.
‫And in order to register the root, we have to pass it into register root as well.
‫Right.
‫So we'll pass in middleware.
‫And then we're just going to add that parameter here as well.
‫So param array.
‫Middleware.
‫Now, since we're passing it into register route, we have to basically catch it up here.
‫So let's say middleware.
‫Middleware and set that to an empty array.
‫And then that's going to get passed in here in the the routes array.
‫So right here.
‫Set that to middleware.
‫All right.
‫Now we have to do this.
‫Actually let's add the params as well.
‫In the.
‫Right here.
‫And then we have to add this same thing middleware here, as well as in the register route for the rest
‫of these.
‫So let's pass in say middleware.
‫Set that to empty.
‫And then pass that in here.
‫I know it's kind of a pain, but at least we cleaned it up so that we're passing it in register, right?
‫And we don't have to do this in every single method.
‫Paste that in.
‫See?
‫It's going to be an empty array.
‫Pass it in here.
‫And then finally delete.
‫All right.
‫So now the last thing we need to do is in the main route, the method here.
‫This is what basically handles everything.
‫We don't need to touch any of this.
‫We just need to go down to after everything is matched and we know which route we're loading, then
‫we're going to loop through the middleware array because there might be more than one like we might
‫have auth, you might have admin you can add on to this.
‫You can add functionality to this.
‫So let's loop through that by doing a for each right here.
‫And say for each and then route middleware.
‫I will say as middleware.
‫And then what we want to do is, is instantiate a new authorize instance.
‫So in parentheses here I'm going to say new.
‫Authorize.
‫And then I'm going to call.
‫So I put parentheses here because I'm not using a variable.
‫And I'm just going to directly call handle which is the method we created in the authorized class.
‫Remember that takes in a role.
‫And that role is going to be in this middleware actually.
‫I mean we could have called this role because that's what it is that's coming in is auth guest admin,
‫whatever, whatever role that is passed into the root.
‫So let's save that now.
‫We can test it out.
‫So right here I have auth in the create.
‫So listing slash create.
‫So make sure that's saved.
‫And I'm not logged in right now I'm just going to reload.
‫And I'm going to go to slash listings slash create.
‫And I shouldn't be able to go to it.
‫And I'm not I'm redirected to login which is perfect.
‫All right.
‫Now just figure out what else is for authenticated users.
‫The home controller.
‫No, obviously home page.
‫We want everybody to go to edit.
‫Yeah, you should probably be authenticated for that.
‫I'll just copy this.
‫Okay, let's see listings.
‫The show page?
‫No.
‫I think that everyone should be able to see the show page.
‫The store, obviously.
‫Yes.
‫You want to be authenticated for that?
‫Um, this is the update.
‫Yes.
‫The delete.
‫Yes.
‫The register page.
‫Now the register and login.
‫We actually don't want a user to go to those pages if they are logged in.
‫So those are actually going to have guest middleware.
‫So there.
‫And there.
‫And remember, in our authorize right here, we're checking for that.
‫If the role is guessed and they're logged in, then redirect to the home page and we'll test that in
‫a minute.
‫So guess for those two.
‫And.
‫What else?
‫The authenticate.
‫So this right here this is to to log in.
‫So they're going to be guess for that.
‫And then to.
‫Uh.
‫To store register.
‫Yeah, that's going to be guest.
‫Log out.
‫Log out is going to be auth.
‫Because obviously you need to be authenticated if you're logging out, store to register.
‫That's going to be that's going to be guest.
‫All right, so, yeah, that looks good.
‫And you don't have to pass in middleware like for the for these.
‫We're not right for the show.
‫We're not.
‫But let's see if I try to go to.
‫I don't know.
‫Let's let's go to a show page.
‫That should work for us no matter what.
‫If I try to hit edit though, I get redirected and I'm going to.
‫We're actually going to get rid of these unless you're logged in and unless you own the listing, we're
‫going to do that in a little bit.
‫But let's try logging in now and testing the guest the guest role.
‫So let's see Brad at gmail.
‫So now obviously the login and register links are gone, but if I try to manually go to auth slash register,
‫I get I get redirected to the home page, which is what I want.
‫All right, so I really hope you guys can see how this is working.
‫Right.
‫So it starts here, gets passed in and it's passed in to whatever whatever method it is.
‫Get post et cetera.
‫Then it's passed into register route.
‫Then it's added to the routes array.
‫And then it's looped through down here.
‫And then for each middleware or each role, it's calling handle and it's checking to see in here.
‫It's checking to see what the deal is.
‫Is it a guest.
‫Are you authenticated.
‫Are you not.
‫Is it auth whatever.
‫And of course you could add more stuff in here for admins or whatever you'd like.
‫All right.
‫Cool.
‫So next we're going to start on the authorization where you know, we don't want even though I'm logged
‫in right now.
‫I can delete or edit any of these listings, even if they don't belong to me.
‫And we don't want that.
‫We only want people that own the listings to be able to manage them.
‫So we'll start that next.