‫All right.
‫So now what I want to do is be able to delete a listing, but I only want to be able to delete the listing.
‫If I own it right now, I can delete any listing.
‫So I think the first step here is to make it so that when we create a listing, our user actually gets
‫saved with it.
‫Because if you remember, if we go to our controller, our user controller, I'm sorry, our listing
‫controller, and we go to where we store the listing.
‫Let's see.
‫Where is it?
‫Um.
‫Store store right here.
‫So I'm setting the user ID to one.
‫So I don't want to do that.
‫I want to set it to my user ID that I'm logged in as.
‫So that's easy to do.
‫All we have to do is change that to use our session class.
‫And then we can say get.
‫Let's close that sidebar up.
‫We can say get.
‫User which remember is an array.
‫So we want to add here brackets an ID.
‫So that should be whatever.
‫Whatever my logged in user ID is should then get put in that before my listing gets added.
‫Now in order to use session I do have to bring it in up here.
‫So up at the top let's say use framework.
‫Slash session.
‫Okay.
‫And we can test that out real quick.
‫So let me just go to post job and I'm just going to put some junk in here.
‫Let me just say test.
‫Listing.
‫Doesn't really matter.
‫Test whatever.
‫Whatever.
‫Whatever doesn't matter.
‫Test at test.
‫Okay.
‫So let's save.
‫And now we have that listing.
‫And notice that listing only shows on the all jobs.
‫If I go to the home page it doesn't because it only shows the six.
‫Now one thing I just realized this second is that it's not in the right order.
‫We should have the most recent jobs here.
‫So let's let's just put a little pin in what we were just doing and let's go to the home controller.
‫And all we have to do is edit the query right here.
‫So select all from listings right before limit six.
‫Let's say order by.
‫Created at underscore at and descending and then limit six.
‫So if I do that and then I come back to the home page.
‫Now my test listing is first which is what I want.
‫If on show all jobs.
‫If you want the test listing to be first, you can do actually.
‫Yeah, let's do that there as well.
‫So in addition to the home controller, let's go to Listing Controller Index and select all from listings
‫order.
‫Uh, order by.
‫The created at.
‫And we want it descending.
‫So refresh.
‫There we go.
‫All right, so back to what we were doing on the details page.
‫Actually not the details.
‫That doesn't show the user ID.
‫I want to go to the database and show you.
‫So in the workbench if I go to listings and I fetch all my listings, you'll see that the user ID for
‫test listing is six.
‫I know this is really small text, but it's six.
‫And if I go to my users, right?
‫So if I look at the users, my Brad at Gmail user is id six.
‫So whatever user is logged in when they submit that listing, that's what's going to be put in that
‫that record.
‫All right.
‫Cool.
‫So we get that done.
‫Now let's make it so that I can only delete my own posts.
‫So.
‫Let's go to the destroy.
‫So listing controller and then destroy because that's where it gets deleted and we can go.
‫Under.
‫Let's see.
‫Right under where we check to see if the listing exists.
‫In fact, I should probably have a comment here.
‫Check.
‫If a listing exists, I might go around and add more comments along the way, but we want to do this
‫before it gets deleted.
‫So let's say authorization.
‫And we'll just do it.
‫We'll just kind of.
‫We'll just use the session here directly, but I think we should create a separate class to do this,
‫and I'll show you that in a second.
‫But let's just say session.
‫Get.
‫So we just need to say if the session user ID remember user is an array that this isn't the ID itself,
‫it's an array that has the ID in it.
‫And then we'll say if that is not equal.
‫If that's not equal to the listing.
‫User underscore ID.
‫Oops.
‫Just close that up.
‫So if that's not equal to that, then we know.
‫That that user is not.
‫Doesn't own the listing.
‫So we could do our flash message.
‫We could say session.
‫And by the way, we're going to create a set flash message in our session class.
‫But for now we'll just hard code it with or we'll just use a superglobal.
‫So let's say error underscore message.
‫And we'll say what do we want to set this to.
‫You are not.
‫Authorized to delete this listing.
‫And then we'll redirect.
‫And let's redirect to.
‫Let's return redirect.
‫To slash listings, slash and then whatever the the ID is.
‫So we'll concatenate.
‫Listing or.
‫Actually, no.
‫It's just.
‫Think we could just do ID, right?
‫Yeah.
‫Well, let's do listing ID.
‫Okay, so let's try this out.
‫I'm going to go to one of these other ones that I don't own.
‫Right.
‫So any of these and if I click delete you are not authorized to delete this listing.
‫If I go to my own, let's go back to listings and go to the test one and delete.
‫And that deletes.
‫Fine.
‫Okay.
‫Now you can leave it like this if you want, but I think we should put this in a class.
‫Now, as far as naming goes, it's a little tough because we have middleware called authorize.
‫I'd like to call this class authorize, but that I don't know.
‫I don't want it to get confused with that.
‫So I guess we'll just call it authorization.
‫So let's say authorization.
‫And this is not middleware.
‫So it's not going to go in the middleware folder.
‫So it doesn't have that namespace.
‫So we could in fact call it authorize.
‫So authorization and and this is going to be pretty simple.
‫It's going to have just one static method called is owner.
‫So it's just going to check to see if it's if it is the owner of the listing.
‫So let's add namespace.
‫Framework.
‫And we're going to be using sessions.
‫So we want to say use framework.
‫Slash session.
‫Class authorization.
‫I didn't spell that right.
‫Authorization.
‫Okay.
‫So let's do we'll have a comment here.
‫Check if.
‫Current logged in user owns a resource.
‫And this doesn't have to be just for listings because the resource is going to get passed in as a as
‫a param.
‫So let's say at param.
‫And and it's going to be a resource ID.
‫So resource ID and it's going to return a boolean.
‫So public static function is.
‫Owner.
‫And that's going to take in a resource ID.
‫And then what I'll do is just.
‫Let's see.
‫Let's let's set a variable here to session user and get that from session get user.
‫And then we'll say if that.
‫If that session user is not equal to null and is set.
‫Session user ID.
‫Okay.
‫So just see if that session user exists then let's say session user.
‫Is going to equal that our session user ID sorry is going to equal.
‫And I'm going to just cast it to an int.
‫And then session user.
‫ID, so we're just putting that into its own variable.
‫And then I'm going to return if the session.
‫Whoops.
‫I'm going to return if session user ID is equal to the resource.
‫ID so if that's true, then we know that it matches and the user is the owner.
‫If not, then we're going to return false.
‫All right.
‫So now what we can do is go back into the listings controller.
‫Let's bring this in.
‫So up top here we're going to say use use framework slash authorization.
‫And then down back where we.
‫Let's see in the destroy.
‫So now right here, we can change this up a little bit.
‫We can say instead of checking the session like that, we can say.
‫If not.
‫Author.
‫Authorization.
‫If not authorization is owner and then pass in the owner.
‫So listing and then user underscore ID.
‫Then we'll show the error message and redirect.
‫So let's try that.
‫So I'm going to go back to one of these other listings and click delete.
‫And I can't do it if I post a job.
‫Okay, so this is mine right here.
‫If I delete, then it works.
‫Okay, now I know it can be a little confusing with the authorized middleware and authorization.
‫So I mean, you can change it to something else if you want.
‫I just think that makes the most sense.
‫So yeah, I mean, now we can only delete our users.
‫Now I don't even want to see the delete and edit, but we're going to we'll do that after I think what
‫I'd like to do next.
‫Is is instead of doing this setting flash messages like this in such a manual way, I think we should
‫have in our session class.
‫We should have methods to set to set and get flash messages.
‫So let's do that next.