‫In the last video, we made it so that a person can't delete another person's listing.
‫Now we want to make sure that they can't edit the listing, and we're going to have multiple layers
‫here.
‫The first layer is going to be so they can't submit the form right because they don't own it.
‫The second layer is going to be that they can't even see this form.
‫And then the last layer is going to be they can't see the buttons if they're not the owner of the listing.
‫So let's start with the submission.
‫So that happens in the listing controller.
‫And we want to go to the update.
‫Right.
‫Because the form submits to the update method.
‫And I'm just going to copy this from the delete.
‫So just checking if owner past listing ID.
‫And so let's grab that.
‫Let's go down to update and go right here after we check if the listing exists.
‫Paste that in.
‫So we're using our authorization class and then the is owner method passing in the listing user ID the
‫listing is coming from here.
‫And then we're setting a flask message called error message.
‫And it says you are not authorized.
‫And we'll change this to update this listing.
‫And then we're redirecting to the show page which is fine.
‫So let's try this out.
‫I'm going to come over here and go to edit.
‫So this is not my listing.
‫So I'll just put a one on front end web developer and click save.
‫And I get redirected.
‫You are not authorized to update this listing.
‫And the title didn't change.
‫So that's the first step.
‫Next we want to make it so we can't even see this form.
‫So we're just going to basically just use this again and go to the edit.
‫Right.
‫Because that's where we show the form.
‫And let's put this just right at the top.
‫Okay now.
‫As far as as this right here, this isn't going to work, right?
‫Because we don't have the listing.
‫So there's a couple ways we could do it.
‫We could move it down or.
‫Yeah, let's do that.
‫Let's move this down under the listing here.
‫Same place.
‫So right before we load the view.
‫And let's reload the page and there we go.
‫So if I click edit, it doesn't even let me go to the page.
‫Now I don't even want to see these buttons if I don't own this listing.
‫Before we do that though, let's test our own listing and make sure that we can still see it and edit
‫it.
‫All right, so I don't have any listings, so let's post one.
‫Just say Brad's listing.
‫And just put some stuff in here.
‫Requirements.
‫Uh, what else benefits?
‫We'll say 401 K tags.
‫Development.
‫I mean, stuff doesn't really matter.
‫I don't even have to do this.
‫But.
‫Just makes it look a little more real.
‫Actually, let's change it from Brad's listing to, let's say, back end.
‫Web developer.
‫Okay, so let's save that.
‫So now we have backend web developer.
‫Now if I go to details, I click edit.
‫I can see the form because I own it.
‫Let's put a one in here.
‫Or let's change the salary to 70,000.
‫And.
‫Save it.
‫And there we go.
‫Listing updated salary has changed.
‫All right.
‫Cool.
‫So now let's get rid of the buttons if we don't own the listing.
‫So that's going to be in the views.
‫So let's go to let's see where are we showing this views listings.
‫And then the show page or the show view.
‫And we have the buttons right here.
‫So it's this div with the class of flex and space X for which ends right here.
‫So what we can do is just wrap this let's say PHP if.
‫Okay, so we'll wrap it in an if statement.
‫I'd say PHP and if.
‫And what I'm going to do is use the authorized authorization is owner method.
‫Now that's in the framework namespace.
‫So I can either bring use framework up top or since I'm only using it once I'm just going to put it
‫right in here I'll say framework slash authorization and then is owner.
‫And then we can pass in the listing.
‫And we want to get the user underscore ID field.
‫All right.
‫So if they're the owner then this should show.
‫So let's save that.
‫Let's go back to this page and reload.
‫And this is my listing.
‫So I'm able to see the buttons.
‫Let's go to front end developer, which is not my listing.
‫And now I can't see the buttons.
‫So we now have full authorization, right?
‫We have owners of listings and they can only manage their own listings.
‫So what I want to do next is this search form.
‫And then any other final touches or anything else that I think of will go in the next section.