Live class 83 User Model Authentication Continued

AI Summary

An AI-generated summary of this video lecture.

This lecture continues the development of a MERN stack authentication system, focusing on securing user passwords and implementing user-specific features. The session begins by addressing the critical security vulnerability of storing plain text passwords in a database, introducing the bcryptjs package as the solution. The instructor demonstrates how to hash passwords before saving them to MongoDB, ensuring that even if the database is compromised, user credentials remain protected. The lesson then transitions to implementing a login mechanism that verifies hashed passwords using bcrypt.compare(). Subsequently, the curriculum shifts to enhancing user functionality by integrating a 'favourite homes' feature directly into the User model, replacing a separate Favourite model. This refactoring involves modifying Mongoose schemas, updating route handlers for adding and removing favorites, and debugging common errors such as ReferenceErrors and model name mismatches. The session concludes with the successful implementation of a 'Host Homes' view, allowing users to manage their own property listings.

Chapters

1. 0:00 – 2:00 00:00-02:00

   The video begins with connectivity issues, showing a black screen labeled 'Host' and alternating between the instructor's feed and empty space. No educational content is visible during this initial window, indicating technical setup or connection instability before the lecture officially commences. The asset title 'Live class 83 User Model Authentication Continued' is visible, setting the context for the session.

2. 2:00 – 5:00 02:00-05:00

   The instructor reviews the existing signup logic in authController.js, highlighting how user details are extracted from req.body to create a new User instance. A slide titled '19.8 Encrypting Password' appears, explicitly stating the problem with plain text passwords and introducing the bcryptjs package as the necessary tool for securing credentials before storage.

3. 5:00 – 10:00 05:00-10:00

   The lesson details the four-step process for password encryption: understanding plain text risks, installing bcryptjs, hashing before saving, and recognizing that the server never stores actual passwords. A diagram illustrates the transformation from plain text to a hashed value, emphasizing that bcrypt is used for this one-way encryption process.

4. 10:00 – 15:00 10:00-15:00

   The instructor implements password hashing in the postSignup function using bcrypt.hash(password, 12). The code shows importing the library and updating the user object to store hashedPassword instead of the raw password. Terminal output confirms the npm install command for bcryptjs, and the slide reiterates the method usage.

5. 15:00 – 20:00 15:00-20:00

   The signup endpoint is tested, showing the terminal output of a successfully created user object with hashed credentials like '$2a$12...'. The instructor verifies the data in MongoDB Compass, confirming that plain text passwords are no longer stored. This validates the implementation of secure password storage in the database.

6. 20:00 – 25:00 20:00-25:00

   The focus shifts to the login logic in postLogin. The code implements User.findOne(email) to retrieve user data and checks for existence before proceeding. Error handling is added using try/catch blocks, specifically checking if a user exists and returning an error message 'User not found' to the frontend view.

7. 25:00 – 30:00 25:00-30:00

   The instructor demonstrates the full login flow, including bcrypt.compare(password, user.password) to verify credentials. Upon a successful match, the session is established with req.session.isLoggedIn = true, followed by a redirect to the home page. A slide outlines these steps: reading input, checking user existence, and comparing passwords.

8. 30:00 – 35:00 30:00-35:00

   The session transitions to '19.10 Adding User Functions'. A slide outlines tasks: modifying the User Model to include a 'favouriteHomes' array, removing the separate Favourite Model, and making favorites user-specific. The instructor explains that navigation bar items should display based on userType.

9. 35:00 – 40:00 35:00-40:00

   The instructor demonstrates backend signup logic again, showing bcrypt.hash(password, 12) and user.save(). MongoDB Compass confirms a new user record with hashed credentials and 'guest' userType. This reinforces the secure storage pattern before moving to new feature implementation.

10. 40:00 – 45:00 40:00-45:00

    The User Model schema is modified to include a 'favouriteHomes' field, defined as an array of ObjectIds referencing the Home model. The code shows const homeSchema = new mongoose.Schema({...}) and the addition of favouriteHomes: [{type: mongoose.Schema.Types.ObjectId, ref: 'Home'}]. The frontend Favourites page is tested to display saved homes.

11. 45:00 – 50:00 45:00-50:00

    A ReferenceError occurs in the terminal related to authentication/views/host-hosts.js. The instructor inspects the postAddFavourites function and switches to MongoDB Compass to verify the users collection. This debugging step highlights checking data structure before fixing backend logic errors.

12. 50:00 – 55:00 50:00-55:00

    The instructor debugs the getFavourites route, initially encountering a 'Favourite is not defined' error. The model name is corrected to 'Home', and the code uses Home.findByIdAndDelete(homeId) for removal. The final output shows a working favorites page with delete options and session data verification.

13. 55:00 – 60:00 55:00-60:00

    The lecture covers the 'Host Homes' feature, showing code for fetching registered homes and rendering them on a frontend page. A syntax error causes the server to crash, but it is resolved, and the server restarts successfully. The terminal displays 'All Host Homes' with pricing details.

14. 60:00 – 65:00 60:00-65:00

    The instructor continues debugging the Host Homes route, ensuring session data is correctly passed to the view. The code exports.getHostHomes handles async/await logic, and the frontend displays cards for each registered home. The instructor verifies that only logged-in hosts can access this specific view.

15. 65:00 – 70:00 65:00-70:00

    The session reviews the complete authentication flow, from signup hashing to login verification. The instructor emphasizes the importance of bcrypt.compare() for security and how session management persists user state across requests. The code structure is revisited to ensure all routes are properly protected.

16. 70:00 – 75:00 70:00-75:00

    The instructor demonstrates how to handle edge cases in the favorite homes feature, such as preventing duplicate additions. The code checks if a home ID already exists in the user's favouriteHomes array before pushing it. This ensures data integrity and prevents redundant entries.

17. 75:00 – 80:00 75:00-80:00

    The lecture covers the removal of favorites, showing how to filter out a home ID from the user's array. The code uses User.findByIdAndUpdate with $pull to remove the specific ObjectId. This operation is tested in MongoDB Compass to confirm the change in the user document.

18. 80:00 – 85:00 80:00-85:00

    The instructor finalizes the Host Homes feature, ensuring that only hosts can view and manage their listings. The code checks req.session.userType === 'host' before rendering the page. This role-based access control is verified through terminal logs and frontend navigation.

19. 85:00 – 86:42 85:00-86:42

    The session concludes with a summary of the implemented features. The instructor reviews the final code structure for authentication and user functions, highlighting the successful integration of password hashing and user-specific favorites. The class ends with a final check of the application's stability.

The lecture systematically builds a secure authentication system and user-specific features for a MERN stack application. It begins by addressing the critical security flaw of plain text password storage, introducing bcryptjs to hash passwords before database insertion. The instructor demonstrates the implementation of signup and login controllers, emphasizing bcrypt.hash for encryption and bcrypt.compare for verification. Session management is established to maintain user state after successful login. The lesson then evolves into enhancing user functionality by integrating a 'favourite homes' feature directly into the User model, replacing a separate Favourite model. This refactoring involves schema modifications to add an array of ObjectIds, updating route handlers for adding and removing favorites, and debugging common errors like ReferenceErrors. The session concludes with the implementation of a 'Host Homes' view, allowing hosts to manage their property listings. Throughout the lecture, MongoDB Compass is used to verify data integrity and structure.