Got a few inquiries. I established authentication in my application using the code below:
passport.use(new LocalStrategy(function(username, password, done){
Users.findOne({ username : username},function(err,user){
if(err) { return done(err); }
if(!user){
return done(null, false, { message: 'Incorrect username' });
}
hash( password, user.salt, function (err, hash) {
if (err) { return done(err); }
if (hash == user.hash) return done(null, user);
done(null, false, { message: 'Incorrect password' });
});
});
}));
app.get('/admin', function (req, res){
res.render('login.jade');
});
app.post('/admin', function (req, res){
passport.authenticate('local', { successRedirect: '/main',
failureRedirect: '/login',
failureFlash: true });
});
The User data schema includes username, password, and hash.
First question - How can I manually insert a new user into the database without a sign-up page? I want to add each user myself.
Next, how do I adjust my current routes to only allow access for authenticated users? For example, I have:
app.get('/comment/:commentID', admin.renderComment);
The renderCommit above is an extensive handler function, but it should only be accessible to authenticated users. What's the best way to verify this?