How to check if particular user is logged in using Passport - express

Question

I want to make sure that a particular link ('New Blog') is only available to myself (username = "admin") and not to the general public. I've written the following if statement but it's throwing an error:
<% if(currentUser.username = "admin") { %>
<ul class="nav navbar-nav">
<li class="active"><i class="fa fa-plus" aria-hidden="true"></i> New Blog <span class="sr-only">(current)</span></li>
</ul>
<% } %>
What is wrong with my logic here??
Routes are as follows:
router.get("/blogs", function(req, res){
Blog.find({}, function(err, blogs){
if(err) {
console.log(err);
} else {
res.render("index", {blogs: blogs});
}
});
});
router.get("/new", function(req, res){
res.render("new");
});
router.get("/blogs/:id", function(req, res){
Blog.findById(req.params.id, function(err, foundBlog){
if(err){
res.redirect("/blogs");
} else {
res.render("show", {blog:foundBlog});
}
});
});
// create route
router.post("/blogs", function(req, res){
req.body.blog.body = req.sanitize(req.body.blog.body);
Blog.create(req.body.blog, function(err, newBlog){
if(err) {
res.render("new");
} else {
res.redirect("/blogs");
}
});
});
// edit route
router.get("/blogs/:id/edit", function(req, res){
// find blog
Blog.findById(req.params.id, function(err, foundBlog){
if(err){
res.redirect("/blogs");
} else {
res.render("edit", {blog: foundBlog});
}
});
});
// update route
router.put("/blogs/:id", function(req,res){
req.body.blog.body = req.sanitize(req.body.blog.body);
Blog.findByIdAndUpdate(req.params.id, req.body.blog, function(err, updatedBlog) {
if(err) {
res.redirect("/");
} else {
res.redirect("/blogs/" + req.params.id);
}
});
});
// delete route
router.delete("/blogs/:id", function(req, res){
Blog.findByIdAndRemove(req.params.id, req.body.blog, function(err, deleteBlog){
if(err) {
res.redirect("/blogs");
} else {
res.redirect("/blogs");
}
});
});
router.get("/", function(req, res){
res.redirect("/blogs");
})
// reg
router.get("/register", function(req, res){
res.render("register");
});
// signup logic
router.post("/register", function(req, res){
var newUser = new User({username: req.body.username, image: req.body.image});
User.register(newUser, req.body.password, function(err, user){
if(err){
res.redirect("/blogs");
}
passport.authenticate("local")(req, res, function(){
res.redirect("/blogs");
});
});
});
// login form
router.get("/login", function(req, res){
res.render("login");
});
// login logic
router.post("/login", passport.authenticate("local", {
successRedirect: "/blogs",
failureRedirect: "/login",
}));
// logout logic
router.get("/logout", function(req, res){
req.logout();
req.flash("success", "You are now logged out");
res.redirect("/blogs");
});

Answer 1

When authentication is successful, Passport attaches the user object to the request object of the express router(req.user). This is achieved via the done(null, user) in your local authentication strategy. You can make the user object to check whether the corresponding user is indeed the admin.
router.post("/blogs", function(req, res){
req.body.blog.body = req.sanitize(req.body.blog.body);
Blog.create(req.body.blog, function(err, newBlog){
if(err) {
res.render("new", {
// Ternary operator which checks if the user object is empty or not
currentUser: req.user ? req.user.currentUser: '',
// I hope currentUser is present in your Schema object
});
} else {
res.redirect("/blogs");
}
});
And then you can check in your view whether it is the correct user or not:
<% if(currentUser === "admin") { %>
<ul class="nav navbar-nav">
<li class="active"><i class="fa fa-plus" aria-hidden="true"></i> New Blog <span class="sr-only">(current)</span> </li>
</ul>
<% } %>