Hey guys in this video we're actually going to start building out or manage users where we'll be retrieving
all of the active users one allowing the user to add or at least an admin user to be able to add deactivate
or reset the password of another user.
And so the first thing that we want to look at however our code changes that I made between the previous
lesson and this one.
So one I modified my log in logic the query that is checking for our user.
I added the constraint that the Q Dot is active must be true.
So firstly we were looking for in the database gets all the users with the get the first user from the
user stable that has a matching User name password in the database that matches our hashed version of
what the rules entered.
And then I added a third constraint where I said and the active flag must be equal into true so you
would remember that we added is active flag.
Now we set to boolean in the previous video.
And so that must be true.
So the same logic applies all three of these most much and if it doesn't then we say please provide
valid credentials.
Right.
It can be more specific than that.
I mean you can probably get into the details as to why was.
But like I said the more generic the better for malicious attempts on your system.
And then I modified our code in the.
So you take a look at this code where instead of doing all the processing to find the role name like
we did initially and then passing just the rule name over.
I'm actually just passing the entire user object over to the mean windows so I say Varma and Windows
equal to man window and I'm passing this karma user.
So when the user is retrieved I want to pass out the entire object over to the mean window.
Now this will give me more flexibility because I'm just going to bring a will mean window.
No I am I can use this user object to access any data but the user that I wanted including the rule.
So initially would have used it to access the rule information and then past only the rule information.
This I'm just passing all of the user information and then on a case by case basis we can access the
user information if we want.
So I introduced our new property instead of the mean window and I said public to user on the square
user.
This one is on the squirrel name and you can see some of them are okay.
So one of my locus I need to be more consistent so they may change URL name to come case.
Ah so everything looks a bit more consistent.
And then inside of the constructor I am initializing I have my log in object I have my user object and
I'm still just going to set the rule names separately because I don't want to repeat this bit of code
every time I want to rule a name.
Right now this bit of code that I just highlighted I condensed it even further.
So the last time what we did was we got the user rules and we've got the first order defaults and then
we add another variable where we got the rule dots shark name from the first default in this case had
did it all out once.
So I'm gonna show you how there are so many ways to write your queries and link that as long as it works
its good and link is kind of designed to be as efficient as it can.
So even here write it this way or another way it's almost going to be the same runtime.
So you know efficiency aside there are so many ways you can write your queries.
So in this situation I'm saying that the role name is equal to my user object which still has the list
of user rules that we determined.
And then I'm saying give me the first or default one.
No once you do a first or default it is going to bring back only one instance of an object one result.
Once I have one result I can see a dot and then call the the associated table.
So this would be like my inner join and then call the property I want saw added scenes Get me the first
R default user all is required for the user then look at the role and get me the details of that rule
saying bits of code that we wrote except we split into into lines last time I'm doing it in one line
here.
So you know if one were one way it works for you better you can read the other one better.
That's fine.
You can always just copy it over and reproduce it that's no problem as long as it's works it's good.
Everything else remains the same.
And like I said in this video we're going to focus on our manage users screen so already kind of putting
some groundwork on this form of managed users we have the refresh of the grid and I don't think I renamed
the grid so let me just go over and rename it quickly.
This should be GV user list.
All right.
So GV user list and then we have our different buttons one to add a new user one to reset a user's password
and the one to deactivate the user.
So let me just go over to the court file for Monday's users and I need to initialize something that
will allow us to connect to the database by now we should all be familiar with the fact that we need
our private Object or private property sorry wharf type car rental entities on the square D.B. and then
we initialize that instead of our constructor and then we have our three object three functions sorry.
So I'm going to deal with the easiest ones are the easy ones first and for me the easy ones would be
the reset password and the deactivate because I don't have to do much design work as opposed to you
know when compared to the beaten and user click because then I have to design a whole farm.
These are simple queries so the simple query would be that when the person selects a user from the list
then they would be able to click reset password and then I'm just going to generate a generic or have
a generic password that is going to get hashed P replace their existing password in the database and
then that is what they're expected to type in when it is that they're logging in.
All right.
So I'm going to put in the reset password functionality and like I did last time I'm just going to borrow
some code from one of the existing manage screens right.
So in the manage vehicle listing what I had done was I said that for B10 at its car whatever it is that
was selected the selected rule that is the one I want to retrieve and then do my operations.
I'm just going to literally copy all of this because it's there already.
We wrote it.
It's ours.
So we can reuse it at will.
So I went to see beat and reset buzzer click I want to retrieve from user list GV user lists.
Right.
So we haven't done anything to populate GV user lists just yet but GV user lists get a selected roll
and the cells should be I.D. And let me just go back to my database and make sure that it is capital
I.D. which it is not it is common I.
So there again I'm being very inconsistent and that's not good.
But you know it's good that we see these things and common mistakes so they want to be consistent in
their cases in a database and in your code.
All right so we're getting the value associated with the selected rule and then I'm looking inside of
the user's table not the type of card stable so user stable Q Dot I.D. being equivalent to the idea
that was selected and then I'm not able to launch any screen or new windows I can remove all of this.
And then what I will see is that var password or var new on the square password is equal to.
And then I can put in a generic one so you can probably auto generate something based on the details.
I know some people they would do is auto generates a password based on the user details but user details
would usually be like First Name Last Name Date of birth and such.
I didn't call it those details I'm not storing those details of all my users.
If you are though you can use that to your advantage.
Right.
But in my simple example all I have is user name and password.
So I'm just going to put in something that says what I'm just going to put in a generic password.
So your new password would be pass word at sign 1 2 3.
All right to communicate with it use it at you reset the password their new password is that and then
you could build in I did that once they put in that generic password they have to change their password.
All right.
So their new password is password 1 2 3.
Then we want to hash it.
So we're using the SHA 2 5 6 algorithm if you look back in the logging not see us file you see SHA 2
5 6 and you'll see all of the code that we need to hash so I'm actually just going to copy and paste
a lot of this and then you'll see that this no once it's repeating itself and it's repeating itself
across multiple forms we could probably create one function that is called that does this job.
So I'm actually going to do that right now.
So inside of my solution Explorer I have a file called utilise.
All right.
And then in this form.
Well in this class what I had done was I created a utility for the forum is open so I'm going to do
another one where I'm going to see public static and this is going to return that's a string and then
it's going to return hash it's going to be called hash password.
All right.
And then it's going to accept a string of a parameter of type String and we're calling it password.
All right.
So inside of this function no we're going to start doing all of that stuff with the SHA 256 so I put
the code in there and then I have to include my references so include in the reference and then I'm
going to just take all of the code that we used in the log in.
So all of this where we're doing the string builder and building it up.
All right.
So I'm going to just cut all of this because I don't want to log in anymore.
So this is parts are refractory or when you realize that code is repeating itself.
And then if you have to modify one base of 10 other places you just do it one place and reuse it right.
So we have our SHA 256 objects we do our bytes we rebuild our string and then the last thing that we
did was to say as a builder to string.
So what I do is take this line and then I'll see who returns our function is going to return the string
build a dot to string.
So this is the final voted out what I've been assigned to the hashed password.
So after getting a password value through the parameter we go through all of that and then we return
the rebuild string.
So that means anybody who wants this this hushed password will have to make a function call where it
is say the hushed password.
So this modify this log in function as a hash password is equal to utilize dot hash password and then
this is expecting some string.
And I'm going to pass in the password that we want touched.
All right.
So that looks much cleaner.
Easy.
Just one line of code to get the hashed password.
All right.
And then just the same way we did that in the log in.
We just did that in the log in.
We had no business doing that in the log and I'm just doing it one time because I'm about to do it again
and let me just save you tools.
I'm about to do it again instead of moneyed users.
So my new password is going to be equal to and I just caught this.
So instead of let me just say var generic password is equal to that string.
All right.
So I like to give my my values variable names.
I don't like to have random values anywhere because then if somebody stumbled upon password I'd say
in 1 2 3 they would be wondering what in the world that is right.
So I just puts it in a variable and then I'm going to see a new password or I could just say a hushed
password or it here is going to be equal to utilize dot and then hash password and then I'm going to
pass in my generic password as a password I would like to get hushed.
There you go.
So we don't have to repeat all those lines of code every time we want to hash up BUZZER we just roll
it off function inside of us static glass that's just going to take a value and then give us back a
hushed password.
All right.
So that is our that is how we hash.
So you see I wanted to introduce what we'll call a salt.
Then we could have just introduced it instead of the utility because then everything is happening here
anyway.
So you could just say I just saw to the password and then do with the hashing and then so no one saw
as he wanted to change us all will change at one place not not changing I saw it is recommended anyway
but that's the point of having all of your code as centralized as possible all right.
So now that we've calculated so we've got the user right presumably.
And let me just change this.
This object names so it's user var user.
All right.
So we retrieve the user and then we got the password we hash the password and then I'm just going to
see user dot password.
All right.
So remember that we retrieved the user from the database.
All right.
And then we you know set the generic password.
We hashed the generic password.
So now I'm seeing that this user from the database your new password value is going to be equal to whatever
came back from our function and got stored in our variable hashed password.
Then I can just say on the score D.B. dot save changes because then it's sorry to trucking that way
I just got this user back from the database I changed a property in this user from the database so to
see if that changes.
Right.
And that's our ball in a reset.
And then at the end of that you probably want to give a message box to say that Reese parser it has
been reset so you could even be a bit more explicit you could let them know that.
Now just use some interpolation here.
User dot user name.
All right.
I'm going to say which user name and then apostrophe s just to be you know punctuation and grammatically
correct.
So user dot user names the password has been reset all right and that's it.
So we just did a password reset to a nice simple click under two password reset of course like I said
for the password I use that generic password.
But then in practical terms you probably want to generate this on the fly and then let the person know
the pattern.
So that's part of security you would never want to tell the person that your new password is password
at.
One two three because then anybody can go in that person's a code and the ones that password has been
set.
If this is the password has been used way every single person.
So security wise you'd want to tell them that it's there.
The first four letters of the first name the last two letters of the last name and the date of birth
something that only they should be able to sit down and figure out easily and probably be a little bit
more difficult for somebody else to figure out.
All right.
So that's a nice cool under two way of doing the reset password function.
Now a similar thing would be for the deactivate user.
So I'm just going to take this strike catch.
All right.
And we're just going to modify the code a little.
So once again we retrieve the person who was selected then we retrieve them from the database.
Well then we don't need any hashing off anything.
All right.
What I am going to change however is there is active state somewhere to see a user that is active is
equal to falls all right as a mother off.
Well this is deactivated so I should probably build in putting functionality to see that you know if
that same button is clicked then it would be activated or deactivated.
So I would have to change to the cuing are the representation of the text on this button.
So what I would do is say change the text to say the activates flash activate user.
Right.
So then the person would be clicking this button would know that this is a button that would deactivate
the person or reactivate them.
So if they're active deactivate and vice versa then the code that we would right is that on button click
and we retrieve the user.
All right then we're going to see if something like I'm just going to use a Turner operator here as
I'll see user dot is active is equal to and then the ternary operator to know would allow me to state
the condition someone to see a user that is active and I have to specify the condition is equivalent
to true no if is active was not knowledgeable.
So if you hover over it you see a bull with a question mark.
That's because we made we are load nodes in the database and so it is B and C sharp.
If it was not knowledgeable and it was just a straight boolean I could just say it is active and then
say is true our false here right.
What happens if it's true what happens is if it's false.
Well because it's normal we introduced a third states where it could be no it will be true false.
Ah no.
Right.
So because of that I have to specify is equivalent to true.
So we're seeing if the user is active.
If only you looked up the user in the database I would find that there they are active if is active
is true then we want to set it to falls otherwise so it's a true.
Right.
So it would just be like an if statement if is active is true then is active should equal to falls.
Ls is active should equal to true right.
That's that's basically what we did in this one line.
All right.
So I could add a comment here to say this is what it would look like as an if else.
All right so that's what it would look like if the user is if the user is active.
That's equivalent to true then we set it to false.
As we set it to true.
So that's what this one line does.
So in the person or the user clicks deactivate user it gets the role that was selected and then he gets
the user associated with the idea of the role that was selected and then we see the user is active.
A is relative to what I was true or false then we see the changes and then we see a user user name or
has been our activities that process change active status has changed.
So I'm just I'm just leaving it generic here because the thing is I would have to probably put in an
if statement to see whether it's true or false at the end of that.
If it was activated or deactivated so I'll just leave it to try and keep it simple and just see you
know the active status has changed.
All right.
So right there we would have done two very major operations and we would have done it with much simplicity
click under to at some points but I did explain why and how you could enhance it for yourself.
And so that's it for this lesson.
Next time we come along we will be populating our grid and then focusing on adding users to our application.