Policy function

policy.js

function requestUserOwnsPost(requestUser, post) {
  return requestUser.id === post.owner;
}

const db = {
  postsById: {
    '2': {
      id: 2,
      owner: 1,
      body: 'hey',
    },
  },
  
  getPost(postId) {
    return this.postsById[postId];
  },
  
  patchPost(postId, patch) {
    const post = this.getPost(postId);
    const patchedPost = { ...post, ...patch };
    
    this.postsById[postId] = patchedPost;
    return patchedPost;
  },
};

app.patch('/posts/:postId', (req, res, next) => {
  const { postId } = req.params;
  const post = db.getPost(postId);
  const permitOperation = requestUserOwnsPost(req.user, post);
  
  if (!permitOperation) {
    return next(new Error('You cannot patch a post you do not own'));
  }
  
  return req.json(db.patchPost(postId, req.body));
});