gistfile1.js

app.use(
	// меняет токен на user
	// создает в req объект user:
	// req.user = { id: 1, roles: [...] }
	exchangePassportToken
)

app
.put('/users/:uid')
.use(roles('manager'))
.use(allowBody(
	['password', function(pass) {
		return pass.length > 12;
	}],
	'contacts.*',
))
.use(updateUser)
.use(allowResponseBody(
	'id',
	'contacts',
	'login',
	'laslogin'
))
.use(sendResponse);

app
.put('/users/:uid')
.use(roles('client'))
.use(allowRequest(
	['params.uid', eq('req.user.id')],
	
	['body.password', [
		is(String),
		length.gt(12),
		containsOnly('0123456789ABCDEF...'),
		regMatch(/[01234...]+/)
	]],

	'body.contacts.phone'
))
.use(updateUser)
.use(allowResponseBody(
	'id',
	'contacts',
	'login'
))
.use(sendResponse);