How to check if userID from req.user from Passport JS and MongdoDB userID match before update/delete document?
<p>I am making a voting app with a <code>delete and edit</code> function for user who are authenticated using <code>Passport JS</code> + the specific poll belongs to him/her.</p>

<p>I have the following <code>Passport setup</code> with <code>Node/Express</code>: </p>

<pre><code> passport.use(new FacebookStrategy({ 

  clientID: FACEBOOK_APP_ID,
  clientSecret: FACEBOOK_APP_SECRET,
  callbackURL: CALLBACK_URL

}, function(accessToken, refreshToken, profile, done){  
//callback function after login  

  process.nextTick(function(){        
    done(null, profile);        
  });      
}));


passport.serializeUser(function(user,done){

req.session.passport.user = {};  

  done(null, user);

});

passport.deserializeUser(function(id, done){

  done(null, id);

});


app.get('/auth/facebook', passport.authenticate('facebook'));


app.get('/auth/facebook/callback', passport.authenticate('facebook', { 
    successRedirect: '/',
    failureRedirect: '/error'

}));

app.get('/success', function(req, res, next) { 

  res.send('Successfully logged in. You can close this window');      
});


app.get('/error', function(req, res, next) {    
  res.send("Error logging in.");      
});
</code></pre>

<p><strong>So, every request now has the user attached to it (req.user) with the id and displayName</strong></p>

<p>I use the following middle ware function to secure a route server side:</p>

<pre><code>var auth = function(req,res,next){

    if(!req.isAuthenticated()){

      console.log("You need to login!");

      res.sendStatus(401);                    
    } 
    else {

      console.log("User is logged in, success!");          
      next();          
    }              
};
</code></pre>

<p>Polls are saved in the following format in MongoDB:</p>

<pre><code>{
    "_id": {
        "$oid": "57c69ec65ed24f166b4e98cf"
    },
    "title": "Poll Test",
    "options": [
        {
            "option": "Option1",
            "votes": 0
        },
        {
            "option": "Option2",
            "votes": 0
        },
        {
            "option": "Option3",
            "votes": 0
        },
        {
            "option": "Option4",
            "votes": 0
        }
    ],
    "userID": "1798846357",
    "displayName": "John Doe",
    "date": "Wed Aug 31 2016 09:09:26 GMT+0000 (UTC)"
}
</code></pre>

<p>I want to protect the following route from my REST API, that is used by for example a <code>delete poll</code> function in the front-end. </p>

<p>The problem is that it checks if a user is authenticated, but not if the poll belongs to the user. In other words: not if the <code>userID</code> in the request and the <code>userID</code> in the database match. </p>

<p>I try to put an if statement inside the <code>db.collection</code> function to check if <code>req.user.id and doc.data.id match</code> but it's not working.</p>

<p>I think that is because the updateOne has already been done.</p>

<p>How can I retrieve the poll with the userID and then check that with the req.user.id and if match, continue with the update?</p>

<pre><code>    app.delete("/polls/:id", auth, function(req, res) {         
    db.collection(POLLS_COLLECTION).deleteOne({
      _id: new ObjectID(req.params.id)
    }, function(err, doc) {

      if (err) {

        handleError(res, err.message, "Failed to delete contact");

      } else {

        res.status(204).end();
      }    
    });        
  });        
});
</code></pre>