Mongoose build query to update multiple fields - mongodb

Question

I want to create endpoint which will update multiple fields from one collection but not every field and I don't know exact amount of fields.
So for example my user.model contain fields like email, password, name, active. Now I want to create endpoint which will be allowed to change name and password but not email and active. Also it can change both values at once or just one depending on what is sent. So if I pass to it JSON like this:
{ "password":"someNewPass" }
it will update password but won't touch other fields and when I will send JSON like this:
{ "password":"someNewPass", "name":"John Smith" }
then it will update both values but when I send JSON like this
{ "password":"someNewPass", "name":"John Smith", "active":false }
it will not allow the action and give status forbidden or something.
I know I can update multiple fields like this:
await User.findOneAndUpdate(
{ 'resetPasswordKey': req.query.key },
{ $set: { 'password': newPasswordHash, 'name': 'John Smith' } }
)
but how to handle that I don't know amount of fields which will be sent (one or two in above example) and I don't want to let update every field (forbid email and active in above example)?

Answer 1

You can try something like this:
let update = { "password":"someNewPass", "name":"John Smith", "active":false }
if(update.hasOwnProperty('active'))
{
throw 'forbidden';
}
else
{
await User.findOneAndUpdate(
{ 'resetPasswordKey': req.query.key },
{ $set: update }
)
}