npm i --save update-props

updateProps({Object} object, {Object} newProperties, {[String]} allowedKeys);

var update = require('update-props');

var user = {
  name: 'John',
  password: 'foo'
};

var changes = update(user, { name: 'Fred', password: 'bar' }, ['name']);

console.log(changes); // { before: { name: 'John' }, after: { name: 'Fred' } }
console.log(user);    // { name: 'Fred', password: 'foo' }

var mongoose = require('mongoose');
var updatePropsPlugin = require('update-props/mongoose-plugin');

var userSchema = new mongoose.Schema({ /*...*/ });
userSchema.plugin(updatePropsPlugin);

userSchema.methods.update = function(props) {
  var allowedKeys = [];
  
  if (this.hasPermission('update:name')) {
    allowedKeys.push('firstName', 'lastName');
  }
  
  if (this.hasPermission('update:address')) {
    allowedKeys.push('address1', 'address2', 'city');
  }
  
  return this.updateProps(props, allowedKeys);
};