title: Express Patch Method usage
body: <p>my question is about the design of an API.</p>
  
  <p>We are about to rebuild our entire API backend infrastructure from Meteor.JS to NodeJS/Express.</p>
  
  <p>Although we found one problem concerning our API.
  We used to have Method.Call on Meteor and could define whatever we want using that.</p>
  
  <p>Now we would like to follow some REST principles and therefor we would like to use only GET/POST/PUT/DELETE and PATCH</p>
  
  <p>//Example POST</p>
  
  <pre><code>createTournament: async(req, res) =&gt; {
    if(!req.body || typeof req.body !== 'object'
      || !req.body.name || typeof req.body.name !== 'string'
      || !req.body.description || typeof req.body.description !== 'string'
      || !req.body.gameId || typeof req.body.gameId !== 'string')
    {
        return res.sendStatus(400);
    }
    const insertId = await (functions.createTournament(
      req.body.name,
      req.body.description,
      req.body.gameId);
    if (insertId) {
      res.status(201).send(insertId);
    } else {
      res.sendStatus(404);
    }
  },
  </code></pre>
  
  <p>//My current patch function</p>
  
  <pre><code>patch: async(req, res) =&gt; {
    if (!req.params
    || !req.params.id  
    || !req.body) {
      res.sendStatus(400);
    }
    const tournament = await functions.patchTournament(req.params.id, req.body);
    res.status(200).send(tournament);
  },
  </code></pre>
  
  <p>The problem is that only users with the role admin can patch a gameId, and other users can only patch a description.</p>
  
  <p>This is a lightweight object, since the actual one has about 20 properties to be set.</p>
  
  <p>While using PATCH, we were wondering if it was possible to authorize certain user roles to be able of only editing certain fields.
  And how we could do this in a clear and easy to understand manner.</p>
  
  <p>Any help would be really great. If you have any questions feel free to ask me.</p>