So, I'm not 100% why this isn't working as intended. I have an Edit Profile React component (I'm learning how to build a SSR-based application currently, using the MERN stack) - but when I submit the edit, I get an error that **"user.save is not a function** - Code:

From the routes:

```
    router.route('/api/users/:userId')
    .get(authCtrl.requireSignin, userCtrl.read)
    .put(authCtrl.requireSignin, authCtrl.hasAuthorization, userCtrl.update)
    .delete(authCtrl.requireSignin, authCtrl.hasAuthorization, userCtrl.remove)

```

The API Helper:

```
const update = async (params, credentials, user) => {
  try {
    let response = await fetch('/api/users/' + params.userId, {
      method: 'PUT',
      headers: {
        "Accept": 'application/json',
        Authorization: 'Bearer ' + credentials.t
      },
      body: user
    })
    return await response.json()
  } catch (err) {
      console.log(err)
  }
}

```

And lastly, the actual controller, that handles all the logic behind the update: (This function sanitizes the password information before passing it back to the client, hence the undefineds)

```
const update = (req, res) => {
  let form = new formidable.IncomingForm()
  form.keepExtensions = true
  form.parse(req, async (err, fields, files) => {
    if (err) {
      return res.status(400).json({
        error: "Photo could not be uploaded"
      })
    }
    let user = req.profile
    user = extend(user, fields)
    user.updated = Date.now()
    if(files.photo){
      user.photo.data = fs.readFileSync(files.photo.path)
      user.photo.contentType = files.photo.type
    }
    try {
      await user.save()
      user.hashed_password = undefined
      user.salt = undefined
      res.json(user)
    } catch (err) {
      console.log(err)
      return res.status(400).json({
        error: errorHandler.getErrorMessage(err)
      })
    }
  })
}

```

This isn't a production level application, just for me learning how to do this from scratch (without CRA, and all contained in one project using SSR)

EDIT: After some digging, console.logs and console.dirs, I discovered that the updates passed from the component aren't even being passed to the controller. The stale data (from the database) are logging, but req.profile is completely empty. I may re-visit this code completely and make some major changes to it.. All part of learning, right?

Here are the auth methods that were requested (I'm using Session Storage for now, but that may change to localStorage):

```
import User from '../models/user.model'
import jwt from 'jsonwebtoken'
import expressJwt from 'express-jwt'
import config from './../../config/config'

const signin = async (req, res) => {
  try {
    let user = await User.findOne({email: req.body.email})
    if (!user) {
      return res.status(401).json({error: "User not found"})
    }
    if (!user.authenticate(req.body.password)) {
      return res.status(401).send({error: "Email and Password do not match"})
    }

    const token = jwt.sign({_id: user._id}, config.jwtSecret)

    res.cookie('t', token, {expire: new Date() + 9999})

    return res.json({
      token,
      user: {
        _id: user._id,
        name: user.name,
        email: user.email
      }
    })
  } catch (err) {
    return res.status(401).json({error: "Could not sign in"})
  }
}

const signout = (req, res) => {
  res.clearCookie('t')
  return res.status(200).json({message: "Signed out"})
}

const requireSignin = expressJwt({
  secret: config.jwtSecret,
  algorithms: ['sha1', 'RS256', 'HS256'],
  userProperty: 'auth'
})

const hasAuthorization = (req, res, next) => {
  const authorized = req.profile && req.auth
  && req.profile._id == req.auth._id
  if (!(authorized)) {
    return res.status(403).json ({error: "User is not authorized"})
  }
  next()
}

export default {
  signin,
  signout,
  requireSignin,
  hasAuthorization
}

```