authorizationExample.swift

//Assuming that you have a route such as: /things/Thing.parameter
// Alo that you have decorated the route to use authentication via the auth module

func patchThing (_ req: Request) throws -> Future<Thing> {
  let user = try req.requireAuthenticated(User.self)
  return try flatMap(
      to: Thing.self, 
      req.parameters.next(Thing.self),
      req.content.decode(Thing.self)) { thing, updatedThing in
// ensure the thing belongs to this user
        guard try thing.ownerId == user.requireID() else {
           throw Abort(.forbidden)
        }
    thing.attribute1 = updatedThing.attribute1
    thing.attribute2 = updatedThing.attribute2
    ...
    return thing.save(on: req)
   }
}