Mitigating Broken Access Control threat (HapiJS)

UsersController.js

update(req, reply) {
return Promise.resolve()
.then(() => {
    /* 
     * Even though this action is accessed from the "PUT /api/users/:id" route
     * we cannot rely on reading the user id from the params. Instead we're using 
     * the user id from the session.
     * This is to mitigate the Broken Access Control threat 
     * (https://www.owasp.org/index.php/Top_10-2017_A5-Broken_Access_Control)
     */
    const where = {
        id: req.auth.credentials.id,
    };

    /* 
     * In case admin is updating a user record we can take the user id from the params
     */
    if (req.auth.credentials.isAdmin) {
        where.id = req.params.id;
    }

    let emailChanged;
    let phoneChanged;

    return this.User.findOne({ where })
    .then((user) => {
        if (!user) throw Boom.notFound('Record not found');

        user.set(req.payload);

        emailChanged = user.changed('email');

        return user.save();
    })
    .tap((user) => {
        if (!emailChanged) return;

        this.EmailVerificationService.sendVerificationEmail(user.email)
        .catch((err) => {
            this.logger.error(err);
        });
    })
    .then((user) => {
        return this.User.scope('public').findById(user.id);
    });

})
.then(reply);

}