code: async function update(ctx) {
    let { Model } = ctx.state;
    let code = Model.api.update;
    if (code > _alaska.PUBLIC && !ctx.user) {
      //未登录,需要认证
      ctx.status = 401;
      return;
    }
    let filters = await Model.createFiltersByContext(ctx);
  
    let doc = await Model.findById(ctx.state.id || ctx.params.id).where(filters);
    if (!doc) {
      //404
      return;
    }
    // $Flow 已经确认ctx.user存在
    if (code === _alaska.OWNER && doc[Model.userField].toString() !== ctx.user.id) {
      //404
      return;
    }
    let body = Object.assign({}, ctx.state.body || ctx.request.body);
  
    // 不允许更新private 字段
    _lodash2.default.forEach(Model.fields, (key, conf) => {
      if (conf.private) {
        delete body[key];
      }
    });
    doc.set(body);
    const scope = ctx.state.scope || ctx.query._scope;
    if (!scope) {
      doc.__modifiedPaths = [];
    }
    await doc.save();
    ctx.state.record = doc;
    if (scope) {
      ctx.body = doc.data(scope);
    } else {
      ctx.body = _lodash2.default.pick(doc.data('update'), 'id', doc.__modifiedPaths);
      delete doc.__modifiedPaths;
    }
  }
docs: 更新一个对象