问创建配置文件身份验证中间件的问题

EN

//the middleware created
middlewareObj.checkProfileOwnership= function(req,res,next){
    if(req.isAuthenticated()){
                              User.findById(req.params.user_id, function(err, editProfile){
                              if(err){
                                      req.flash("error", "error");
                                      res.redirect("back");
                            } 
                    else{
                         // does user own the info???
                         if(editProfile.contributor.id.equals(req.user._id) || req.user.isAdmin){
                             next();
                         } else{
                                req.flash("error","You need Permission to do that");
                                res.redirect("back");
                         }

                 }
            }); 
        }
        else{
              req.flash("error", "You need to be Logged in to do that"); 
             res.redirect("back");
            }
     };
    // the user model
var mongoose= require("mongoose");
var passportLocalMongoose= require("passport-local-mongoose");
var UserSchema= new mongoose.Schema({
    username:String,
    password:String,
    avatar: String,
    info:String,
    firstName: String,
    lastName: String,
    email: String,
    isAdmin: {type:Boolean, default:false},
    contributor:{
       id: {
           type:mongoose.Schema.Types.ObjectId,
           ref:"User"

        },
        username:String
    }