how can i update the products inventory when the is confirmed?

Question

I' creating a Shopping cart in node/express and mongodb. I need that the products the customer has bought to be updated once those have been paid. I am also using an api called Mercado Pago to make payments

Cart route

router.post("/", verifyToken, validateGenerateOrder , generateOrder);
router.get("/",verifyToken, showAllOrders);
router.get("/:idUser", verifyToken, showOrder);
router.put("/:idOrder",verifyToken, updateOrder);
router.delete("/:idUser",verifyToken, deleteOrder);
router.delete("/:idUser/:idOrder",verifyToken, deleteProductOrder);

Products route

router.post("/", [verifyToken, isAdmin], uploadMiddleware.uploadMulti, validatePostProducts, postProducts);
router.post("/searchProducts", searchProducts);
router.get("/", getProducts);
router.get("/:productId", getProductById);
router.put("/:productId",[verifyToken, isAdmin], updateProductById);
router.put("/updateProductsQuantity/:userId",[verifyToken], updateProductsQuantity);
router.delete("/:productId",[verifyToken,isAdmin], deleteProductById);

payment Route

router.post("/create-order",verifyToken, createOrder );

cartController

export const generateOrder = async (req, res) => {
  const body = matchedData(req)
  const { id, quantity } = body.products[0];
  try {
    // devuelve el usuario logeado
    const user = await User.findById(req.userId).select('-password')

    //devuelve el carrito si es que existe si no existe crea uno
    let cart = await Cart.findOne({ user: user._id })

    //devuelve el producto que se va a agregar al carrito
    let product = await Products.findById(id)

    if (!product) return res.status(404).json({ msg: "el producto no existe" });


    // si existe un carrito 
    if (cart) {
      let itemIndex = cart.products.findIndex(product => product.id == id);
      if (itemIndex > -1) {
        //product exists in the cart, update the quantity
        let productItem = cart.products[itemIndex]
        productItem.quantity += quantity;
        cart.products[itemIndex] = productItem;
      }
      else {
        //product does not exists in cart, add new item
        cart.products.push({ id, quantity });
      }


      await cart.save();
      return res.json({ msg: "el producto a sido agregado correctamente" });
    }
    else {
      //no cart for user, create new cart

      await Cart.create({
        user: user._id,
        products: [{ id, quantity }]
      });
      return res.json({ msg: "el producto a sido agregado correctamente" });
    }


  } catch (error) {
    console.log(error)
    res.status(500).json({ msg: 'hubo un error' })
  }

};

productController

export const postProducts = async (req, res) => {

  try {
    const { name, descripcion, date, price, stock, category } = req.body
    let images = [];

    const categorySearch = await Category.findById(category);
    if (!categorySearch) return res.status(400).send("Invalid Category");

    if (req.files.images.length > 0) {

      req.files.images.forEach(element => {
        images.push({
          _id: shortid.generate(),
          fileName: element.filename,
          filePath: element.path,
          lastModified: element.lastModified
        });
      });
    }

    const product = new Products({ name, descripcion, date, price, stock, images, category });

    // guardamos el producto
    await product.save();
    // ----------
    // consultamos los productos disponibles
    const products = await getProductsfunction(req, res)

    res.json({ products, msg: "se a eliminado el producto correctamente" });

  } catch (error) {
    console.log(error);
    res.status(500).send("hubo un error");
  }
};

// update quantities of one or more products
export const updateProductsQuantity = async (req, res) => {
  try {
...
   /
  } catch (error) {
    res.status(500).send("hubo un error");
  }
}

paymentController

export const createOrder = async (req, res) => {

    // devuelve el usuario logeado
    const user = await User.findById(req.userId).select('-password')

    //devuelve el carrito si es que existe si no existe crea uno
    let cart = await Cart.findOne({ user: user._id }).populate({ path: "products.id", model: "Productos" })

    let preference = {
        items: [],
        back_urls: {
            "success": "http://localhost:3000/notification",
            "failure": "http://localhost:3000/notification",
            "pending": "http://localhost:3000/notification"
        },
        auto_return: "approved",
    };

    cart.products.forEach(product => {
        preference.items.push({
            title: product.id.name,
            quantity: product.quantity,
            currency_id: 'ARS',
            unit_price: product.id.price

        })
    })

    const response = await mercadopago.preferences.create(preference)
    const preferenceId = response.body.id

    res.send({ preferenceId })
}

models

`

const productSchema = Schema({
    name: {
        type: String,
        required: true,
        trim: true
    },
    descripcion: {
        type: String,
        required: true,
        trim: true,
    },
    date: {
        type: Date,
        default: Date.now()
    },
    price: {
        type: Number,
        required: true,
    },
    stock: {
        type: Number,
        required: true,
    },
    category: {
        type: Schema.Types.ObjectId,
        ref: "Category",
        require: true,
      },
    images: Array,
}, {
    timestamps: true,
    versionKey: false
})

export default model('Productos', productSchema)

const cartSchema = Schema({
  user: {
    type: Schema.ObjectId,
    ref: "Usuario",
  },
  products: [
    {
      id: {
        type: Schema.ObjectId,
        ref: "Productos",
      },
      quantity: {
        type: Number,
        default: 1
      }
    }
  ],
  total: {
    type: Number,
  },

}, {
  versionKey: false
  
});

export default model("Cart", cartSchema);

`

I tried to put the code here to update the products but I realized that anyone can update the products

// update quantities of one or more products
export const updateProductsQuantity = async (req, res) => {
  try {


// I look for the user's cart
    const order = await Cart.find({ user: req.params.idUser }).populate({ path: "products.id", model: "Productos" })

    if (order.length == 0) return res.status(404).json({ msg: "no posee pedidos aun" })
    ...
   /
  } catch (error) {
    res.status(500).send("hubo un error");
  }
}