I am not picturing this update taking more than 3 lines of code with SQL either. Here is an update in one of my projects with names changed:

  await client.query(`
    update table set c1 = $1, c2 = $2 
    where id = $3 and userId = $4
    `, [c1, c2, id, userId]);