How to use the leanengine.ACL function in leanengine

const authData = user.get('authData');
  if (!authData || !authData.lc_weapp) {
    return response.error(new Error('当前用户不是小程序用户'));
  }
  const order = new Order();
  order.tradeId = uuid().replace(/-/g, '');
  order.status = 'INIT';
  order.user = request.currentUser;
  order.productDescription = 'LeanCloud-小程序支付测试';
  order.amount = 1;
  order.ip = request.meta.remoteAddress;
  if (!(order.ip && /^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/.test(order.ip))) {
    order.ip = '127.0.0.1';
  }
  order.tradeType = 'JSAPI';
  const acl = new AV.ACL();
  // 只有创建订单的用户可以读，没有人可以写
  acl.setPublicReadAccess(false);
  acl.setPublicWriteAccess(false);
  acl.setReadAccess(user, true);
  acl.setWriteAccess(user, false);
  order.setACL(acl);
  order.place().then(() => {
    console.log(`预订单创建成功：订单号 [${order.tradeId}] prepayId [${order.prepayId}]`);
    const payload = {
      appId: process.env.WEIXIN_APPID,
      timeStamp: String(Math.floor(Date.now() / 1000)),
      package: `prepay_id=${order.prepayId}`,
      signType: 'MD5',
      nonceStr: String(Math.random()),
    }
    payload.paySign = wxpay.sign(payload);

}, function(err, spam) {
                if (err) console.log (`垃圾评论检测出错！${err}`);
                if (spam) {
                    console.log('逮到一只垃圾评论，烧死它！用文火~');
                    comment.set('isSpam', true);
                    comment.setACL(new AV.ACL({"*":{"read":false}}));
                    comment.save();
                    // comment.destroy();
                } else {
                    comment.set('isSpam', false);
                    comment.setACL(new AV.ACL({"*":{"read":true}}));
                    comment.save();
                    console.log('垃圾评论检测完成，放行~');
                }
            });
        }

router.post('/', function(req, res, next) {
  var content = req.body.content;
  var todo = new Todo();
  if (req.currentUser) {
    todo.set('author', req.currentUser);

    // 设置 ACL，可以使该 todo 只允许创建者修改，其他人只读
    // 更多的 ACL 控制详见： https://leancloud.cn/docs/js_guide.html#其他对象的安全
    var acl = new AV.ACL(req.currentUser);
    acl.setPublicReadAccess(true);
    todo.setACL(acl);
  }
  todo.set('content', content);
  todo.set('status', 0);
  todo.save(null, {sessionToken: req.sessionToken}).then(function() {
    res.redirect('/todos');
  }).catch(next);
});