How to save the Reset Password Nodejs and MongoDb

I am using SendGrid to send the user the reset password link that goes with two parameters (The user._id and token). I have another component that saves the user's changed the password but all I get is an error user. save is not a function

Email helper Code.

import sendGrid from "@sendgrid/mail";

export class sendGridEmail {
  static async sendResetPasswordEmail(email, token, id) {
    sendGrid.setApiKey(process.env.SENDGRID_API_KEY);
    const msg = {
      to: `${email}`,
      from: `${process.env.VERIFIED_SENDER}`, // Change to your verified sender
      subject: "RESET YOUR PASSWORD",
      text: `Follow this link to reset your password: ${process.env.BASE_URL}/${id}/${token}`,
    };
    return sendGrid
      .send(msg)
      .then(() => {
        console.log(`password rest link has been sent to: ${email}`);
      })
      .catch((err) => {
        console.log(err);
      });
  }

sendLink Component

export const resetUserPassword = asynchandler(async (req, res) => {
  const { email } = req.body;
  const user = await userModel.findOne({ email });
  if (!user) {
    res.status(404);
    res.json({ message: "the email provided was not found" });
  } else if (user) {
    const token = AuthToken(user._id);
    try {
      await sendGridEmail.sendResetPasswordEmail(user.email, token, user._id);
      res.status(200);
      res.json({
        message: `a link to reset your password has been sent to: ${user.email}`,
      });
    } catch (error) {
      res.status(500);
      res.json({ message: error });
    }
  } else {
    res.status(500);
    res.json({ message: "Internal Server Error" });
  }
});

The Component that tries to update the password in the Database but I get an error user.save() is not a function

export const saveResetPassword = asynchandler(async (req, res) => {
  const { id, authorization } = req.params;

  const user = userModel.findOne(req.params.id);
  const private_key=process.env.PRIVATE_KEY
  const payload = jwt.verify(authorization, private_key);
  if (user._id === id || payload.id) {
    try {
      user.password = req.body.password;
      await user.save();
    } catch (error) {
      res.status(404);
      res.json({ message: `an error occured: ${error}` });
    }
  }else{
    res.status(500)
    res.json({message: "an error occured"})
  }
});

My Routes

import { loginUser, registerUser, resetUserPassword, saveResetPassword } from "./controllers/user.controller.js";

export const Routes =(app)=>{
    app.get("/health", (req,res) => {
        res.send(200).json({message:"Server health check is Ok"});
    });
    // user api's
    app.post('/api/registeruser', registerUser);
    app.post('/api/loginuser', loginUser);
    app.post('/api/password-reset', resetUserPassword);
    app.post("/api/save-password/:id/:authorization", saveResetPassword);

}