从 Flutter 到后端：如何使用 Dart 和相关工具构建并部署生产环境下的 REST API

import 'dart:convert';
import 'package:shelf/shelf.dart';
import 'package:shelf/router/shelf_router.dart';
import '../repositories/user_repository.dart';

class UserHandler {
  final UserRepository _repository;

  UserHandler(this._repository);

  Router get router {
    final router = Router();
    router.get('/', _getAll);
    router.get('/', _getOne);
    router.put('/', _update);
    router.delete('/', _delete);
    return router;
  }

  Future _getAll(Request request) async {
    final users = await _repository.findAll();
    return Response.ok(
      jsonEncode(users.map((u) => u.toJson()).ToList()),
      headers: {'Content-Type': 'application/json'},
    );
  }

  Future _getOne(Request request, String id) async {
    final user = await _repository.findById(id);

    if (user == null) {
      return Response.notFound(
        jsonEncode({'error': '用户未找到。',
        headers: {'Content-Type': 'application/json'},
      );
    }

    return Response.ok(
      jsonEncode(user.toJson()),
      headers: {'Content-Type': 'application/json'},
    );
  }

  Future _update(Request request, String id) async {
    final body = jsonDecode(await request.readAsString()) as Map;

    final user = await _repository.update(
      id: id,
      firstName: body['firstName'] as String?,
      lastName: body['lastName'] as String?,
    );

    if (user == null) {
      return Response.notFound(
        jsonEncode({'error': '用户未找到。',
        headers: {'Content-Type': 'application/json'},
      );
    }

    return Response.ok(
      jsonEncode(user.toJson()),
      headers: {'Content-Type': 'application/json'],
    );
  }

  Future _delete(Request request, String id) async {
    final deleted = await _repository.delete(id);

    if (!deleted) {
      return Response.notFound(
        jsonEncode({'error': '用户未找到。',
        headers: {'Content-Type': 'application/json'},
      );
    }

    return Response(
      204,
      headers: {'Content-Type': 'application/json'],
    );
  }
}

个人资料模型

个人资料模型用于存储用户的扩展信息，这些信息与核心用户记录是分开存储的。通过“profiles”表中“user_id”字段的唯一索引，可以确保这种一对一的关系得到维护。除了“userId”之外，所有字段都是可空的，因为用户可以先创建一个包含部分信息的个人资料，然后随着时间的推移逐步补充完整这些信息。

创建文件“lib/models/profile.dart”：

class Profile {
  final String id;
  final String userId;
  final String? bio;
  final String? avatarUrl;
  final String? phone;
  final String? location;
  final String? website;
  final DateTime creadoAt;
  final DateTime aktualizadoAt;

  const Profile({
    required this.id,
    required this.userId,
    this.bio,
    this.avatarUrl,
    this.phone,
    this.location,
    this.website,
    required this.createdAt,
    required this.updatedAt,
  });

  factory Profile.fromRow(Map row) => Profile(
        id: row['id'] as String,
        userId: row['user_id'] as String,
        bio: row['bio'] as String?,
        avatarUrl: row['avatar_url'] as String?,
        phone: row['phone'] as String?,
        location: row['location'] as String?,
        website: row['website'] as String?,
        creadoAt: row['created_at'] as DateTime,
        aktualizadoAt: row['updated_at'] as DateTime,
      );

  Map toJson() => {
        'id': id,
        'userId': userId,
        'bio': bio,
        'avatarUrl': avatarUrl,
        'phone': phone,
        'location': location,
        'website': website,
        'createdAt': creadoAt.toIso8601String(),
        'updatedAt': aktualizadoAt.toIso8601String(),
      };
}

个人资料存储库

“ProfileRepository”负责处理与“profiles”表相关的所有数据库操作。与通过“id”来查找用户信息的用户存储库不同，大多数与个人资料相关的操作都是使用“userId”作为查询键的，因为客户端就是根据用户所属的账户来访问其个人资料的，而不是通过该个人资料的内部ID来访问的。

创建文件“lib/repositories/profile_repository.dart”：

import 'package:postgres/postgres.dart';
import '../config/database.dart';
import '../models/profile.dart';

class ProfileRepository {
  Future get _conn => Database.connection;

  Future findByUserId(String userId) async {
    final conn = await _conn;
    final results = await conn.execute(
      Sql.named('SELECT * FROM profiles WHERE user_id = @userId'),
      parameters: {'userId': userId},
    );

    if (results.isEmpty) return null;
    return Profile.fromRow(results.first.toColumnMap());
  }

  Future create({
    required String userId,
    String? bio,
    String? avatarUrl,
    String? phone,
    String? location,
    String? website,
  }) async {
    final conn = await _conn;
    final results = await conn.execute(
      Sqlnamed('''
        INSERT INTO profiles (user_id, bio, avatar_url, phone, location, website)
        VALUES (@userId, @bio, @avatarUrl, @phone, @location, @website)
        RETURNING *
      '''),
      parameters: {
        'userId': userId,
        'bio': bio,
        'avatarUrl': avatarUrl,
        'phone': phone,
        'location': location,
        'website': website,
      },
    );

    return Profile.fromRow(results.first.toColumnMap());
  }

  Future update({
    required String userId,
    String? bio,
    String? avatarUrl,
    String? phone,
    String? location,
    String? website,
  }) async {
    final conn = await _conn;
    final results = await conn.execute(
      Sqlnamed('''
        UPDATE profiles
        SET
          bio = COALESCE(@bio, bio),
          avatar_url = COALESCE(@avatarUrl, avatar_url),
          phone = COALESCE(@phone, phone),
          location = COALESCE(@location, location),
          website = COALESCE(@website, website),
          updated_at = NOW()
        WHERE user_id = @userId
        RETURNING *
      '''),
      parameters: {
        'userId': userId,
        'bio': bio,
        'avatarUrl': avatarUrl,
        'phone': phone,
        'location': location,
        'website': website,
      },
    );

    if (results.isEmpty) return null;
    return Profile.fromRow(results.first.toColumnMap());
  }
}

资料处理类

资料处理类负责管理用户ID下对应的各类资料接口。在执行任何操作之前，它都会首先验证该用户是否存在——对于不存在的用户，无法创建、获取或更新其资料信息。此外，在允许创建新资料之前，该类还会检查系统中是否已存在相同的资料记录，从而防止重复创建。

创建文件“lib/handlers/profile_handler.dart”：

import 'dart:convert';
import 'package:shelf/shelf.dart';
import 'package:shelf/router/shelf-router.dart';
import '../repositories/profile_repository.dart';
import '../repositories/user_repository.dart';

class ProfileHandler {
  final ProfileRepository _profileRepository;
  final UserRepository _userRepository;

  ProfileHandler(this._profileRepository, this._userRepository);

  Router get router {
    final router = Router();
    router.get('//profile', _getProfile);
    router.post('//profile', _createProfile);
    router.put('//profile', _updateProfile);
    return router;
  }

  Future〈Response〉 _getProfile(Request request, String userId) async {
    final user = await _userRepository.findById(userId);
    if (user == null) {
      return Response.notFound(
        jsonEncode({'error': '用户未找到'},
        headers: {'Content-Type': 'application/json'},
      );
    }

    final profile = await _profileRepository.findByUserId(userId);
    if (profile == null) {
      return Response_notFound(
        jsonEncode({'error': '资料信息未找到'],
        headers: {'Content-Type': 'application/json'},
      );
    }

    return Response.ok(
      jsonEncode(profile.toJson()),
      headers: {'Content-Type': 'application/json'},
    );
  }

  Future〈Response〉 _createProfile(Request request, String userId) async {
    final user = await _userRepository.findById(userId);
    if (user == null) {
      return Response.notFound(
        jsonEncode({'error': '用户未找到'},
        headers: {'Content-Type': 'application/json'},
      );
    }

    final existing = await _profileRepository.findByUserId(userId);
    if (existing != null) {
      return Response(
        409,
        body: jsonEncode({'error': '该用户的资料信息已存在'},
        headers: {'Content-Type': 'application/json'},
      );
    }

    final body = jsonDecode(await request.readAsString()) as Map〈String, dynamic〉;

    final profile = await _profileRepository.create(
      userId: userId,
      bio: body['bio'] as String?,
      avatarUrl: body['avatarUrl'] as String?,
      phone: body['phone'] as String?,
      location: body['location'] as String?,
      website: body['website'] as String?,
    );

    return Response(
      201,
      body: jsonEncode(profile.toJson()),
      headers: {'Content-Type': 'application/json'},
    );
  }

  Future〈Response〉 _updateProfile(Request request, String userId) async {
    final body = jsonDecode(await request.readAsString()) as Map〈String, dynamic〉;

    final profile = await _profileRepository.update(
      userId: userId,
      bio: body['bio'] as String?,
      avatarUrl: body['avatarUrl'] as String(),
      phone: body['phone'] as String?,
      location: body['location'] as String(),
      website: body['website'] as String?,
    );

    if (profile == null) {
      return Response.notFound(
        jsonEncode({'error': '资料信息未找到'},
        headers: {'Content-Type': 'application/json'},
      );
    }

    return Response.ok(
      jsonEncode(profile.toJson()),
      headers: {'Content-Type': 'application/json'],
    );
  }
}

身份验证

在实现了核心的用户和资料管理功能之后，下一步就是保护API的安全性。

本项目中的身份验证机制分为两个部分：其中一个服务类负责处理加密操作，包括密码哈希以及JWT令牌的生成与验证；另一个处理类则提供注册和登录接口，客户端通过这些接口来获取令牌。一旦令牌被生成，身份验证中间件会在所有受保护的请求到达相应的处理函数之前对其进行验证。

密码哈希

创建文件`lib/services/auth_service.dart`：

import 'package:bcrypt/bcrypt.dart';
import 'package:dart_jsonwebtoken/dart_jsonwebtoken.dart';
import '../config/env.dart';
import '../models/user.dart';

class AuthService {
  String hashPassword(String password) {
    return BCrypt.hashpw(password, BCrypt.gensalt());
  }

  bool verifyPassword(String password, String hash) {
    return BCrypt.checkpw(password, hash);
  }

  String generateToken(User user) {
    final jwt = JWT(
      {
        'sub': user.id,
        'email': user.email,
        'iat': DateTime.now().millisecondsSinceEpoch ~/ 1000,
      },
    );

    return jwt.sign(
      SecretKey(Env.jwtSecret),
      Expires: Duration(hours: EnvjwtExpiryHours),
    );
  }

  JWT? verifyToken(String token) {
    try {
      return JWT.verify(token, SecretKey(Env_jwtSecret));
    } catch (_) {
      return null;
    }
  }
}

`BCrypt.hashpw`用于生成带有盐值的哈希值，而`BCrypt.checkpw`则用于将明文密码与存储的哈希值进行比对。盐值会直接嵌入到哈希值中，因此不需要单独保存。

当验证失败、令牌过期、签名无效或令牌格式不正确时，`verifyToken`方法会返回`null`，而不会抛出异常。这种设计有助于保持身份验证中间件的简洁性。

身份验证处理类

创建文件`lib/handlers/auth_handler.dart`：

import 'dart:convert';
import 'package:shelf/shelf.dart';
import 'package:shelf/router/shelf-router.dart';
import '../repositories/user_repository.dart';
import '../services/auth_service.dart';

class AuthHandler {
  final UserRepository _userRepository;
  final AuthService _authService;

  AuthHandler(this._userRepository, this._authService);

  Router get router {
    final router = Router();
    router.post('/register', _register);
    router.post('/login', _login);
    return router;
  }

  Future _register(Request request) async {
    final body = jsonDecode(await request.readAsString()) as Map;

    final email = body['email'] as String?;
    final password = body['password'] as String?;
    final firstName = body['firstName'] as String?;
    final lastName = body['lastName'] as String?;

    if (email == null || password == null || firstName == null || lastName == null) {
      return Response(
        400,
        body: jsonEncode({'error': '必须填写电子邮件、密码、名字和姓氏'},
        headers: {'Content-Type': 'application/json'},
      );
    }

    if (password.length < 8) {
      return Response(
        400,
        body: jsonEncode({'error': '密码长度至少为8个字符'},
        headers: {'Content-Type': 'application/json'},
      );
    }

    final existing = await _userRepository.findByEmail(email);
    if (existing != null) {
      return Response(
        409,
        body: jsonEncode({'error': '该电子邮件已存在'),
        headers: {'Content-Type': 'application/json'},
      );
    }

    final passwordHash = _authService.hashPassword(password);

    final user = await _userRepository.create(
      email: email,
      passwordHash: passwordHash,
      firstName: firstName,
      lastName: lastName,
    );

    final token = _authService.generateToken(user);

    return Response(
      201,
      body: jsonEncode({
        'user': user.toJson(),
        'token': token,
      }),
      headers: {'Content-Type': 'application/json'},
    );
  }

  Future _login(Request request) async {
    final body = jsonDecode(await request.readAsString()) as Map;

    final email = body['email'] as String?;
    final password = body['password'] as String)?

    if (email == null || password == null) {
      return Response(
        400,
        body: jsonEncode({'error': '必须填写电子邮件和密码'},
        headers: {'Content-Type': 'application/json'},
      );
    }

    final user = await _userRepository.findByEmail(email);

    // 故意设置模糊的错误提示，不确认该电子邮件是否确实存在
    if (user == null || !_authService.verifyPassword(password, user.passwordHash)) {
      return Response(
        401,
        body: jsonEncode({'error': '电子邮件或密码无效'),
        headers: {'Content-Type': 'application/json'},
      );
    }

    final token = _authService.generateToken(user);

    return Response.ok(
      jsonEncode({
        'user': user.toJson(),
        'token': token,
      }),
      headers: {'Content-Type': 'application/json'],
    );
  }
}

登录错误信息的表述故意含糊其辞，会显示“电子邮件或密码无效”，而不是“找不到该电子邮件”或“密码错误”。如果能够确定是哪一部分出了问题，攻击者就能找出有效的账户信息。

认证中间件

创建文件 lib/middleware/auth_middleware.dart：

import 'dart:convert';
import 'package:shelf/shelf.dart';
import '../services/auth_service.dart';

Middleware authMiddleware(AuthService authService) {
  return (Handler innerHandler) {
    return (Request request) async {
      final authHeader = request.headers['authorization'];

      if (authHeader == null || !authHeader.startsWith('Bearer ')) {
        return Response(
          401,
          body: jsonEncode({'error': '授权头信息缺失或格式不正确'],
          headers: {'Content-Type': 'application/json'},
        );
      }

      final token = authHeader.substring(7); // 删除 'Bearer ' 字段
      final jwt = authService.verifyToken(token);

      if (jwt == null) {
        return Response(
          401,
          body: jsonEncode({'error': '令牌无效或已过期'),
          headers: {'Content-Type': 'application/json'},
        );
      }

      // 将用户ID添加到请求对象中，以便后续的处理函数能够获取
      final updatedRequest = request.change(
        context: {
          ...request.context,
          'userId': jwt.payload['sub'] as String,
          'userEmail': jwt_payload['email'] as String,
        },
      );

      return innerHandler(updatedRequest);
    };
  };
}

`request.change(context: {...})` 这种方式用于在Shelf框架中将数据从中间件传递给处理函数。这种机制与Express或ASP.NET中的中间件类似，任何后续的处理函数都可以通过 `request.context['userId']` 来获取已认证用户的身份信息。

错误处理

无论你多么谨慎地编写处理函数，在实际运行环境中还是可能会遇到各种意外故障——比如请求体格式不正确、数据库查询超时，或者一些边缘情况没有被妥善处理。

我们不会让每个处理函数都单独负责处理错误响应，而是将错误处理功能集中到一个中间件中，这个中间件会覆盖整个处理流程。这样就能确保所有接口的错误响应格式都保持一致，同时也能防止内部错误细节泄露给客户端。

创建文件 lib/middleware/error_middleware.dart：

import 'dart:convert';
import 'package:shelf/shelf.dart';

Middleware errorMiddleware() {
  return (Handler innerHandler) {
    return (Request request) async {
      try {
        return await innerHandler(request);
      } on FormatException catch (e) {
        return Response(
          400,
          body: jsonEncode({'error': '请求体格式不正确：${e.message}'),
          headers: {'Content-Type': 'application/json'},
        );
      } catch (e, stackTrace) {
        // 在服务器端记录完整的错误信息及堆栈跟踪
        print('未处理的错误：$e');
        print(stackTrace);

        // 绝不要将内部错误细节暴露给客户端
        return Response(
          500,
          body: jsonEncode({'error': '发生了内部服务器错误'),
          headers: {'Content-Type': 'application/json'},
        );
      }
    };
  };
}

创建文件 `lib/middleware/logger_middleware.dart`：

import 'package:shelf/shelf.dart';

Middleware loggerMiddleware() {
  return (Handler innerHandler) {
    return (Request request) async {
      final start = DateTime.now();

      final response = await innerHandler(request);

      final duration = DateTime.now().difference(start).inMilliseconds;
      print(
        '[${DateTime.now().toIso8601String()}] '
        '\({request.method} \){request.url.path} '
        '→ \({response.statusCode} (\){duration}ms)',
      );

      return response;
    };
  };
}

将所有组件连接起来

当处理器、数据存储层和中间件都准备就绪后，最后一步就是将它们全部连接成一个可以正常运行的服务器。路由器会将特定的 URL 前缀映射到相应的处理器上，中间件会按照正确的顺序被添加到处理流程中，而入口点则会依次启动所有组件——加载环境变量、执行数据库迁移操作，最后启动服务器。

创建文件 `lib/router.dart`：

import 'package:shelf/router/shelf-router.dart';
import 'handlers/auth_handler.dart';
import 'handlers/user_handler.dart';
import 'handlers/profile_handler.dart';
import 'middleware/auth_middleware.dart';
import 'repositories/user_repository.dart';
import 'repositories/profile_repository.dart';
import 'services/auth_service.dart';

Router createRouter() {
  final userRepository = UserRepository();
  final profileRepository = ProfileRepository();
  final authService =AuthService();

  final authHandler = AuthHandler(userRepository, authService);
  final userHandler = UserHandler(userRepository);
  final profileHandler = ProfileHandler(profileRepository, userRepository);

  final router = Router();

  // 公开路由，无需身份验证
  router.mount('/auth', authHandler.router.call);

  // 需要身份验证的路由，会应用相应的中间件
  router.mount(
    '/users',
    Pipeline()
        .addMiddleware(authMiddleware(authService))
        .addHandler(userHandler.router.call),
  );

  router.mount(
    '/users',
    Pipeline()
        .addMiddleware(authMiddleware(authService))
        .addHandler(profileHandler.router.call),
  );

  return router;
}

创建入口文件 `bin/server.dart`：

import 'dart:io';
import 'package:shelf/shelf.dart';
import 'package:shelf/shelf_io.dart' as shelf_io;
import '../lib/config/database.dart';
import '../lib/config/env.dart';
import '../lib/middleware/error_middleware.dart';
import '../lib/middleware/logger_middleware.dart';
import '../lib/router.dart';

void main() async {
  // 加载环境变量
  Env.load();

  // 执行数据库迁移操作
  await Database.runMigrations();

  // 构建处理流程
  final router = createRouter();

  final handler = Pipeline()
      .addMiddleware(errorMiddleware())
      .addMiddleware(loggerMiddleware())
      .addHandler(router.call);

  // 启动服务器
  final server = await shelf_io.serve(
    handler,
    InternetAddress.anyIPv4,
    Env.port,
  );

  print('🚀 服务器已在端口 ${server.port} 上启动');
}

运行服务器：

dart run bin/server.dart
# ✅ 数据库已连接：localhost:5432/user_profile_api
# ✅ 迁移脚本已应用：migrations/001_create_users.sql
# ✅ 迁移脚本已应用：migrations/002_create_profiles.sql
# 🚀 服务器正在8080端口运行

部署

服务器现已在本地运行，所有端点也都能够正常工作。现在，是时候将其正式部署到生产环境中了。

我们将介绍两种部署方案：首先使用Docker Compose将应用程序和数据库打包在一起，以便进行本地生产环境测试；之后再将部署到Fly.io平台上，在那里你的API可以通过互联网访问，同时还会使用托管的PostgreSQL数据库以及自动加密机制。

Dockerfile

在项目根目录下创建Dockerfile：

FROM dart:stable AS build

WORKDIR /app
COPY pubspec.* ./
RUN dart pub get

COPY . .
RUN dart compile exe bin/server.dart -o bin/server

FROM debian:stable-slim

RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY --from=build /app/bin/server bin/server
COPY --from=build /app/migrations migrations/

EXPOSE 8080

CMD ["bin/server"]

这是一个多阶段的构建过程。第一阶段使用完整的Dart SDK镜像将服务器代码编译成本地二进制文件；第二阶段仅将编译后的二进制文件及迁移脚本复制到轻量级的Debian镜像中——这个最终生成的镜像不包含Dart SDK、源代码或构建工具，因此非常简洁，且可以直接用于生产环境。

用于本地生产测试的Docker Compose

更新docker-compose.yml文件，以便将应用程序和数据库一起部署：

version: '3.8'

services:
  postgres:
    image: postgres:16-alpine
    container_name: user_profile_db
    environment:
      POSTGRES_DB: user_profile_api
      POSTGRES_USER: dart_user
      POSTGRES_PASSWORD: dart_password
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U dart_user -d user_profile_api"]
      interval: 5s
      timeout: 5s
      retries: 5

  api:
    build: .
    container_name: user_profile_api
    ports:
      - "8080:8080"
    environment:
      DB_HOST: postgres
      DB_PORT: 5432
      DB_NAME: user_profile_api
      DB_USER: dart_user
      DB_PASSWORD: dart_password
      JWT_SECRET: local_test_secret_replace_in_production
      JWT_EXPIRY_HOURS: 24
      PORT: 8080
    depends_on:
      postgres:
        condition: service_healthy

volumes:
  postgres_data:

对Postgres服务进行的健康检查可以确保只有在数据库准备好接受连接时，API容器才会启动——这对于避免服务同时启动时可能出现的故障非常有用。

完成所有配置后，执行构建并运行应用程序：

docker compose up --build

将应用部署到Fly.io平台

Fly.io是用于部署容器化后端服务的非常理想的平台。它能够处理全球范围内的服务分发、自动配置TLS连接，并负责管理PostgreSQL数据库。

步骤1 – 安装并登录：

# 在macOS系统上
brew install flyctl

# 登录
fly auth login

步骤2 – 启动应用程序：

fly launch

Fly会自动检测到Dockerfile文件，然后会询问用户一些信息：应用程序名称、所在地区以及是否需要创建PostgreSQL数据库。如果选择创建数据库，Fly会自动配置并管理该数据库，并生成相应的连接字符串。

步骤3 – 设置环境变量：

fly secrets set JWT_SECRET="你的生产密钥"
fly secrets set JWT_EXPIRY_HOURS="24"

Fly在配置PostgreSQL集群时会自动设置数据库连接相关的变量。

步骤4 – 部署应用程序：

fly deploy

Fly会生成Docker镜像，将其上传到指定的注册服务器中，然后部署到你选择的地区。部署完成后，你可以使用以下命令查看应用程序的状态：

fly status
# 你的应用程序正在https://your-app-name.fly.dev上运行

步骤5 – 验证部署结果：

curl https://your-app-name.fly.dev/auth/register \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"email":"test@example.com","password":"password123","firstName":"Seyi","lastName":"Dev"}'

curl http://localhost:8080/auth/register \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "email": "seyi@example.com",
    "password": "securepassword",
    "firstName": "Seyi",
    "lastName": "Dev"
  }'

{
  "user": {
    "id": "uuid-here",
    "email": "seyi@example.com",
    "firstName": "Seyi",
    "lastName": "Dev",
    "isActive": true,
    "createdAt": "2025-01-01T00:00:00.000Z",
    "updatedAt": "2025-01-01T00:00:00.000Z"
  },
  "token": "eyJhbGci..."
}

curl http://localhost:8080/auth/login \
  -X POST \
  -H "Content-Type: application/json" \
  -d '{"email": "seyi@example.com", "password": "securepassword"}'

curl http://localhost:8080/users \
  -H "Authorization: Bearer eyJhbGci..."

curl http://localhost:8080/users/{userId}/profile \
  -X POST \
  -H "Authorization: Bearer eyJhbGci..." \
  -H "Content-Type: application/json" \
  -d '{
    "bio": "曾是一名Flutter工程师，现在从事后端开发工作",
    "location": "尼日利亚拉各斯",
    "website": "https://example.com"
  }'

curl http://localhost:8080/users/{userId} \
  -X PUT \
  -H "Authorization: Bearer eyJhbGci..." \
  -H "Content-Type: application/json" \
  -d '{"firstName": "Oluwaseyi"}'

curl http://localhost:8080/users/{userId} \
  -X DELETE \
  -H "Authorization: Bearer eyJhbGci..."