Now that we have decided to attach our token using the Authorization header with the Bearer scheme, our next action is to write the tests for this authentication system. For our use cases, let's say that all endpoints that alter a user's document (that is, all POST, PATCH, and PUT requests except /login) will require a token where the sub property matches the ID of the user.

As always, we begin development by writing tests. Let's start with the Delete User endpoint, which should respond with the following:

• 200 OK if the Authorization header is set to a well-formed credential (for example, it has the structure username:bcrypt-digest. We will verify whether these credentials correspond with a real user in the next step; right now, we just care whether it has the correct structure.)
• 400 Bad Request if the Authorization header is set but its value is not well-formed.
• 401 Unauthorized if the Authorization header is not set at all, or if the credentials do not match the specified user's.
• 403 Forbidden if the user is trying to delete another user.
• 404 Not Found if the user to be deleted cannot be found.