Who May Change Things? in JavaScript

Right now anyone can add a product to the shop: POST /products saves whatever it receives and never asks who is calling. A real shop lets everyone read its products, but only its owner may change them. The simplest way to tell the owner apart: the owner knows a secret, the admin key, and sends it with every request that changes something.

The key travels in a header: a name and a value that go with the request, next to the body. In Express you read one with req.get("Name"). Like a missing value in req.query, it gives undefined when the request doesn't have that header. Here a made-up route picks its greeting from a header:

app.get("/hello", (req, res) => {
  const lang = req.get("X-Language");
  if (lang === "fr") {
    return res.json({ message: "Bonjour" });
  }
  res.json({ message: "Hello" });
});

When the key is missing or wrong, the shop answers 401 Unauthorized, which means "I don't know who you are", and saves nothing. With the right key, the product is added as before. These are the requests your code must answer:

POST /products  {"name": "Vase", "price": 18}  (no key)                    →  401  {"error": "Missing or unknown key"}
POST /products  {"name": "Vase", "price": 18}  X-Admin-Key: let-me-in      →  401  {"error": "Missing or unknown key"}
POST /products  {"name": "Vase", "price": 18}  X-Admin-Key: admin-key-123  →  201  {"id": 9, "name": "Vase", "price": 18}
GET /products/9   →  200  {"category": null, "id": 9, "name": "Vase", "price": 18, "stock": 0}
GET /products/10  →  404  {"error": "Product not found"}

Your task: store the secret "admin-key-123" in a constant ADMIN_KEY. At the start of the POST /products route's function, read the X-Admin-Key header into key, and when it isn't the admin key, answer {"error": "Missing or unknown key"} with the status 401 before anything is saved.

Assignment
Follow the Coding Tutorial to protect POST /products with the admin key.

Hint
Put the check before the line that reads req.body and the INSERT: once the row is saved, a 401 comes too late. One !== covers both cases, because a missing header gives undefined, and undefined isn't the key either.