Short Links: Delete with a Key in JavaScript

A link's creator should be able to delete it, and nobody else. Codes count 1, 2, 3, so anyone can guess them: knowing a code proves nothing. The proof is a key, a random secret the app makes with each new link and sends only to its creator, in the 201 answer. To delete, the client sends that key back in a request header named X-Owner-Key.

Node's crypto module makes keys nobody can guess, and the delete operator removes a key and its value from an object:

const crypto = require("node:crypto");
const token = crypto.randomBytes(8).toString("hex");  // 16 hex characters, like "4f0c9a7e21b3d865"
const scores = { ann: 3, bob: 5 };
delete scores["ann"];                                  // scores is now { bob: 5 }

A route reads a header with req.get(...), which gives undefined when the header is missing. Here is a header check on another route:

app.get("/admin/report", (req, res) => {
  if (req.get("X-Admin-Token") !== ADMIN_TOKEN) {
    return res.status(403).json({ error: "Not allowed" });
  }
  res.json({ links: Object.keys(links).length });
});

403 Forbidden means "you may not do this". A missing key and a wrong key get the same 403: there are no accounts to log in to. A delete that works answers 204 No Content, with an empty body. These are the test requests, in order (<key>, <key2> and <key3> stand for the random keys of links 1, 2 and 3):

POST /links  {"url": "https://www.python.org/downloads/"}  →  201  {"code": "1", "url": "https://www.python.org/downloads/", "key": "<key>"}
POST /links  {"url": "https://en.wikipedia.org/wiki/URL_shortening"}  →  201  {"code": "2", "url": "https://en.wikipedia.org/wiki/URL_shortening", "key": "<key2>"}
POST /links  {"url": "https://www.python.org/downloads/"}  →  200  {"code": "1", "url": "https://www.python.org/downloads/"}
DELETE /links/1  (no key)  →  403  {"error": "Wrong or missing key"}
DELETE /links/1  X-Owner-Key: <key2>  →  403  {"error": "Wrong or missing key"}
DELETE /links/1  X-Owner-Key: <key>  →  204  (empty body)
GET /1  →  404  {"error": "Link not found"}
DELETE /links/1  X-Owner-Key: <key>  →  404  {"error": "Link not found"}
GET /links/2/stats  →  200  {"code": "2", "url": "https://en.wikipedia.org/wiki/URL_shortening", "clicks": 0}
POST /links  {"url": "https://flask.palletsprojects.com/en/stable/quickstart/"}  →  201  {"code": "3", "url": "https://flask.palletsprojects.com/en/stable/quickstart/", "key": "<key3>"}

Your task: in the POST /links route, make a key with crypto.randomBytes(8).toString("hex"), store it with the new link and add it to the 201 answer. Then add DELETE /links/:code: 404 for an unknown code, 403 when the X-Owner-Key header isn't that link's key, and otherwise delete the link and answer an empty 204.

Assignment
Follow the Coding Tutorial to give every new link a secret key and to add the DELETE route that checks it.

Hint
Check the code before the key: for an unknown code, links[code].key would crash. The answer for a URL that was already shortened stays without the key. An empty body is .send() with nothing in the parentheses.