Short Links: Only Real URLs in JavaScript

Right now your shortener shortens anything it gets: even a body with no url gets a code, for a link that leads nowhere. Short links are clicked by strangers, so the app should check what it gets first. Bad input is turned away with 400 Bad Request, before anything is counted or stored.

Two tools do the checking. A property that is missing from an object is undefined, and calling a string method on undefined crashes. The || operator gives a default instead: a || b is a when it is there and b when it is missing. A string's startsWith method tells you whether it begins with a given text. Here is the same idea on another route, a list of tags that only accepts names starting with #:

app.post("/tags", (req, res) => {
  const name = req.body.name || "";
  if (!name.startsWith("#")) {
    return res.status(400).json({ error: "A tag starts with #" });
  }
  tags.push(name);
  res.status(201).json({ name: name });
});

Only addresses that start with http:// or https:// are web pages to send people to. Without that start, a browser reads www.python.org as a page of your own app, and ftp: or javascript: addresses don't belong behind a link strangers click. One more rule: the same URL sent twice gets the code it already has, with 200 OK, because nothing new was created. These are the test requests, in order:

POST /links  {"url": "https://www.python.org/downloads/"}  →  201  {"code": "1", "url": "https://www.python.org/downloads/"}
POST /links  {"url": "ftp://files.example.com/report.pdf"}  →  400  {"error": "The URL must start with http:// or https://"}
POST /links  {"url": "javascript:alert(1)"}  →  400  {"error": "The URL must start with http:// or https://"}
POST /links  {"url": "www.python.org"}  →  400  {"error": "The URL must start with http:// or https://"}
POST /links  {}  →  400  {"error": "The URL must start with http:// or https://"}
POST /links  {"url": "http://example.com/old-page"}  →  201  {"code": "2", "url": "http://example.com/old-page"}
POST /links  {"url": "https://www.python.org/downloads/"}  →  200  {"code": "1", "url": "https://www.python.org/downloads/"}
GET /links/3/stats  →  404  {"error": "Link not found"}
GET /2  →  302  Location: http://example.com/old-page

Your task: in the POST /links route, read the URL with || and the default "", and answer 400 with the error above when it starts with neither http:// nor https://. Then, before making a new code, look through links: if a stored link has the same URL, answer its code and URL with 200.

Assignment
Follow the Coding Tutorial to make the POST /links route accept only real web addresses and give a URL it already knows its old code.

Hint
Both checks go above lastNumber += 1, so a refused or repeated URL uses up no number: that is why GET /links/3/stats answers 404. A for...in loop over an object gives its keys, here the codes.