Short Links: Delete with a Key

A link's creator should be able to delete it, and nobody else. Codes count 1, 2, 3, so anyone can guess them: knowing a code proves nothing. The proof is a key, a random secret the app makes with each new link and sends only to its creator, in the 201 answer. To delete, the client sends that key back in a request header named X-Owner-Key.

The given helper makeKey() uses Go's crypto/rand to make keys nobody can guess, and the built-in delete removes a key and its value from a map:

token := makeKey()    // 16 hex characters, like "4f0c9a7e21b3d865"
scores := map[string]int{"ann": 3, "bob": 5}
delete(scores, "ann") // scores is now map[bob:5]

A handler reads a header with r.Header.Get(...), which gives "" when the header is missing. Here is a header check on another route:

app.HandleFunc("GET /admin/report", func(w http.ResponseWriter, r *http.Request) {
	if r.Header.Get("X-Admin-Token") != adminToken {
		writeJSON(w, 403, map[string]string{"error": "Not allowed"})
		return
	}
	writeJSON(w, 200, map[string]int{"links": len(links)})
})

403 Forbidden means "you may not do this". A missing key and a wrong key get the same 403: there are no accounts to log in to. A delete that works answers 204 No Content, with an empty body: w.WriteHeader(204) with nothing written after it. These are the test requests, in order (<key>, <key2> and <key3> stand for the random keys of links 1, 2 and 3):

POST /links  {"url": "https://www.python.org/downloads/"}  →  201  {"code": "1", "key": "<key>", "url": "https://www.python.org/downloads/"}
POST /links  {"url": "https://en.wikipedia.org/wiki/URL_shortening"}  →  201  {"code": "2", "key": "<key2>", "url": "https://en.wikipedia.org/wiki/URL_shortening"}
POST /links  {"url": "https://www.python.org/downloads/"}  →  200  {"code": "1", "url": "https://www.python.org/downloads/"}
DELETE /links/1  (no key)  →  403  {"error": "Wrong or missing key"}
DELETE /links/1  X-Owner-Key: <key2>  →  403  {"error": "Wrong or missing key"}
DELETE /links/1  X-Owner-Key: <key>  →  204  (empty body)
GET /1  →  404  {"error": "Link not found"}
DELETE /links/1  X-Owner-Key: <key>  →  404  {"error": "Link not found"}
GET /links/2/stats  →  200  {"clicks": 0, "code": "2", "url": "https://en.wikipedia.org/wiki/URL_shortening"}
POST /links  {"url": "https://flask.palletsprojects.com/en/stable/quickstart/"}  →  201  {"code": "3", "key": "<key3>", "url": "https://flask.palletsprojects.com/en/stable/quickstart/"}

Your task: in the POST /links handler, make a key with makeKey(), store it in the new link's Key field and add it to the 201 answer. Then register a DELETE /links/{code} handler: 404 for an unknown code, 403 when the X-Owner-Key header isn't that link's Key, and otherwise delete the link and answer an empty 204.

Assignment
Follow the Coding Tutorial to give every new link a secret key and to add the DELETE handler that checks it.

Hint
Check the code before the key: for an unknown code, links[code] is nil, and reading its Key would panic. Each error answer needs its own return. The answer for a URL that was already shortened stays without the key.