401 or 403?

The shop now hands out keys to its staff too, for other jobs later. Adding products stays the owner's job. So a refused request can mean two different things, and HTTP has a status for each.

401 Unauthorized means "I don't know who you are": the key is missing, or it isn't one of the shop's keys. 403 Forbidden means "I know who you are, and you may not do this": the key is real, but its role isn't allowed. After a 401 a client should send a valid key; after a 403, trying again won't help.

An object can map each valid key to its role. The type { [key: string]: string } says its property names are strings, each with a string value. Square brackets look up a property by its name and give the value stored for it, or undefined when the object has nothing under that name. Here with made-up keys for a music app:

const PLANS: { [key: string]: string } = { "free-key-1": "free", "pro-key-2": "pro" };
const noKey: string | undefined = undefined;
console.log(PLANS["pro-key-2"]);    // pro
console.log(PLANS["no-such-key"]);  // undefined
console.log(PLANS[noKey]);          // undefined

These are the requests your code must answer:

POST /products  {"name": "Vase", "price": 18}  (no key)                    →  401  {"error": "Missing or unknown key"}
POST /products  {"name": "Vase", "price": 18}  X-Admin-Key: let-me-in      →  401  {"error": "Missing or unknown key"}
POST /products  {"name": "Vase", "price": 18}  X-Admin-Key: staff-key-456  →  403  {"error": "Admins only"}
POST /products  {"name": "Vase", "price": 18}  X-Admin-Key: admin-key-123  →  201  {"id": 9, "name": "Vase", "price": 18}
GET /products/10  →  404  {"error": "Product not found"}

Your task: replace ADMIN_KEY with an object API_KEYS of type { [key: string]: string } that maps "admin-key-123" to "admin" and "staff-key-456" to "staff". In the POST /products route, answer 401 when API_KEYS[key] is undefined, then 403 with {"error": "Admins only"} when its role isn't "admin".

Assignment
Follow the Coding Tutorial to tell an unknown caller (401) from a known caller who isn't allowed (403).

Hint
Keep the order: 401 first, then 403. With the role check first, a missing key would get 403, because undefined isn't "admin" either. After the 401 check, every key that's left has a role in API_KEYS.