For test 2: You have to get the hostname of the url in the request body. Then you use dns.lookup() to verify the hostname. The dns.lookup() will tell if the url is invalid or not. Using a regex might not work.
For test 3: Make sure the find the shortUrl request parameter using findOne() of mongoose. Then use the select("-_id -__v") on the query if you don’t want these fields.