Step 8: Test the rules

const assert = require("assert");

function parseTarget(input) {
  if (typeof input !== "string" || input.length > 2000) return { error: "bad type or too long" };
  let url;
  try { url = new URL(input); } catch { return { error: "not a valid URL" }; }
  if (url.protocol !== "http:" && url.protocol !== "https:") return { error: "only http and https" };
  return { url: url.toString() };
}

const cases = [
  ["https://example.com", true],
  ["http://example.com/a?b=c#d", true],
  ["ftp://example.com", false],
  ["javascript:alert(1)", false],
  ["//example.com", false],
  ["", false],
  [null, false],
];

let failed = 0;
for (const [input, shouldPass] of cases) {
  try {
    assert.strictEqual(Boolean(parseTarget(input).url), shouldPass);
    console.log("ok  ", JSON.stringify(input));
  } catch {
    failed++;
    console.log("FAIL", JSON.stringify(input));
  }
}
console.log(failed === 0 ? `all ${cases.length} cases passed` : `${failed} failed`);

// a normalised URL is stable, so the same link can be recognised twice
assert.strictEqual(parseTarget("HTTPS://EXAMPLE.com").url, "https://example.com/");
console.log("normalisation ok");

ok   "https://example.com"
ok   "http://example.com/a?b=c#d"
ok   "ftp://example.com"
ok   "javascript:alert(1)"
ok   "//example.com"
ok   ""
ok   null
all 7 cases passed
normalisation ok