chore: 🤖 resolve rollup vulnerability by removing ember-fetch (#2505)

✅ Closes: https://hashicorp.atlassian.net/browse/ICU-15189

addons/auth/addon/authenticators/base.js

@@ -5,7 +5,7 @@
 
 import SimpleAuthBaseAuthenticator from 'ember-simple-auth/authenticators/base';
 import { resolve, reject } from 'rsvp';
-import fetch from 'fetch';
+import { waitForPromise } from '@ember/test-waiters';
 
 /**
  * Encapsulates common authenticator functionality.
@@ -58,10 +58,14 @@ export default class BaseAuthenticator extends SimpleAuthBaseAuthenticator {
    */
   async validateToken(token, tokenID) {
     const tokenValidationURL = this.buildTokenValidationEndpointURL(tokenID);
-    const response = await fetch(tokenValidationURL, {
-      method: 'get',
-      headers: { Authorization: `Bearer ${token}` },
-    });
+    // Note: waitForPromise is needed to provide the necessary integration with @ember/test-helpers
+    // visit https://www.npmjs.com/package/@ember/test-waiters for more info.
+    const response = await waitForPromise(
+      fetch(tokenValidationURL, {
+        method: 'get',
+        headers: { Authorization: `Bearer ${token}` },
+      }),
+    );
     // 401 and 404 responses mean the token is invalid, whereas other types of
     // error responses do not tell us about the validity of the token.
     if (response.status === 401 || response.status === 404) return reject();
@@ -103,7 +107,7 @@ export default class BaseAuthenticator extends SimpleAuthBaseAuthenticator {
   }
 
   /**
-   * Posts to the `deauthEntpoint` on a best-effort basis and then returns.
+   * Posts to the `deauthEndpoint` on a best-effort basis and then returns.
    * Deauthentication with the server is not guaranteed and request failures
    * are ignored.
    *
@@ -113,12 +117,14 @@ export default class BaseAuthenticator extends SimpleAuthBaseAuthenticator {
   async invalidate(options) {
     const { token } = options;
     const deauthEndpointURL = this.buildDeauthEndpointURL(options);
-    await fetch(deauthEndpointURL, {
-      method: 'delete',
-      headers: { Authorization: `Bearer ${token}` },
-    }).catch(() => {
-      /* no op */
-    });
+    await waitForPromise(
+      fetch(deauthEndpointURL, {
+        method: 'delete',
+        headers: { Authorization: `Bearer ${token}` },
+      }).catch(() => {
+        /* no op */
+      }),
+    );
     return super.invalidate(...arguments);
   }
 }

addons/auth/addon/authenticators/oidc.js

@@ -6,7 +6,7 @@
 import BaseAuthenticator from './base';
 import { inject as service } from '@ember/service';
 import { reject } from 'rsvp';
-import fetch from 'fetch';
+import { waitForPromise } from '@ember/test-waiters';
 
 /**
  * The OIDC base authenticator encapsulates the multistep OIDC flow.
@@ -47,7 +47,9 @@ export default class OIDCAuthenticator extends BaseAuthenticator {
   async startAuthentication(options) {
     const url = this.buildAuthEndpointURL(options);
     const body = JSON.stringify({ command: 'start' });
-    const response = await fetch(url, { method: 'post', body });
+    // Note: waitForPromise is needed to provide the necessary integration with @ember/test-helpers
+    // visit https://www.npmjs.com/package/@ember/test-waiters for more info.
+    const response = await waitForPromise(fetch(url, { method: 'post', body }));
     const json = await response.json();
     if (response.status < 400) {
       // Store meta about the pending OIDC flow
@@ -94,7 +96,7 @@ export default class OIDCAuthenticator extends BaseAuthenticator {
       },
     });
     // Fetch the endpoint and get the response JSON
-    const response = await fetch(url, { method: 'post', body });
+    const response = await waitForPromise(fetch(url, { method: 'post', body }));
     if (response.status === 202) {
       // The token isn't ready yet, keep trying.
       return false;

addons/auth/addon/authenticators/password.js

@@ -5,7 +5,7 @@
 
 import BaseAuthenticator from './base';
 import { resolve, reject } from 'rsvp';
-import fetch from 'fetch';
+import { waitForPromise } from '@ember/test-waiters';
 
 /**
  *
@@ -66,7 +66,11 @@ export default class PasswordAuthenticator extends BaseAuthenticator {
       attributes: { login_name, password },
     });
     const authEndpointURL = this.buildAuthEndpointURL(options);
-    const response = await fetch(authEndpointURL, { method: 'post', body });
+    // Note: waitForPromise is needed to provide the necessary integration with @ember/test-helpers
+    // visit https://www.npmjs.com/package/@ember/test-waiters for more info.
+    const response = await waitForPromise(
+      fetch(authEndpointURL, { method: 'post', body }),
+    );
     const json = await response.json();
     return response.status < 400
       ? resolve(this.normalizeData(json, login_name))

addons/auth/package.json

@@ -23,7 +23,6 @@
   "dependencies": {
     "ember-cli-babel": "^8.2.0",
     "ember-cli-htmlbars": "^6.2.0",
-    "ember-fetch": "^8.1.1",
     "ember-simple-auth": "^4.2.2"
   },
   "devDependencies": {
@@ -32,6 +31,7 @@
     "@ember/optional-features": "^2.0.0",
     "@ember/string": "^3.0.1",
     "@ember/test-helpers": "^3.3.1",
+    "@ember/test-waiters": "^3.1.0",
     "@embroider/test-setup": "^2.1.1",
     "@glimmer/component": "^1.1.2",
     "@glimmer/tracking": "^1.1.2",