Address some final review coments about cross-fetch and type-casting

plugins/auth-backend/package.json

@@ -65,7 +65,6 @@
     "passport-okta-oauth": "^0.0.1",
     "passport-onelogin-oauth": "^0.0.1",
     "passport-saml": "^2.0.0",
-    "r2": "^2.0.1",
     "uuid": "^8.0.0",
     "winston": "^3.2.1",
     "yn": "^4.0.0"

plugins/auth-backend/src/identity/TokenFactory.test.ts

@@ -81,13 +81,7 @@ describe('TokenFactory', () => {
     const token = await factory.issueToken({ claims: { sub: 'foo' } });
 
     const { keys } = await factory.listPublicKeys();
-    const keyMap: {
-      [key: string]: AnyJWK;
-    } = {};
-
-    keys.forEach(key => {
-      keyMap[key.kid] = key;
-    });
+    const keyMap = Object.fromEntries(keys.map(key => [key.kid, key]));
 
     const payload = (
       await jwtVerify(token, async header => {

plugins/auth-backend/src/identity/TokenFactory.ts

@@ -133,7 +133,6 @@ export class TokenFactory implements TokenIssuer {
       const kid = uuid();
       const jwk = await fromKeyLike(key.privateKey);
 
-      // @ts-ignore https://github.com/microsoft/TypeScript/issues/13195 -
       // JOSE Library provides optional for most fields - and TS does not distinguish between missing/undefined.
       // Because AnyJWK requires keys to have type "string", this throws a TypeError - though in practice, if the field
       // is undefined, JOSE will not send it back as key.
@@ -142,7 +141,7 @@ export class TokenFactory implements TokenIssuer {
         alg: 'ES256',
         kid: kid,
         use: 'sig',
-      };
+      } as AnyJWK;
       // We're not allowed to use the key until it has been successfully stored
       // TODO: some token verification implementations aggressively cache the list of keys, and
       //       don't attempt to fetch new ones even if they encounter an unknown kid. Therefore we

plugins/auth-backend/src/providers/aws-alb/provider.test.ts

@@ -30,11 +30,13 @@ yOlxJ2VW88mLAQGJ7HPAvOdylxZsItMnzCuqNzZvie8m/NJsOjhDncVkrw==
 `;
 };
 
-jest.mock('r2', () => ({
+jest.mock('cross-fetch', () => ({
   __esModule: true,
-  default: () => {
+  default: async () => {
     return {
-      text: mockKey(),
+      json: async () => {
+        return mockKey();
+      },
     };
   },
 }));

plugins/auth-backend/src/providers/aws-alb/provider.ts

@@ -19,8 +19,7 @@ import {
   ExperimentalIdentityResolver,
 } from '../types';
 import express from 'express';
-// @ts-ignore no types available for R2
-import r2 from 'r2';
+import fetch from 'cross-fetch';
 import * as crypto from 'crypto';
 import { KeyObject } from 'crypto';
 import { Logger } from 'winston';
@@ -101,9 +100,9 @@ export class AwsAlbAuthProvider implements AuthProviderRouteHandlers {
     if (optionalCacheKey) {
       return optionalCacheKey;
     }
-    const keyText: string = await r2(
+    const keyText: string = await fetch(
       `https://public-keys.auth.elb.${this.options.region}.amazonaws.com/${keyId}`,
-    ).text;
+    ).then(response => response.json());
     const keyValue = crypto.createPublicKey(keyText);
     this.keyCache.set(keyId, keyValue);
     return keyValue;