chore(profile): replace request with native fetch

[toufali]

Because

• request is deprecated upstream (Request’s Past, Present and Future request/request#3142), and this was the last first-party usage in the repo.
• nock 13 can't intercept fetch, and upgrading it was already tried and rejected (task: upgrade jest and nock to support native fetch #18724), so the mocks move to plain Jest fetch stubs — matching the axios conversions.

This pull request

• Converts the oauth /verify call, the auth-server profile lookup, and both image-worker calls to native fetch; deletes lib/request.js.
• Replaces nock in test/lib/mock.js with a global.fetch stub, so mock.done() still asserts every mock was consumed. The worker mock buffers the body and injects it into the real worker, keeping the image pipeline under test.
• Drops request, nock, and through. Also removes the S3 mock helpers, dead since img.driver is local in the test config.

Issue that this pull request solves

Closes: FXA-4892

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review

• lib/img-workers.js is the risky part: the avatar upload streams its body, and the worker route requires content-length. Forwarding the caller's header keeps it a fixed-length request — without it undici falls back to chunked encoding.
• Two deliberate behaviour changes: a non-JSON /verify body is now treated as absent, so a bare string can't be returned as credentials; and request's forever/maxSockets tuning is replaced by undici's pooling, since fetch has no agent option. (This worked for our Axios replacement as well.)

Other information (Optional)

request still resolves in the lockfile via node-zendesk, grunt-http, and z-schema; clearing that needs a node-zendesk upgrade, which would also free the remaining nock calls in fxa-auth-server, allowing us to remove altogether.

unit test currently failing due to unrelated terms/privacy change

[Copilot]

Pull request overview

This PR removes the deprecated request library from fxa-profile-server by migrating the remaining outbound HTTP calls (OAuth verify, auth-server profile lookup, and image-worker requests) to native fetch, and updates tests to mock fetch with Jest instead of nock.

Changes:

• Migrates OAuth /verify, auth-server /account/profile, and image-worker upload/delete calls from request to native fetch.
• Replaces nock-based test mocking with a global.fetch stub that asserts all expected requests were consumed and can inject requests into the real worker.
• Drops request, nock, and through, and deletes the now-unused helper modules (lib/request.js, test/lib/inject.js).

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
yarn.lock	Removes direct dependencies on request, nock, and through from the lockfile graph (where possible).
packages/fxa-profile-server/package.json	Drops request, nock, and through dependencies from the profile-server package.
packages/fxa-profile-server/lib/server/web.js	Replaces OAuth /verify call with fetch in the auth scheme.
packages/fxa-profile-server/lib/routes/_core_profile.js	Replaces auth-server profile lookup with fetch + timeout via AbortSignal.timeout.
packages/fxa-profile-server/lib/img-workers.js	Replaces worker upload/delete HTTP calls with streaming fetch (including duplex: 'half').
packages/fxa-profile-server/lib/request.js	Deletes the request wrapper and agent/socket tuning.
packages/fxa-profile-server/test/lib/mock.js	Replaces nock request interception with a global.fetch stub + outstanding-call assertions and worker injection.
packages/fxa-profile-server/test/lib/inject.js	Deletes the old through-based inject helper used by nock mocks.
packages/fxa-profile-server/test/load/avatar/avatar.js	Updates avatar load harness to use native fetch for upload/download/delete.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.