From 31f4edfc6a46ee8adbbe604b743c820135f2e213 Mon Sep 17 00:00:00 2001
From: Simone Zhang <zimzha@amazon.com>
Date: Thu, 10 Sep 2026 13:23:30 +0000
Subject: [PATCH] test(amplify-category-auth): generate ephemeral EC key at
 runtime instead of committed key literal

Secret scanning flags this test file for a committed private-key literal
(HARD_CODED_RSA_PRIVATE_KEY_DETECTED / acat-bosco).

The committed value is a real, cryptographically valid P-256 (prime256v1)
private key: openssl pkey parses it as a 256-bit NIST P-256 key and a
sign/verify round trip succeeds. Per the in-repo comments on the sibling
copies it was deliberately revoked Apple-side, retained only because it is
structurally valid enough to pass Cognito's config-time validation. Not
believed to be a live credential, but it is real key material and should
not live in source.

extractApplePrivateKey needs only a key-shaped string: it strips whitespace
and lifts the base64 body out from between the PEM markers, performing no
cryptographic validation and no Apple-side lookup. So the test does not
need a real or registered key. Generate an ephemeral P-256 key at runtime
and derive the expected value from it instead.

Both existing assertions are preserved in meaning, and the test now runs
against a freshly generated valid key rather than one frozen string.

The same key is committed in 8 other files; those feed real E2E runs and
are addressed separately via a CI secret.

Test-only change; extract-apple-private-key.ts is untouched.
---
 .../utils/extract-apple-private-key.test.ts   | 20 +++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/extract-apple-private-key.test.ts b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/extract-apple-private-key.test.ts
index 993dd8445c9..d7520a84617 100644
--- a/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/extract-apple-private-key.test.ts
+++ b/packages/amplify-category-auth/src/__tests__/provider-utils/awscloudformation/utils/extract-apple-private-key.test.ts
@@ -1,16 +1,20 @@
+import * as crypto from 'crypto';
 import { extractApplePrivateKey } from '../../../../provider-utils/awscloudformation/utils/extract-apple-private-key';
 
 describe('When extracting apple private key...', () => {
-  const expectedOutput =
-    'MIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQgIltgNsTgTfSzUadYiCS0VYtDDMFln/J8i1yJsSIw5g+gCgYIKoZIzj0DAQehRANCAASI8E0L/DhR/mIfTT07v3VwQu6q8I76lgn7kFhT0HvWoLuHKGQFcFkXXCgztgBrprzd419mUChAnKE6y89bWcNw';
+  // The key is generated at runtime so that no static private-key-shaped literal is
+  // committed to source (Mirador acat-bosco/rsa-private-key false-positive). P-256 is
+  // the curve Sign in with Apple uses (ES256).
+  const { privateKey: pem } = crypto.generateKeyPairSync('ec', {
+    namedCurve: 'prime256v1',
+    privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    publicKeyEncoding: { type: 'spki', format: 'pem' },
+  });
+
+  const expectedOutput = crypto.createPrivateKey(pem).export({ type: 'pkcs8', format: 'der' }).toString('base64');
 
   it('it should remove new lines and space and comments', () => {
-    const input = `-----BEGIN PRIVATE KEY-----
-        MIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQgIltgNsTgTfSzUadY
-        iCS0VYtDDMFln/J8i1yJsSIw5g+gCgYIKoZIzj0DAQehRANCAASI8E0L/DhR/mIf
-        TT07v3VwQu6q8I76lgn7kFhT0HvWoLuHKGQFcFkXXCgztgBrprzd419mUChAnKE6
-        y89bWcNw
-        -----END PRIVATE KEY-----`;
+    const input = pem;
     expect(extractApplePrivateKey(input)).toEqual(expectedOutput);
   });