fix(amplify-category-auth): reject empty apple private key payloads

[mehuljariwala]

Description of changes

Sign in with Apple setup currently accepts a private key containing only spaces or tabs between its PEM markers. The later extraction step removes that whitespace, leaving marker text to be submitted as the key. Require non-whitespace content between the markers at the prompt validation boundary, while preserving populated single-line keys with surrounding or embedded spaces/tabs.

The change is limited to input-shape validation. It does not attempt cryptographic validation or change key extraction, public APIs, or AWS resources. Regression tests use the actual Cognito input definition and cover empty/whitespace-only payloads and populated controls.

Issue #, if available

Fixes #13065.

Description of how you validated changes

• yarn install --immutable completed with existing dependency/TypeScript patch warnings; lockfile unchanged.
• yarn lerna run build --scope @aws-amplify/amplify-category-auth --include-dependencies --concurrency 2 passed for the auth package and its dependency graph.
• From packages/amplify-category-auth, yarn test --runInBand passed: 31 suites, 139 tests, 45 snapshots. The new cases were first run against the original code, where five whitespace-only cases failed.
• Scoped ESLint and Prettier checks passed; ESLint emits existing schema-reference warnings.
• git diff --check passed.
• Repository pre-commit and commit-message hooks passed, including git-secrets scanning. No hooks were bypassed.

Verified on macOS arm64 with Node 26.8.1 and repository-pinned Yarn 3.5.0. Validation used synthetic key content, never live credentials. No AWS resources were provisioned; a complete amplify add auth deployment and cloud E2E suite were not run. The existing package hint still describes the required PEM shape; no corresponding auth documentation file exists in the repository's docs/ tree.

AI assistance: OpenAI Codex assisted with source tracing, implementation, tests, and submission. No independent human review is claimed; the commit author is explicitly marked (AI) as required by AGENTS.md.

Checklist

• PR description included
• Auth package yarn test passes
• Regression tests added
• No new AWS SDK calls or CloudFormation actions
• Maintainer review and applicable repository labels

[mehuljariwala]

Update (2026-10-05): a query by the exact head commit c0c005e found three upstream GitHub Actions runs awaiting maintainer approval. The earlier branch-filtered lookup missed these runs, so the CI-status statement in the original version of this comment was incomplete.

Could a maintainer review whether these workflows can be approved to run when appropriate?

• Build and Test on Mac: https://github.com/aws-amplify/amplify-cli/actions/runs/37117264051
• CodeQL: https://github.com/aws-amplify/amplify-cli/actions/runs/37117264049
• CodeQL Tests: https://github.com/aws-amplify/amplify-cli/actions/runs/37117264010

If the separate AmplifyCLI-PR-Testing CodeBuild path is also required, please advise. Local validation is recorded in the PR description; it is not being treated as upstream CI success.

AI assistance disclosure: this is an AI-assisted maintenance follow-up.