chore: remove hardcoded private key

Author: pranav-okta

internal/m2mauth/m2mauth_test.go

@@ -17,6 +17,10 @@
 package m2mauth
 
 import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
 	"net/http"
 	"os"
 	"regexp"
@@ -27,6 +31,26 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// generateTestPrivateKey creates a 2048-bit RSA private key in PKCS8 PEM format for testing
+func generateTestPrivateKey() (string, error) {
+	privateKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return "", err
+	}
+
+	pkcs8Bytes, err := x509.MarshalPKCS8PrivateKey(privateKey)
+	if err != nil {
+		return "", err
+	}
+
+	pemBlock := &pem.Block{
+		Type:  "PRIVATE KEY",
+		Bytes: pkcs8Bytes,
+	}
+
+	return string(pem.EncodeToMemory(pemBlock)), nil
+}
+
 func TestMain(m *testing.M) {
 	var reset func()
 	reset = testutils.OsSetEnvIfBlank("OKTA_AWSCLI_ORG_DOMAIN", testutils.TestDomainName)
@@ -42,38 +66,12 @@ func TestMain(m *testing.M) {
 	reset = testutils.OsSetEnvIfBlank("OKTA_AWSCLI_KEY_ID", "kid-rock")
 	defer reset()
 
-	// NOTE: Okta Security this is just some random PK to unit test the client
-	// assertion generator in this app. PK was created with
-	// `openssl genrsa 2048 | openssl pkcs8 -topk8 -nocrypt`
-	reset = testutils.OsSetEnvIfBlank("OKTA_AWSCLI_PRIVATE_KEY", `
------BEGIN PRIVATE KEY-----
-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDb6SvsSfrP69gO
-yDpdXsZsT3ydS/ggCYFV8NhbHx6VtJeoLuQp+TCJ0pc4sC0ZvnBk5r6oAubLLDgK
-zqDsf8rIzg91mZPH2KfQs0bM02q+2naLkHYIVXjCFMh3ibXGWuNH/cItm9CLHJz0
-11K4LmsXUJdre4suSGDmUKOYgJqpcYHaWeEGNWcnMb7UGC+lcaXpwnkbp5ziBP6P
-PC/OH9S/HVDpiuJioex/zLLeCF/jnjHnbIa5EY1I5eWDttDgCxBRe+0p8XOtI6KJ
-wIUkhank99DoVp+KIcCxFW6WfQCac9/oT5I8I+j0lOtBAfQo+d2uVQd2xX80vsdM
-D2zvgyUHAgMBAAECggEAP4iQDgYZljR3CV5DrnIRNX2JbRBjsS3N1fxtJXZKKcow
-/n/9nzrFESxsUA5mGUfxxNT9RCECeLRfxI+J4onRFk6iHMGv9k7bvOnujIKQFm+b
-TBsCXsoCx1+lwxNgFtxvSX9AuFiJ2Yb8uafz2A5hFi1McdsRjN+QTzoA6bBN/qGp
-PO5PiVnfY9B9C/XAy2fWJ8JF0xZ8yBpJo9RNet241Ee0tiWwuHNpwntMT7C+K8f5
-cv5ccE+mA81ZwOrhbaIRct3HaFhV8l1j5usbvmZXlzHgOXzDfdLx/scADBbDwjmo
-djxrUBvLX1gwY6xRKXwgOv4ReZZcYV6Fvk5tTmgE8QKBgQD38fwyXZn24f4gb4X3
-WXf5WUuVlQx5cMMP5WQUgSPeUKuau2g0OR9ypy3KIG4qZj0sKFEP/aD8tbKfcDEg
-I+dK87nfUvvU3I+3TCgy16D8Ir7mmZimcUJ380d62I7YZSWTTRTjvrTb5S4MakoO
-s++N8sty/XM3whZe1Ls0XAraRQKBgQDjDgpjg/J5d/W1pG6Ru9YsvtyK64wGLP2o
-DpnQFUNNO+WR+VGBDitKvdzSsEinfSI3Reklydn+jzTt5BVNUvughfqX/fTb+QN1
-7meHr8FPEPlLgKyLkmq9E6yZWuvOeMgjV7/P4Pwh66+rU7GVm14P7VEA1UOYmjvu
-LJWjnw182wKBgQDOjGyefHEdRIhR9vWv531VYDjiBEdfBzvICz1DA42gzq0V+lbF
-Ymy7M1+myTtc4MzG81MMMiohOy/xOCIEd0RfoQfPba7SVWb3uF6odA7s2/kR2xRa
-W3GWwThjsvHUfPY/bnAfhSffI10oBIdrFiRSqNcpFNAdu/asyySkaqSzzQKBgFhS
-PN5LFEYF0NFwfgY4b+6F69oqGBTK6Xy2+UQFEWH4u6tVtUujTFnNkxlts0VbmrSv
-gCrP4vlvkWI8R8EFV5Ywp7L5+YabzanRK/qO9n4gFyk0i2nbcaPNBGW/BV0ShJ+i
-4Z0mYk17laDqdHjCsAs4ADt3ucyhqlBSjX7RPvjjAoGAHoR+FJglKaY2U82VV5pK
-sa8YdiJHAaJyd3olYNzq2QuxQOWN4d+BitVWPmM+IQkaBigESxTIam+n5/qHiVyV
-XNY+9eUj7XwoMVz03BISN8TEmDlRyyQYHffRUF69wDLlSY1PG4k/9uED50YsQZAm
-oO62j9Objbi/ntr/BSQIpYE=
------END PRIVATE KEY-----`)
+	// Generate a fresh RSA key for testing JWT signing
+	privateKey, err := generateTestPrivateKey()
+	if err != nil {
+		panic("failed to generate test private key: " + err.Error())
+	}
+	reset = testutils.OsSetEnvIfBlank("OKTA_AWSCLI_PRIVATE_KEY", privateKey)
 	defer reset()
 
 	os.Exit(m.Run())