test: verify RDS index query template includes authFilter

Add a unit test that directly exercises RDSIndexVTLGenerator and asserts
the generated VTL contains ctx.stash.authFilter forwarding to the SQL
Lambda payload. This ensures the authorization bypass cannot regress.

Author: Simone319

packages/amplify-graphql-index-transformer/src/__tests__/amplify-graphql-index-transformer.test.ts

@@ -1504,6 +1504,30 @@ describe('Index query resolver creation', () => {
   };
 });
 
+describe('RDS index query template includes authFilter', () => {
+  it('generates VTL that forwards ctx.stash.authFilter to the SQL Lambda payload', () => {
+    const { RDSIndexVTLGenerator } = require('../resolvers/generators/rds-vtl-generator');
+    const generator = new RDSIndexVTLGenerator();
+    const mockCtx: any = {
+      resourceHelper: {
+        getModelNameMapping: jest.fn().mockReturnValue('customer'),
+      },
+      output: {
+        getObject: jest.fn().mockReturnValue(undefined),
+        getTypeDefinitionsOfKind: jest.fn().mockReturnValue([]),
+      },
+    };
+    const vtl = generator.generateIndexQueryRequestTemplate(
+      { name: 'byRep', queryField: 'listByRep' } as any,
+      mockCtx,
+      'Customer',
+      'listByRep',
+    );
+    expect(vtl).toContain('$ctx.stash.authFilter');
+    expect(vtl).toContain('lambdaInput.args.metadata.authFilter');
+  });
+});
+
 describe('auth', () => {
   const API_KEY = 'API Key Authorization';
   const IAM_AUTH_TYPE = 'IAM Authorization';