From 17c7b76af19589d4c2d7c10229f430fe812b26d5 Mon Sep 17 00:00:00 2001
From: Tofik Hasanov <annexcies@gmail.com>
Date: Fri, 1 May 2026 10:00:27 -0400
Subject: [PATCH] fix(cloud-tests): scope to aws/gcp/azure and remove hardcoded
 copy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cloud Tests previously surfaced any integration with category 'Cloud',
which incorrectly included Vercel. Filter the providers and findings
queries by an explicit slug allowlist (aws, gcp, azure) so the page
reflects what users actually expect.

Also remove two hardcoded "exclusively for Cloud Security Tests"
strings on the Integrations page and Connect dialog — they were gated
on the same broken category check and showed up for Vercel too.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../cloud-security-query.service.ts           | 20 +++++++++----------
 .../components/PlatformIntegrations.tsx       |  6 ------
 .../integrations/ConnectIntegrationDialog.tsx |  5 -----
 3 files changed, 9 insertions(+), 22 deletions(-)

diff --git a/apps/api/src/cloud-security/cloud-security-query.service.ts b/apps/api/src/cloud-security/cloud-security-query.service.ts
index ca8cb85164..9dea252410 100644
--- a/apps/api/src/cloud-security/cloud-security-query.service.ts
+++ b/apps/api/src/cloud-security/cloud-security-query.service.ts
@@ -2,7 +2,7 @@ import { Injectable } from '@nestjs/common';
 import { db } from '@db';
 import { getManifest } from '@trycompai/integration-platform';
 
-const CLOUD_PROVIDER_CATEGORY = 'Cloud';
+const CLOUD_PROVIDER_SLUGS = ['aws', 'gcp', 'azure'] as const;
 
 /** Scan window for filtering legacy results to latest scan only */
 const SCAN_WINDOW_MS = 10 * 60 * 1000; // 10 minutes
@@ -88,7 +88,7 @@ export class CloudSecurityQueryService {
       where: {
         organizationId,
         status: 'active',
-        provider: { category: CLOUD_PROVIDER_CATEGORY },
+        provider: { slug: { in: [...CLOUD_PROVIDER_SLUGS] } },
       },
       include: { provider: true },
     });
@@ -98,10 +98,9 @@ export class CloudSecurityQueryService {
       where: { organizationId },
     });
 
-    const activeLegacy = legacyIntegrations.filter((i) => {
-      const manifest = getManifest(i.integrationId);
-      return manifest?.category === CLOUD_PROVIDER_CATEGORY;
-    });
+    const activeLegacy = legacyIntegrations.filter((i) =>
+      (CLOUD_PROVIDER_SLUGS as readonly string[]).includes(i.integrationId),
+    );
 
     // Map new connections
     const newProviders: CloudProvider[] = newConnections.map((conn) => {
@@ -207,7 +206,7 @@ export class CloudSecurityQueryService {
       where: {
         organizationId,
         status: 'active',
-        provider: { category: CLOUD_PROVIDER_CATEGORY },
+        provider: { slug: { in: [...CLOUD_PROVIDER_SLUGS] } },
       },
       include: { provider: true },
     });
@@ -303,10 +302,9 @@ export class CloudSecurityQueryService {
       where: { organizationId },
     });
 
-    const activeLegacy = legacyIntegrations.filter((i) => {
-      const manifest = getManifest(i.integrationId);
-      return manifest?.category === CLOUD_PROVIDER_CATEGORY;
-    });
+    const activeLegacy = legacyIntegrations.filter((i) =>
+      (CLOUD_PROVIDER_SLUGS as readonly string[]).includes(i.integrationId),
+    );
 
     const legacyIds = activeLegacy.map((i) => i.id);
     if (legacyIds.length === 0) return [];
diff --git a/apps/app/src/app/(app)/[orgId]/integrations/components/PlatformIntegrations.tsx b/apps/app/src/app/(app)/[orgId]/integrations/components/PlatformIntegrations.tsx
index d099fc24af..ecee3f8027 100644
--- a/apps/app/src/app/(app)/[orgId]/integrations/components/PlatformIntegrations.tsx
+++ b/apps/app/src/app/(app)/[orgId]/integrations/components/PlatformIntegrations.tsx
@@ -659,12 +659,6 @@ export function PlatformIntegrations({ className, taskTemplates }: PlatformInteg
                           {provider.description}
                         </CardDescription>
 
-                        {provider.category === 'Cloud' && (
-                          <p className="text-xs text-muted-foreground italic">
-                            This integration is used exclusively for Cloud Security Tests.
-                          </p>
-                        )}
-
                         {/* Mapped tasks */}
                         {provider.mappedTasks && provider.mappedTasks.length > 0 && (
                           <div className="flex flex-wrap gap-1.5">
diff --git a/apps/app/src/components/integrations/ConnectIntegrationDialog.tsx b/apps/app/src/components/integrations/ConnectIntegrationDialog.tsx
index 5a493f955e..4a5befdb36 100644
--- a/apps/app/src/components/integrations/ConnectIntegrationDialog.tsx
+++ b/apps/app/src/components/integrations/ConnectIntegrationDialog.tsx
@@ -555,11 +555,6 @@ export function ConnectIntegrationDialog({
                 <p className="whitespace-pre-wrap text-xs break-words">{provider.setupInstructions}</p>
               </div>
             )}
-            {provider?.category === 'Cloud' && !provider?.setupScript && (
-              <div className="text-xs text-muted-foreground bg-muted/50 p-3 rounded-md">
-                This integration will only be used for Cloud Security Tests. Your credentials are encrypted and used exclusively to run read-only security scans.
-              </div>
-            )}
             {allFields
               .filter((field) => {
                 if (!provider?.setupScript) return true;