fix(app): make cloud reconnect cutoff exclusive

Author: tofikwest

apps/app/src/app/(app)/[orgId]/cloud-tests/components/ProviderTabs.tsx

@@ -307,7 +307,7 @@ export function ProviderTabs({
                               <div>
                                 <p className="text-sm font-medium">Reconnect this account</p>
                                 <p className="text-xs text-muted-foreground mt-0.5">
-                                  This connection was created on or before {CLOUD_RECONNECT_CUTOFF_LABEL}. Reconnect it to keep scans and remediation fully reliable.
+                                  This connection was created before {CLOUD_RECONNECT_CUTOFF_LABEL}. Reconnect it to keep scans and remediation fully reliable.
                                 </p>
                               </div>
                               {canAddConnection !== false && (

apps/app/src/app/(app)/[orgId]/cloud-tests/components/TestsLayout.tsx

@@ -288,7 +288,7 @@ export function TestsLayout({ initialFindings, initialProviders, orgId }: TestsL
             Reconnect required for {reconnectRequiredCount} cloud connection{reconnectRequiredCount === 1 ? '' : 's'}
           </p>
           <p className="text-xs text-muted-foreground mt-0.5">
-            Connections created on or before {CLOUD_RECONNECT_CUTOFF_LABEL} should be re-added to keep scans and remediation fully reliable.
+            Connections created before {CLOUD_RECONNECT_CUTOFF_LABEL} should be re-added to keep scans and remediation fully reliable.
           </p>
         </div>
       )}

apps/app/src/app/(app)/[orgId]/integrations/[slug]/components/ProviderDetailView.tsx

@@ -199,7 +199,7 @@ export function ProviderDetailView({ provider, initialConnections }: ProviderDet
             <div>
               <p className="text-sm font-medium">Reconnect this account</p>
               <p className="text-xs text-muted-foreground mt-0.5">
-                This connection was created on or before {CLOUD_RECONNECT_CUTOFF_LABEL}. Reconnect it to keep scans and remediation fully reliable.
+                This connection was created before {CLOUD_RECONNECT_CUTOFF_LABEL}. Reconnect it to keep scans and remediation fully reliable.
               </p>
             </div>
             <Button size="sm" variant="outline" onClick={() => void handleConnect()}>

apps/app/src/lib/cloud-reconnect-policy.test.ts

@@ -5,16 +5,26 @@ import {
 } from './cloud-reconnect-policy';
 
 describe('requiresCloudReconnect', () => {
-  it('returns true for cloud connections created on the cutoff date', () => {
+  it('returns true for cloud connections created before the cutoff date', () => {
     expect(
       requiresCloudReconnect({
         providerId: 'aws',
-        createdAt: CLOUD_RECONNECT_CUTOFF_ISO_UTC,
+        createdAt: '2026-04-12T23:59:59.999Z',
         status: 'active',
       }),
     ).toBe(true);
   });
 
+  it('returns false for cloud connections created exactly at the cutoff timestamp', () => {
+    expect(
+      requiresCloudReconnect({
+        providerId: 'aws',
+        createdAt: CLOUD_RECONNECT_CUTOFF_ISO_UTC,
+        status: 'active',
+      }),
+    ).toBe(false);
+  });
+
   it('returns false for cloud connections created after the cutoff date', () => {
     expect(
       requiresCloudReconnect({
@@ -45,4 +55,3 @@ describe('requiresCloudReconnect', () => {
     ).toBe(false);
   });
 });
-

apps/app/src/lib/cloud-reconnect-policy.ts

@@ -1,10 +1,10 @@
 const CLOUD_RECONNECT_PROVIDER_IDS = new Set(['aws', 'gcp', 'azure']);
 
 /**
- * Connections created on or before this UTC timestamp require re-connection.
+ * Connections created before this UTC timestamp require re-connection.
  * This rollout date is fixed intentionally so the behavior is stable over time.
  */
-export const CLOUD_RECONNECT_CUTOFF_ISO_UTC = '2026-04-13T23:59:59.999Z';
+export const CLOUD_RECONNECT_CUTOFF_ISO_UTC = '2026-04-13T00:00:00.000Z';
 export const CLOUD_RECONNECT_CUTOFF_LABEL = 'April 13, 2026';
 
 const CLOUD_RECONNECT_CUTOFF_MS = new Date(CLOUD_RECONNECT_CUTOFF_ISO_UTC).getTime();
@@ -29,6 +29,5 @@ export function requiresCloudReconnect(candidate: ReconnectCandidate): boolean {
   const createdAt = new Date(candidate.createdAt);
   if (Number.isNaN(createdAt.getTime())) return false;
 
-  return createdAt.getTime() <= CLOUD_RECONNECT_CUTOFF_MS;
+  return createdAt.getTime() < CLOUD_RECONNECT_CUTOFF_MS;
 }
-