From 773c1596e54cacc52186afae7ea2040e52a4e5ef Mon Sep 17 00:00:00 2001
From: Lisbet Alvarez <107949262+lisbet-alvarez@users.noreply.github.com>
Date: Thu, 8 Jan 2026 14:45:16 -0800
Subject: [PATCH] =?UTF-8?q?fix:=20=F0=9F=90=9B=20Update=20worker=5Ffilter?=
 =?UTF-8?q?=20label=20for=20AWS=20DHC=20w/=20static=20creds=20(#3114)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: 🐛 Update worker_filter label for AWS DHC w/ static creds

* test: 💍 add test case

* test: 💍 fix serializer tests
---
 .../addon/generated/models/host-catalog.js    |  2 +-
 .../unit/serializers/host-catalog-test.js     |  4 ++-
 .../components/form/host-catalog/aws/index.js |  7 +++--
 .../form/host-catalog/azure/index.hbs         | 28 +++++++++++++++++++
 .../acceptance/host-catalogs/create-test.js   | 26 ++++++++++++++++-
 5 files changed, 62 insertions(+), 5 deletions(-)

diff --git a/addons/api/addon/generated/models/host-catalog.js b/addons/api/addon/generated/models/host-catalog.js
index 007d8587c..51fea24b9 100644
--- a/addons/api/addon/generated/models/host-catalog.js
+++ b/addons/api/addon/generated/models/host-catalog.js
@@ -72,7 +72,7 @@ export default class GeneratedHostCatalogModel extends BaseModel {
   @attr('string', {
     for: {
       type: 'plugin',
-      name: ['aws', 'gcp'],
+      name: ['aws', 'azure', 'gcp'],
     },
     description:
       'An expression used to filter the workers that have network access to a service that is hosting the external object store.',
diff --git a/addons/api/tests/unit/serializers/host-catalog-test.js b/addons/api/tests/unit/serializers/host-catalog-test.js
index e1aa519f0..e89220827 100644
--- a/addons/api/tests/unit/serializers/host-catalog-test.js
+++ b/addons/api/tests/unit/serializers/host-catalog-test.js
@@ -224,7 +224,6 @@ module('Unit | Serializer | host catalog', function (hooks) {
       region: 'spain',
       access_key_id: 'foobars',
       secret_access_key: 'testing',
-      worker_filter: 'workerfilter',
       // these are Azure fields and should be excluded
       tenant_id: 'a1b2c3',
       client_id: 'a1b2c3',
@@ -233,6 +232,7 @@ module('Unit | Serializer | host catalog', function (hooks) {
       secret_value: 'a1b2c3',
       project_id: 'project',
       zone: 'zone',
+      worker_filter: 'workerfilter',
     });
     const expectedResult = {
       name: 'Azure',
@@ -248,6 +248,7 @@ module('Unit | Serializer | host catalog', function (hooks) {
         secret_id: 'a1b2c3',
         secret_value: 'a1b2c3',
       },
+      worker_filter: 'workerfilter',
     };
     assert.deepEqual(record.serialize(), expectedResult);
   });
@@ -313,6 +314,7 @@ module('Unit | Serializer | host catalog', function (hooks) {
       type: 'plugin',
       name: 'azure',
       description: 'test description',
+      worker_filter: null,
       attributes: {
         disable_credential_rotation: false,
         tenant_id: 'a1b2c3',
diff --git a/ui/admin/app/components/form/host-catalog/aws/index.js b/ui/admin/app/components/form/host-catalog/aws/index.js
index e3c37db67..afb3cf1a0 100644
--- a/ui/admin/app/components/form/host-catalog/aws/index.js
+++ b/ui/admin/app/components/form/host-catalog/aws/index.js
@@ -34,9 +34,12 @@ export default class FormHostCatalogAwsComponent extends Component {
   }
 
   /**
-   * Returns true if current edition is HCP.
+   * Returns true if current edition is HCP and dynamic credential type is specified.
    */
   get isWorkerFilterRequired() {
-    return this.featureEdition.edition === 'hcp';
+    return (
+      this.featureEdition.edition === 'hcp' &&
+      this.args.model.credentialType === TYPE_CREDENTIAL_DYNAMIC
+    );
   }
 }
diff --git a/ui/admin/app/components/form/host-catalog/azure/index.hbs b/ui/admin/app/components/form/host-catalog/azure/index.hbs
index fc5033005..92261a377 100644
--- a/ui/admin/app/components/form/host-catalog/azure/index.hbs
+++ b/ui/admin/app/components/form/host-catalog/azure/index.hbs
@@ -176,6 +176,34 @@
     </F.HelperText>
   </Hds::Form::TextInput::Field>
 
+  {{#if (feature-flag 'worker-filter')}}
+    <Hds::Form::Textarea::Field
+      name='worker_filter'
+      @value={{@model.worker_filter}}
+      @isOptional={{true}}
+      @isInvalid={{@model.errors.worker_filter}}
+      disabled={{form.disabled}}
+      as |F|
+    >
+      <F.Label>{{t 'form.worker_filter.label'}}</F.Label>
+      <F.HelperText>
+        {{t 'resources.host-catalog.form.worker_filter.help'}}
+        <Hds::Link::Inline @href={{doc-url 'worker.create-tags'}}>
+          {{t 'actions.learn-more'}}
+        </Hds::Link::Inline>
+      </F.HelperText>
+      {{#if @model.errors.worker_filter}}
+        <F.Error as |E|>
+          {{#each @model.errors.worker_filter as |error|}}
+            <E.Message>
+              {{error.message}}
+            </E.Message>
+          {{/each}}
+        </F.Error>
+      {{/if}}
+    </Hds::Form::Textarea::Field>
+  {{/if}}
+
   <Hds::Form::Checkbox::Field
     name='disable_credential_rotation'
     checked={{@model.disable_credential_rotation}}
diff --git a/ui/admin/tests/acceptance/host-catalogs/create-test.js b/ui/admin/tests/acceptance/host-catalogs/create-test.js
index 9de37e301..c719d306f 100644
--- a/ui/admin/tests/acceptance/host-catalogs/create-test.js
+++ b/ui/admin/tests/acceptance/host-catalogs/create-test.js
@@ -368,7 +368,7 @@ module('Acceptance | host-catalogs | create', function (hooks) {
       .includesText('Optional');
   });
 
-  test('users should see required worker filter field in hcp edition when AWS host catalog is selected', async function (assert) {
+  test('users should see required worker filter field in hcp edition when AWS host catalog is selected and using assume role', async function (assert) {
     setRunOptions({
       rules: {
         'color-contrast': {
@@ -382,12 +382,36 @@ module('Acceptance | host-catalogs | create', function (hooks) {
     featureEdition.setEdition('hcp');
     await visit(urls.newAWSDynamicHostCatalog);
 
+    await click(selectors.FIELD_DYNAMIC_CREDENTIAL);
+
     assert.dom(selectors.FIELD_WORKER_FILTER).isVisible();
     assert
       .dom(selectors.FIELD_AWS_WORKER_FILTER_LABEL)
       .includesText('Required');
   });
 
+  test('users should see optional worker filter field in hcp edition when AWS host catalog is selected and using access key', async function (assert) {
+    setRunOptions({
+      rules: {
+        'color-contrast': {
+          // [ember-a11y-ignore]: axe rule "color-contrast" automatically ignored on 2025-08-01
+          enabled: false,
+        },
+      },
+    });
+
+    featuresService.enable('worker-filter');
+    featureEdition.setEdition('hcp');
+    await visit(urls.newAWSDynamicHostCatalog);
+
+    await click(selectors.FIELD_STATIC_CREDENTIAL);
+
+    assert.dom(selectors.FIELD_WORKER_FILTER).isVisible();
+    assert
+      .dom(selectors.FIELD_AWS_WORKER_FILTER_LABEL)
+      .includesText('Optional');
+  });
+
   test('users should see worker filter field in enterprise edition when GCP host catalog is selected', async function (assert) {
     setRunOptions({
       rules: {