From e426c292076a3618da4613c5cc4564ef6407df5f Mon Sep 17 00:00:00 2001
From: "Andoni A." <14891798+andoniaf@users.noreply.github.com>
Date: Wed, 14 Jan 2026 09:11:27 +0100
Subject: [PATCH] fix(attack-paths): remove duplicate path_target causing
 disconnected nodes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Removed the extra path_target re-match that was causing role nodes to appear
disconnected in the visualization. The target_role is now only connected via
virtual relationships (PASSES_ROLE → target_role → GRANTS_ACCESS), which
provides a cleaner and more accurate attack path visualization.
---
 .../api/attack_paths/query_definitions.py     | 35 ++++++++-----------
 1 file changed, 15 insertions(+), 20 deletions(-)

diff --git a/api/src/backend/api/attack_paths/query_definitions.py b/api/src/backend/api/attack_paths/query_definitions.py
index 5be8ff68f3..eae717ee95 100644
--- a/api/src/backend/api/attack_paths/query_definitions.py
+++ b/api/src/backend/api/attack_paths/query_definitions.py
@@ -670,12 +670,11 @@ _QUERY_DEFINITIONS: dict[str, list[AttackPathsQueryDefinition]] = {
                 }, escalation_outcome)
                 YIELD rel AS grants_rel
 
-                // Re-match paths for visualization
+                // Re-match path for visualization (only principal path, target_role is connected via virtual rels)
                 MATCH path_principal = (aws)--(principal)
-                MATCH path_target = (aws)--(target_role)
 
-                RETURN path_principal, path_target,
-                       lambda_node, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
+                RETURN path_principal,
+                       lambda_node, target_role, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
             """,
             parameters=[],
         ),
@@ -816,12 +815,11 @@ _QUERY_DEFINITIONS: dict[str, list[AttackPathsQueryDefinition]] = {
                 }, escalation_outcome)
                 YIELD rel AS grants_rel
 
-                // Re-match paths for visualization
+                // Re-match path for visualization (only principal path, target_role is connected via virtual rels)
                 MATCH path_principal = (aws)--(principal)
-                MATCH path_target = (aws)--(target_role)
 
-                RETURN path_principal, path_target,
-                       ecs_task, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
+                RETURN path_principal,
+                       ecs_task, target_role, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
             """,
             parameters=[],
         ),
@@ -967,12 +965,11 @@ _QUERY_DEFINITIONS: dict[str, list[AttackPathsQueryDefinition]] = {
                 }, escalation_outcome)
                 YIELD rel AS grants_rel
 
-                // Re-match paths for visualization
+                // Re-match path for visualization (only principal path, target_role is connected via virtual rels)
                 MATCH path_principal = (aws)--(principal)
-                MATCH path_target = (aws)--(target_role)
 
-                RETURN path_principal, path_target,
-                       glue_endpoint, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
+                RETURN path_principal,
+                       glue_endpoint, target_role, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
             """,
             parameters=[],
         ),
@@ -1061,12 +1058,11 @@ _QUERY_DEFINITIONS: dict[str, list[AttackPathsQueryDefinition]] = {
                 }, escalation_outcome)
                 YIELD rel AS grants_rel
 
-                // Re-match paths for visualization
+                // Re-match path for visualization (only principal path, target_role is connected via virtual rels)
                 MATCH path_principal = (aws)--(principal)
-                MATCH path_target = (aws)--(target_role)
 
-                RETURN path_principal, path_target,
-                       bedrock_agent, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
+                RETURN path_principal,
+                       bedrock_agent, target_role, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
             """,
             parameters=[],
         ),
@@ -1147,12 +1143,11 @@ _QUERY_DEFINITIONS: dict[str, list[AttackPathsQueryDefinition]] = {
                 }, escalation_outcome)
                 YIELD rel AS grants_rel
 
-                // Re-match paths for visualization
+                // Re-match path for visualization (only principal path, target_role is connected via virtual rels)
                 MATCH path_principal = (aws)--(principal)
-                MATCH path_target = (aws)--(target_role)
 
-                RETURN path_principal, path_target,
-                       cfn_stack, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
+                RETURN path_principal,
+                       cfn_stack, target_role, escalation_outcome, create_rel, pass_rel, grants_rel, target_count
             """,
             parameters=[],
         ),