[varunj-msft]

Description

Part 9 of saving Registry entries across restarts. Stacked on part 8 (#4026); part 10 (#4028) builds on it, and so do the side branches part 16 (#4068) and part 19 (#4070). This PR's own changes: varunj-msft/PyRIT@varunj-msft/13178-Save-Targets...varunj-msft/13178-Save-From-Registry

Design: 1. The contract, 4.8 Names. Where every part fits: PR map.

This is one of the changes for saving Registry entries across restarts. It builds on #4026, which saves targets created through the API. Until the earlier PRs merge, the diff here also shows their changes.

Problem. The New Target dialog in Registry > Targets still makes targets that are gone after the backend restarts. It sends no name, so the backend makes one up (compat_<hex>), and the Targets table doesn't say which targets will come back.

Change.

• The dialog has a Registry Name field. Until the user edits it, it suggests a name from the type and model that no listed target has (openai_chat_gpt_4o). The model tells saved targets apart and keeps the suggestion off names the startup scripts register, such as openai_chat. The field checks the same rule the backend uses for saved names. A name the Targets list already has, or one the backend says is taken (409), shows on the field and holds Save until the name changes.
• The dialog saves by default (persist: true). When a target can't be saved, the button reads Create as Temporary and a warning says why, and that a Temporary target is gone after the backend restarts or is reinitialized. The dialog says so before submitting. The backend's type list tells it when the type can't be saved or the chosen sign-in can't be saved (an API key, for now). For the values entered, such as a typed credential or a round robin with a Temporary member, it asks the new POST /api/targets/saveability, which runs create's checks and the library's save checks without building or saving anything, so the warning and the save share one policy. The check waits until typing pauses, and only its answer for the current values counts. If Save is pressed first, the backend's refusal turns the button into Create as Temporary for those exact values, and changing any of them goes back to Save Target. No other error offers Temporary.
• A new target starts with Microsoft Entra ID, or No key, when a saved target of its type can use it, so the usual case saves. This also applies when the type's details arrive after the type was picked. Picking another type resets the choice and clears a typed key. For an OpenAI endpoint that isn't on Azure, the Entra ID error now says to choose No key for a server that needs no key, such as a local one. It's the Endpoint URL field's own error, shown once the field is left, not while the address is typed, so it stays next to the address on a narrow screen.
• GET /api/targets/types adds saveable_auth_modes and not_saveable_reason to each type. They come from the checks a save runs (the class check, and the server-setting check for each auth mode with those settings turned off), so the dialog keeps no copy of the credential rules.
• A refused save gets a typed 400 ("type": "/errors/not-saveable"), so the dialog doesn't read messages. When the only problem is an endpoint that isn't a full http(s) or ws(s) address, the request gets a plain 400 instead, since a Temporary target with that address wouldn't work either.
• The warning uses role="status" so screen readers read it out, and the Entra ID error is the field's validation message. Fluent's message bars only announce through an announcer the app doesn't render.
• The Targets table labels each target Saved, From configuration or Temporary, and the round robin member list marks Temporary members.
• The GUI doc says where saved targets are kept, how to remove one for now, and what happens if a startup script later registers the same name.

What stays the same. API callers that don't send persist get Temporary targets as before, and may still leave out the name. Permission checks still come first, and restore is unchanged.

Not covered.

• Showing who saved a target, and a Mine / All filter. That's FEAT: Show who saved each target and list only your own (part 10) #4028 (part 10).
• Picking a server credential, and keeping typed keys in a key vault. Until then a target that uses an API key is Temporary.
• Saving converters, scorers and techniques, and deleting saved entries. Those come in parts 12 to 14 and part 20.

Tests and Documentation

• tests/unit/registry/test_registry_recipe_rules.py: check_saveable_class lists the auth modes a saved target of each type can use, refuses a class that can never be saved, and agrees with the check a save runs for every registered target type and auth mode.
• tests/unit/backend/test_target_service.py: the type list says which auth modes a saved target can use and why a type can't be saved; saving a type that can't be saved is refused; an endpoint that isn't a full web address is an error to fix, not a refusal.
• tests/unit/backend/test_api_routes.py: a refused save is a 400 with "type": "/errors/not-saveable"; other bad requests stay untyped; POST /api/targets/saveability answers with the save checks' reason, and a request creating would refuse gets the same 400 or 403.
• tests/unit/backend/test_target_service.py (TestCheckSaveability): the check answers as saving would for a Temporary round-robin member, a typed key and Entra ID, without building anything, and refuses a request creating would refuse.
• CreateTargetDialog.test.tsx (new "CreateTargetDialog saving" block): saving by default with Entra ID or No key, also when the type details arrive late; the suggested name from the type and model until it's edited; names already listed or taken (409) held on the field; when Create as Temporary is offered and why (an API key or a type that can't be saved from the type list; a typed credential or a round robin with a Temporary member from the backend's check, and not from the list's labels), and only after a typed refusal for those exact values; an answer for values that have since changed is ignored; no Temporary offer on 409, 422, 403 or other errors; the warning as a live region; starting over after the dialog closes; the Entra ID error as the Endpoint URL field's description once the field is left.
• TargetTable.test.tsx: the Saved, From configuration and Temporary labels. registryName.test.ts and errors.test.ts: the name suggestion and the typed refusal check.
• frontend/e2e/config.spec.ts (mock): saving through the dialog sends Entra ID and persist: true. frontend/e2e/registry.spec.ts (seeded, real backend): a target saved from the dialog is still Saved after a reload.
• Each of the 64 ways I tried to break the dialog, the labels or the saveability check fails at least one of these tests (from the earlier round).
• python -m pytest -n 8 tests/unit/converter tests/unit/prompt_target tests/unit/registry tests/unit/backend: 11,925 passed, 9 skipped, 4 xfailed
• cd frontend && npx jest CreateTargetDialog.test.tsx api.test.ts: 227 passed
• cd frontend && npx playwright test --project=mock e2e/config.spec.ts: 18 passed
• npx tsc --noEmit, npx eslint on the changed files, and pre-commit (ruff, ty, docs checks): passed
• Run against a real backend process (this round): POST /api/targets/saveability says an Entra ID target and a round robin over a saved target can be saved, gives the credential reason for a typed key without echoing it, and refuses a missing model with the same 400 as create.
• Earlier, run against a real backend in a real browser, with the server using its own Entra ID credential: saved an Entra ID chat target on Azure OpenAI and a local No key target from the dialog. A target with an API key, a round robin using a Temporary target, and a target created through the API without persist came out Temporary, with the reason shown. After a backend restart the saved targets came back as Saved, the Temporary ones were gone, and a message sent through the restored Entra ID target got an answer. No key was in any saved file.
• doc/gui/0_gui.md (Registry): saving a target, where saved targets are kept, how to remove one for now, and what happens when a startup script registers the same name. pyrit/backend/README.md: the new type fields, the typed 400, and the saveability check.

No JupyText changes.

[Richard Lundeen (richlundeen)]

Found six issues to address before approval. Details are on the affected lines.