FEAT: Delete saved registry entries (part 20)

.pyrit_conf_example

@@ -161,6 +161,21 @@ allow_custom_initializers: false
 # as scenario_presets_source. Defaults to ~/.pyrit/scenario_suites.
 # scenario_suites_source: https://account.blob.core.windows.net/container/scenario_suites
 
+# Optional storage for saved targets, converters, scorers, and techniques, so they
+# come back when the backend restarts. Each kind has its own folder under the source.
+# This supports the same local directory and Azure Blob sources as
+# scenario_presets_source. If any saved entry can't be restored, the backend stays
+# not ready and lists the failures in its runtime status. Fix or delete the listed
+# files, then apply the configuration or restart the backend. Defaults to
+# ~/.pyrit/registry_recipes.
+#
+# ⚠️  WARNING: The backend rebuilds every saved entry in this source as an
+# administrator, at startup and live reinitialization. Anyone who can write to this
+# source can make the backend run a model's repository code or use its identity.
+# Restrict write access to trusted administrators, and use a dedicated folder or
+# blob prefix.
+# registry_recipes_source: https://account.blob.core.windows.net/container/registry_recipes
+
 # Upload Folder for API-Created Targets
 # -------------------------------------
 # Folder that targets created through the REST API may upload local files from

doc/getting_started/pyrit_conf.md

@@ -194,6 +194,20 @@ Suites store ordered references to scenario presets and resolve each preset's cu
 
 A SAS query string may be included; otherwise, PyRIT uses `DefaultAzureCredential`. The default is `~/.pyrit/scenario_suites`. Local writes use the same hidden lock-file and atomic replacement behavior as scenario presets. Startup scans the configured source so malformed suite documents are reported immediately without preventing the backend from starting.
 
+### `registry_recipes_source`
+
+Stores saved targets, converters, scorers, and techniques in a local directory or Azure Blob container, so they come back when the backend restarts. Targets, converters, and scorers created through `POST /api/targets`, `POST /api/converters`, and `POST /api/scorers` with `"persist": true` are saved here. An Azure URI may include a blob-name prefix:
+
+```yaml
+registry_recipes_source: https://account.blob.core.windows.net/pyrit-storage/registry-recipes
+```
+
+Each kind has its own folder under the source (`targets/`, `converters/`, `scorers/`, `techniques/`), with one JSON file per saved entry named after the entry. A file holds the create request the entry was made with, and restore builds the entry through the API's create for its kind. A file never holds a credential: restore refuses a file that stores a value for a parameter its class marks as a credential, such as `api_key`. A saved target also can't use a key from this server: it signs in with Microsoft Entra ID (`"auth_mode": "identity"`), which uses this server's Azure identity for everyone using the app, or needs no key. Targets from the server's configuration that it uses, such as a round-robin's members, keep their own sign-in. So restore refuses a target file that would read an empty key from an environment variable or leave an address to this server's settings. The addresses each target type declares (such as `endpoint`, `container_url` for Blob storage, or an A2A agent card path) can't hold a user name, password, SAS token, fragment, path parameters (`;`, `&`, `=`), or a query other than `api-version`, and a path can't have a query at all. An address the server would otherwise fill in must be a full http(s) or ws(s) address. In identity mode, an OpenAI target file sets `"headers": "{}"` in its `params` so that the server's `OPENAI_ADDITIONAL_REQUEST_HEADERS` aren't added. The OpenAI SDK adds the headers in `OPENAI_CUSTOM_HEADERS` to every request, so while the server sets it, OpenAI targets can't be saved and saved ones aren't restored. The SDK's `OPENAI_ORG_ID` and `OPENAI_PROJECT_ID` still apply to every OpenAI target on this server. GitHub Copilot, Hugging Face, HackAPrompt, LiteLLM, HTTP, and Copilot WebSocket targets can't be saved yet. Converters and scorers follow the same rules. The Azure Speech converters, the Azure Content Safety scorer, and the audio scorers can't be saved yet, because they sign in with this server's key or Azure identity, and neither can the local refusal classifier scorer, whose model can come from this server. A SAS query string may be included in the source; otherwise, PyRIT uses `DefaultAzureCredential`. The default is `~/.pyrit/registry_recipes`.
+
+Restore can't tell who wrote a saved file, even one that names the user who saved it, so the backend rebuilds every entry in this source as an administrator, at startup and after a live apply. A file here can, for example, make the backend run a model's repository code, or use the server's identity on a storage container that the file names. Write access to this source is administrator authority on the backend: grant it only to principals you already trust as backend administrators, and use a dedicated directory or blob prefix that less-trusted users and services cannot write to.
+
+The backend restores saved entries at startup and after a live apply, once the configured initializers have registered theirs. If any saved entry can't be restored, the backend doesn't become ready (state `failed`, outcome `restore-failed`), so a scan can't quietly run without an entry it expects. Until then, only the configuration, status and saved-entry routes answer; the rest return 503. Administrators see each failure with its reason in `GET /api/config/runtime` and on the GUI's Configuration page, where they can fix the listed files or delete them with **Delete** (`DELETE /api/saved-entries/{kind}/{name}`); everyone else sees that an administrator has to fix saved entries. When a folder couldn't be listed, check that the backend can read this source. Then apply the configuration, if `enable_live_reinitialization` is on and the backend runs as one worker and one replica, which live apply requires; otherwise, restart the backend. Files whose names aren't valid entry names (up to 64 lowercase letters, digits, and underscores, starting with a letter) aren't failures and don't block startup; administrators can see them under `restore_ignored` in `GET /api/config/runtime`.
+
 ### `initialization_scripts`
 
 Local paths to custom Python scripts containing `PyRITInitializer` subclasses. Paths can be absolute or relative to the current working directory.

doc/gui/0_gui.md

@@ -198,6 +198,17 @@ members; defaults, visibility, and the target's configuration columns remain
 available. Converter inputs and outputs stay visible in the table. Use the small
 red X to remove a converter from the live registry; confirmation is required.
 
+**Delete** on a saved target, converter, scorer, or technique deletes its saved
+file and removes it from the registry, so it doesn't come back after a restart.
+The person who saved it, or an administrator, can delete it; anyone can when
+sign-in is off. The dialog says who saved it. An entry that another saved entry
+uses, or that a registered entry holds, isn't deleted until that one is deleted
+or changed, and an entry isn't deleted while a run, send, or request could be
+using it. If the file changed since the dialog read it, **Look again** shows the
+current one. A saved entry that couldn't be restored keeps PyRIT from becoming
+ready; an administrator can delete it from the list on the **Configuration**
+page, then select **Reinitialize PyRIT** or restart the backend.
+
 **Scenario presets** save a scenario configuration for reuse with a target
 chosen at launch. **Suites** maintain ordered collections of preset definitions.
 They are stored separately from live component instances.
@@ -209,8 +220,46 @@ Editing a preset preserves unchanged parameter values exactly, including commas
 and whitespace inside list entries, empty lists, duplicates, and their order.
 Editing a list field uses the comma-separated format shown in the editor.
 
-Targets, converters, and techniques added only to the live registry must be
-recreated after a backend restart or reinitialization. Use
+**New Target** saves the target, so it comes back after the backend restarts or
+is reinitialized. Give it a registry name of lowercase letters, digits, and
+underscores that starts with a letter; the dialog suggests one from the target
+type and model. Saved targets are kept in `registry_recipes_source`
+(`~/.pyrit/registry_recipes` unless set in your `.pyrit_conf`). To remove a saved
+target, select **Delete** on its row in the Targets table. If a startup initializer later
+registers a target under a saved target's name, the saved one isn't restored and
+the backend isn't ready until that file is renamed or removed and the backend
+restarted.
+
+Saved targets can't hold credentials yet, so choose Identity-based or No key
+authentication when the target supports it. A target that needs an API key or
+another credential value, a type that can't be saved, or a round robin that uses
+a Temporary target is created as **Temporary** instead, and the dialog says why.
+A Temporary target is gone after the backend restarts or is reinitialized.
+
+The Targets table labels each target **Saved**, **From configuration**
+(registered by an initializer at startup), or **Temporary**. A target saved while
+signed in also says who saved it (**Saved by you** for your own). Once you have
+saved one, check **Only targets I saved** to list just yours. Anyone can still
+use every target.
+
+New converters are saved the same way, wherever you add one: **New Converter** in
+the Converters tab, the converter panel in chat, or **New converter** in the
+technique editor. The dialog suggests a name such as `base64_converter`. A
+converter type that can't be saved yet (the Azure Speech converters, and types
+that need an uploaded file), a converter with an uploaded file, or one that uses a
+Temporary target is created as **Temporary** instead, and the dialog says why.
+**Save to registry** on a converter's changed settings, in chat or in a technique
+edit, makes a Temporary copy. The Converters and Scorers tables use the same three
+labels and say who saved each entry, with **Only converters I saved** and **Only
+scorers I saved** to list just yours; scorers can be saved through the API.
+
+**New technique** saves the technique the same way. Give it a registry name of
+lowercase letters, digits, and underscores that starts with a letter. A technique
+that uses a Temporary converter or a Temporary adversarial target is created as
+**Temporary** instead, and the dialog says why. Settings changed for a single run
+in Scanner stay with that run. The Techniques table uses the same three labels and
+**Only techniques I saved**. To
+remove a saved technique, select **Delete** next to its name. Use
 [initializers](../code/setup/0_setup.md) for repeatable component setup.
 
 Use **Auto-detect capabilities** to select targets and run live checks. Results

frontend/e2e/_targets.ts

@@ -14,6 +14,9 @@ export interface FlatTarget {
   capabilities?: unknown;
   target_specific_params?: unknown;
   inner_targets?: FlatTarget[] | null;
+  origin?: "saved" | "configuration" | "temporary" | null;
+  saved_by?: string | null;
+  saved_by_me?: boolean;
 }
 
 interface TargetInstanceMock {
@@ -27,6 +30,9 @@ interface TargetInstanceMock {
   capabilities: unknown;
   target_specific_params: unknown;
   inner_targets: TargetInstanceMock[] | null;
+  origin?: "saved" | "configuration" | "temporary" | null;
+  saved_by?: string | null;
+  saved_by_me?: boolean;
 }
 
 export function makeTarget(flat: FlatTarget): TargetInstanceMock {
@@ -41,5 +47,8 @@ export function makeTarget(flat: FlatTarget): TargetInstanceMock {
     capabilities: flat.capabilities ?? null,
     target_specific_params: flat.target_specific_params ?? null,
     inner_targets: flat.inner_targets ? flat.inner_targets.map(makeTarget) : null,
+    ...(flat.origin !== undefined ? { origin: flat.origin } : {}),
+    ...(flat.saved_by !== undefined ? { saved_by: flat.saved_by } : {}),
+    ...(flat.saved_by_me !== undefined ? { saved_by_me: flat.saved_by_me } : {}),
   };
 }

frontend/e2e/config.spec.ts

@@ -302,7 +302,7 @@ test.describe("Target Registry Page", () => {
 
     // Dialog should open
     await expect(page.getByText("Create New Target")).toBeVisible();
-    await expect(page.getByText("Create Target")).toBeVisible();
+    await expect(page.getByRole("button", { name: "Save Target" })).toBeVisible();
   });
 
   test("should update targets after a visible minute without a Refresh control", async ({ page }) => {
@@ -343,6 +343,34 @@ test.describe("Target Registry Page", () => {
     await expect(reset).toBeFocused();
     await expect(reset).toHaveAttribute("aria-disabled", "true");
   });
+
+  test("should say who saved each target and list only yours on request", async ({ page }) => {
+    await page.route(/\/api\/targets(?:\?.*)?$/, async (route) => {
+      await route.fulfill(
+        mockTargetsList([
+          { target_registry_name: "mine_chat", target_type: "OpenAIChatTarget", model_name: "gpt-4o", origin: "saved",
+            saved_by: "Ada", saved_by_me: true },
+          { target_registry_name: "bobs_chat", target_type: "OpenAIChatTarget", model_name: "gpt-4o-mini",
+            origin: "saved", saved_by: "Bob" },
+          { target_registry_name: "startup_chat", target_type: "OpenAIChatTarget", model_name: "gpt-4.1",
+            origin: "configuration" },
+        ])
+      );
+    });
+    await goToTargets(page);
+
+    await expect(page.getByTestId("target-row-mine_chat").getByText("Saved by you", { exact: true })).toBeVisible();
+    await expect(page.getByTestId("target-row-bobs_chat").getByText("Saved by Bob", { exact: true })).toBeVisible();
+    await page.getByRole("checkbox", { name: "Only targets I saved (1)" }).check();
+    await expect(page.getByTestId("target-row-bobs_chat")).toHaveCount(0);
+    await expect(page.getByTestId("target-row-startup_chat")).toHaveCount(0);
+    await expect(page.getByTestId("target-row-mine_chat")).toBeVisible();
+
+    // The choice isn't kept, so a fresh load lists everyone's targets again.
+    await goToTargets(page);
+    await expect(page.getByTestId("target-row-bobs_chat")).toBeVisible();
+    await expect(page.getByRole("checkbox", { name: "Only targets I saved (1)" })).not.toBeChecked();
+  });
 });
 
 test.describe("Create Target Dialog", () => {
@@ -406,12 +434,14 @@ test.describe("Create Target Dialog", () => {
     await expect(selectedDetails).toContainText("Supported authentication: API key");
   });
 
-  test("should create a target through the dialog", async ({ page }) => {
+  test("should save a target through the dialog", async ({ page }) => {
     let createdTarget: FlatTarget | null = null;
+    let createBody: Record<string, unknown> | null = null;
 
     await page.route(/\/api\/targets/, async (route) => {
       if (route.request().method() === "POST") {
         const body = JSON.parse(route.request().postData() ?? "{}");
+        createBody = body;
         createdTarget = {
           target_registry_name: "new-target-1",
           target_type: body.type,
@@ -429,6 +459,27 @@ test.describe("Create Target Dialog", () => {
         await route.fulfill(mockTargetsList(items));
       }
     });
+    // Registered last, so it answers the type list instead of the route above.
+    await page.route(/\/api\/targets\/types(?:\?.*)?$/, async (route) => {
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          items: [
+            {
+              target_type: "OpenAIChatTarget",
+              parameters: [
+                { name: "endpoint", type_name: "str", required: true, default: null },
+                { name: "model_name", type_name: "str", required: true, default: null },
+              ],
+              supported_auth_modes: ["api_key", "identity", "none"],
+              saveable_auth_modes: ["identity", "none"],
+              not_saveable_reason: null,
+            },
+          ],
+        }),
+      });
+    });
 
     await goToTargets(page);
 
@@ -453,11 +504,16 @@ test.describe("Create Target Dialog", () => {
     // Fill model name
     await dialog.getByPlaceholder("e.g. gpt-4o, my-deployment").fill("gpt-4o-test");
 
-    // Click Create Target
-    await dialog.getByRole("button", { name: "Create Target" }).click();
+    await dialog.getByRole("button", { name: "Save Target" }).click();
 
     // Dialog should close and target should appear in the list
     await expect(page.getByText("Create New Target")).not.toBeVisible({ timeout: 5_000 });
+    expect(createBody).toMatchObject({
+      name: "openai_chat_gpt_4o_test",
+      type: "OpenAIChatTarget",
+      auth_mode: "identity",
+      persist: true,
+    });
     await expect(page.getByText("gpt-4o-test", { exact: true })).toBeVisible({ timeout: 10_000 });
     await expect(page.getByText("OpenAIChatTarget")).toBeVisible();
   });
@@ -496,7 +552,7 @@ test.describe("Create Target Dialog", () => {
     await expect(page.getByText("Create New Target")).toBeVisible();
 
     const dialog = page.locator('[role="dialog"]');
-    const createBtn = dialog.getByRole("button", { name: "Create Target" });
+    const createBtn = dialog.getByRole("button", { name: "Save Target" });
     await expect(createBtn).toBeDisabled();
 
     await selectTargetType(

frontend/e2e/fixtures/manual_send_backend.py

@@ -4,6 +4,7 @@
 """Offline backend for manual-send browser tests, with no real configuration or providers."""
 
 import os
+import tempfile
 from collections.abc import AsyncGenerator
 from contextlib import asynccontextmanager
 from unittest.mock import AsyncMock, patch
@@ -27,19 +28,22 @@ async def _initialize_offline_async(self: ConfigurationLoader, *, raise_on_initi
 
 @asynccontextmanager
 async def _offline_lifespan_async(application: FastAPI) -> AsyncGenerator[None, None]:
-    config = ConfigurationLoader(memory_db_type="in_memory", env_files=[], env_akv_ref=[])
-    with (
-        patch.dict(os.environ, {"PYRIT_AUTH_MODE": "local", "PYRIT_DEV_MODE": "true"}, clear=True),
-        patch.object(
-            ConfigurationFileService,
-            "_read_source_async",
-            new=AsyncMock(return_value="memory_db_type: in_memory\nenv_files: []\ninitializers: []\n"),
-        ),
-        patch.object(ConfigurationLoader, "load_with_overrides", return_value=config),
-        patch.object(ConfigurationLoader, "initialize_pyrit_async", new=_initialize_offline_async),
-    ):
-        async with lifespan(application):
-            yield
+    with tempfile.TemporaryDirectory() as recipes:
+        config = ConfigurationLoader(
+            memory_db_type="in_memory", env_files=[], env_akv_ref=[], registry_recipes_source=recipes
+        )
+        with (
+            patch.dict(os.environ, {"PYRIT_AUTH_MODE": "local", "PYRIT_DEV_MODE": "true"}, clear=True),
+            patch.object(
+                ConfigurationFileService,
+                "_read_source_async",
+                new=AsyncMock(return_value="memory_db_type: in_memory\nenv_files: []\ninitializers: []\n"),
+            ),
+            patch.object(ConfigurationLoader, "load_with_overrides", return_value=config),
+            patch.object(ConfigurationLoader, "initialize_pyrit_async", new=_initialize_offline_async),
+        ):
+            async with lifespan(application):
+                yield
 
 
 app.router.lifespan_context = _offline_lifespan_async