[varunj-msft]

Description

Part 9 of saving Registry entries across restarts. Stacked on part 8 (#4026); part 10 (#4028) builds on it, and so do the side branches part 16 (#4068) and part 19 (#4070). This PR's own changes: varunj-msft/PyRIT@varunj-msft/13178-Save-Targets...varunj-msft/13178-Save-From-Registry

Design: 1. The contract, 4.8 Names. Where every part fits: PR map.

This is one of the changes for saving Registry entries across restarts. It builds on #4026, which saves targets created through the API. Until the earlier PRs merge, the diff here also shows their changes.

Problem. The New Target dialog in Registry > Targets still makes targets that are gone after the backend restarts. It sends no name, so the backend makes one up (compat_<hex>), and the Targets table doesn't say which targets will come back.

Change.

• The dialog has a Registry Name field. Until the user edits it, it suggests a name from the type and model that no listed target has (openai_chat_gpt_4o). The model tells saved targets apart and keeps the suggestion off names the startup scripts register, such as openai_chat. The field checks the same rule the backend uses for saved names. A name the Targets list already has, or one the backend says is taken (409), shows on the field and holds Save until the name changes.
• The dialog saves by default (persist: true). When a target can't be saved, the button reads Create as Temporary and a warning says why, and that a Temporary target is gone after the backend restarts or is reinitialized. The dialog says so before submitting when the backend's type list already tells it: the type can't be saved, the chosen sign-in can't be saved (an API key, for now), a credential is typed in, or a round robin uses a Temporary target. Otherwise the backend's refusal turns the button into Create as Temporary for those exact values, and changing any of them goes back to Save Target. No other error offers Temporary.
• A new target starts with Microsoft Entra ID, or No key, when a saved target of its type can use it, so the usual case saves. This also applies when the type's details arrive after the type was picked. Picking another type resets the choice and clears a typed key. For an OpenAI endpoint that isn't on Azure, the Entra ID error now says to choose No key for a server that needs no key, such as a local one. It shows once the endpoint field is left, not while the address is typed.
• GET /api/targets/types adds saveable_auth_modes and not_saveable_reason to each type. They come from the checks a save runs (the class check, and the server-setting check for each auth mode with those settings turned off), so the dialog keeps no copy of the credential rules.
• A refused save gets a typed 400 ("type": "/errors/not-saveable"), so the dialog doesn't read messages. When the only problem is an endpoint that isn't a full http(s) or ws(s) address, the request gets a plain 400 instead, since a Temporary target with that address wouldn't work either.
• The warning and the Entra ID error use role="status" so screen readers read them out. Fluent's message bars only announce through an announcer the app doesn't render.
• The Targets table labels each target Saved, From configuration or Temporary, and the round robin member list marks Temporary members.
• The GUI doc says where saved targets are kept, how to remove one for now, and what happens if a startup script later registers the same name.

What stays the same. API callers that don't send persist get Temporary targets as before, and may still leave out the name. Permission checks still come first, and restore is unchanged.

Not covered.

• Showing who saved a target, and a Mine / All filter. That's FEAT: Show who saved each target and list only your own (part 10) #4028 (part 10).
• Picking a server credential, and keeping typed keys in a key vault. Until then a target that uses an API key is Temporary.
• Saving converters, scorers and techniques, and deleting saved entries. Those come in parts 12 to 14 and part 20.

Tests and Documentation

• tests/unit/registry/test_registry_recipe_rules.py: check_saveable_class lists the auth modes a saved target of each type can use, refuses a class that can never be saved, and agrees with the check a save runs for every registered target type and auth mode.
• tests/unit/backend/test_target_service.py: the type list says which auth modes a saved target can use and why a type can't be saved; saving a type that can't be saved is refused; an endpoint that isn't a full web address is an error to fix, not a refusal.
• tests/unit/backend/test_api_routes.py: a refused save is a 400 with "type": "/errors/not-saveable"; other bad requests stay untyped.
• CreateTargetDialog.test.tsx (new "CreateTargetDialog saving" block): saving by default with Entra ID or No key, also when the type details arrive late; the suggested name from the type and model until it's edited; names already listed or taken (409) held on the field; when Create as Temporary is offered and why (an API key, a typed credential, a type that can't be saved, a round robin with a Temporary member), and only after a typed refusal for those exact values; no Temporary offer on 409, 422, 403 or other errors; the warning and the Entra ID error as live regions; starting over after the dialog closes; the Entra ID error once the endpoint field is left.
• TargetTable.test.tsx: the Saved, From configuration and Temporary labels. registryName.test.ts and errors.test.ts: the name suggestion and the typed refusal check.
• frontend/e2e/config.spec.ts (mock): saving through the dialog sends Entra ID and persist: true. frontend/e2e/registry.spec.ts (seeded, real backend): a target saved from the dialog is still Saved after a reload.
• Each of the 64 ways I tried to break the dialog, the labels or the saveability check fails at least one of these tests.
• uv run --frozen --extra all python -m pytest -n 8 --dist=loadfile tests/unit/registry tests/unit/backend tests/unit/prompt_target tests/unit/models tests/unit/setup tests/unit/converter tests/unit/score: 19,599 passed, 9 skipped, 4 xfailed
• cd frontend && npm run test:coverage: 184 suites, 4,557 tests passed
• cd frontend && npx playwright test --project=mock e2e/config.spec.ts e2e/registry.spec.ts: 28 passed
• cd frontend && E2E_SEEDED_MODE=true npx playwright test --project=seeded: 109 passed
• npx tsc --noEmit, npx eslint on the changed files, and pre-commit (ruff, ty, docs checks): passed
• Run against a real backend in a real browser, with the server using its own Entra ID credential: saved an Entra ID chat target on Azure OpenAI and a local No key target from the dialog. A target with an API key, a round robin using a Temporary target, and a target created through the API without persist came out Temporary, with the reason shown. After a backend restart the saved targets came back as Saved, the Temporary ones were gone, and a message sent through the restored Entra ID target got an answer. No key was in any saved file.
• doc/gui/0_gui.md (Registry): saving a target, where saved targets are kept, how to remove one for now, and what happens when a startup script registers the same name. pyrit/backend/README.md: the new type fields and the typed 400.

No JupyText changes.