[varunj-msft]

Description

Part 7 of saving Registry entries across restarts. Stacked on part 6 (#3986); part 8 (#4026) builds on it. This PR's own changes: varunj-msft/PyRIT@varunj-msft/13178-Launch-Keeps-Saved-Entries...varunj-msft/13178-Refuse-Saved-Target-Keys

Design: 4.4 Credentials. Where every part fits: PR map.

This is one of the changes for saving Registry entries across restarts. It builds on #3986. Until the earlier PRs merge, the diff here also shows their changes.

Problem. Restore refuses a recipe that stores a credential, but a target can use one without storing it. An OpenAI target with an empty api_key reads the key from this server's environment, an empty endpoint takes this server's endpoint setting (which can hold a user name and password), and a URL can carry a SAS token or a key in its query. Saved targets are shared by everyone using the app, so one restored like that would send every user's requests with this server's keys.

Change. Restore now runs every saved entry through one shared check, check_saved_entry_params. On top of the rules it already had (no stored credential, no class that needs the server's upload folder), it refuses a target recipe that:

• uses an auth mode its class doesn't support, or leaves empty a parameter the class would fill from this server. Each class lists those in server_fallback_parameters, with the value that turns the fallback off (for example, OpenAI's headers set to "{}"). Microsoft Entra ID ("identity") and no key ("none") are fine. Entra ID uses this server's Azure identity the same way targets created through the API do today, and an OpenAI target only mints that token for a recognized Azure endpoint.
• leaves a destination to this server's settings, or gives one that can carry a credential. Each class lists its destinations in destination_parameters. One that would take this server's setting must be a full http(s) or ws(s) address. None may hold a user name, password, SAS token, fragment, ;, & or = in the path, or a query other than api-version, even after percent-decoding and Unicode normalization, and a path can't have a query at all.
• builds a class that can't be saved at all, each with its reason in not_saveable_reason: WebSocketCopilotTarget, HTTPTarget and HuggingFaceChatTarget. (HTTPXAPITarget was already refused, since it needs the server's upload folder.)

Each refusal is reported as a restore failure whose message names the class or parameter, never a value.

What stays the same. Converters and scorers get the same checks as before, since they don't declare fallbacks or destinations yet. Targets created without saving, and targets the startup scripts register, aren't checked, so a saved round-robin can still use startup targets, which keep their own sign-in. server_credential_parameter (the admin check from #3247) is unchanged.

Not covered. Environment variables the OpenAI SDK reads by itself (OPENAI_CUSTOM_HEADERS, OPENAI_ORG_ID, OPENAI_PROJECT_ID) still apply to every OpenAI target on this server, saved ones included.

Tests and Documentation

• New tests/unit/registry/test_registry_recipe_rules.py: Entra ID and no-key targets pass; an OpenAI target without a key or identity, an empty key the class reads from this server, identity without headers, headers that can carry a credential, an auth mode the class doesn't support, and a class that can't be saved are refused; plain addresses and A2A agent card paths pass; URLs and paths that can carry a credential (user info, SAS, fragment, path parameters, other query keys, encoded or look-alike forms, and values that never finish decoding) are refused; an empty destination that would take this server's setting is refused, and one that isn't a full address gets its own message; text parameters that aren't destinations are left alone. Each URL rule also has a case only it catches, such as ; or & alone in a path, sig= or SIG= in the host, a lone api-key, subscription-key or sv query, an api-version value that isn't version-shaped, and an agent endpoint with another scheme, no host, or a value that can't be parsed.
• tests/unit/registry/test_registry_recipe_restore.py: restore reports a target that would use this server's credentials, or sign in with this server's account, instead of building it. The test that fed a server endpoint holding a credential into a build error is gone, since such a target is now refused before it's built; the tests that build errors hide credentials stay.
• Each of the 39 ways I tried to remove or loosen a rule fails at least one of these tests.
• uv run --frozen --extra all python -m pytest -n 8 --dist=loadfile tests/unit/registry tests/unit/backend tests/unit/prompt_target tests/unit/models tests/unit/setup tests/unit/converter tests/unit/score: 19,447 passed, 9 skipped, 4 xfailed
• pre-commit (ruff, ty) on the changed files: passed.
• doc/getting_started/pyrit_conf.md: what a saved target can hold and use, which addresses must be full, the OpenAI SDK settings that still apply, and which target types can't be saved yet.

No JupyText changes.