MAINT: Fail Closed on Missing GUI Authentication Configuration

[Justin Song (jsong468)]

TL;DR: Make PyRIT require either explicit local mode or complete Microsoft Entra configuration before the GUI backend can start. Existing local, Docker, CI, and Azure workflows retain their normal commands while explicitly declaring and testing the appropriate authentication and network boundaries.

Description

• Add an immutable process-start authentication policy with explicit local and entra modes.
  • Missing, partial, contradictory, or unknown authentication configuration now fails startup instead of silently disabling authentication.
  • Complete Entra configuration remains backward compatible when PYRIT_AUTH_MODE is omitted.
• Resolve authentication policy before recoverable PyRIT runtime initialization and share it through application state.
  • Middleware, frontend auth bootstrap, and administrator checks now use one validated policy and cannot disagree or change during live reinitialization.
• Add --auth-mode local|entra to pyrit_backend.
  • Explicit local mode is rejected on non-loopback CLI bindings.
  • Container launchers may supply local mode through the environment while relying on verified loopback-only host publication.
• Preserve existing local workflows without additional user steps:
  • frontend/dev.py, scanner/shell launchers, Docker Compose, the Docker helper, and Docker smoke tests explicitly select local mode.
  • Azure Container Apps explicitly select Entra mode.
• Restrict the Vite development server to 127.0.0.1 by default so its /api proxy cannot expose a local unauthenticated backend to the LAN.
  • Isolated environments can explicitly override this with PYRIT_FRONTEND_HOST.
• Add the shared _forward_process_output helper to continuously copy backend and Vite output from their subprocess pipes to the terminal.
  • Previously, dev.py stopped reading Vite output after detecting its port; once the finite pipe buffer filled, Vite could remain running but stop responding to HTTP requests.
• Update frontend E2E startup to select local mode and extend Docker CI to verify both loopback publication and the resolved GUI auth mode.
• Add regression coverage for policy validation, fail-closed Uvicorn startup, CLI/container launch behavior, Docker Compose, frontend development, and Azure deployment wiring.

Tests and Documentation

• uv run pytest tests/unit/backend/test_authentication_policy.py tests/unit/backend/test_auth_middleware.py tests/unit/backend/test_auth_route.py tests/unit/backend/test_main.py tests/unit/backend/test_pyrit_backend.py tests/unit/backend/test_runtime_lifecycle.py tests/unit/backend/test_compatibility.py tests/unit/cli/test_server_launcher.py tests/unit/docker/test_docker_compose.py tests/unit/frontend/test_dev.py tests/unit/infra/test_bicep_topology.py -q
  • Passed: 548 passed, 5 skipped.
• npm run type-check --prefix frontend
  • Passed.
• npm run lint --prefix frontend
  • Passed.
• npm run build --prefix frontend
  • Passed.
• Focused Ruff lint and format checks for changed Python launcher files
  • Passed.
• Resolved Docker Compose validation
  • Passed: GUI publishes 127.0.0.1:8000 and sets PYRIT_AUTH_MODE=local.
• Direct unconfigured Uvicorn validation
  • Passed: startup exits nonzero before opening a listener.
• Live local frontend/dev.py smoke validation
  • Passed: Vite and backend listen only on loopback; GUI HTML, proxied health/auth bootstrap, and a compatibility-stamped protected API request returned 200.
• Live Docker container smoke testing was not run locally because the Docker Desktop daemon was unavailable; Docker configuration, launcher behavior, and CI smoke-test wiring were validated.
• Update backend, GUI, Docker, and frontend development documentation with the explicit authentication-mode contract, local-network boundary, Docker behavior, and optional devcontainer host override.