FEAT Add GUI initializers - #2271
Open
hannahwestra25 wants to merge 14 commits into
Open
Conversation
Adds a DB-backed initializer settings feature: persistence, merge/apply-now API, and a frontend Initializers config tab. - pyrit/models/initializer_setting.py: new InitializerSetting model - pyrit/memory: schema, memory_interface support, and alembic migration for initializer settings - pyrit/backend: routes/service/models for listing, saving, applying, and resetting initializer settings, merged with baseline config-file initializers - pyrit/setup/configuration_loader.py: public initializer_configs accessor used by the backend instead of a private attribute - frontend/src/components/Config: new ConfigPage, InitializerConfig, and InitializerTable components for viewing and editing initializers in the GUI, including Save/Apply now/Reset actions per initializer and a no-op guard that disables Save until parameters change Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 42217662-8f83-4440-9b89-2d3645e6af08
…th card layout in a settings dialog - Backend: filter scorer/technique/load_default_datasets/preload_scenario_metadata out of GET /initializers/settings since they have no visible effect in the browser-only GUI (scanner-only registries). - Frontend: replace the multi-column InitializerTable with a card-per-initializer InitializerList, since only 'target' is ever shown now. - Frontend: revert Targets/Initializers tabs on the Config page back to a single Target Configuration view; initializer settings are now reached via an 'Initializer Settings' button that opens a dialog. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 42217662-8f83-4440-9b89-2d3645e6af08
…tartup Address PR review notes: - Remove the half-wired 'enabled' flag across domain model, DB column, migration, REST models, service, route, config-loader merge, TS types, InitializerList, and tests (no GUI toggle ever set it false). - Drop empty InitializerSettingResponse; save route returns InitializerSetting. - Restore initializer_service module docstring (list/register/unregister). - Simplify _GUI_HIDDEN_INITIALIZER_NAMES comment. - Merge saved InitializerSetting overrides with the .pyrit_conf baseline at the backend-facing entry point: build Central Memory up front via _create_memory_instance and pass it into initialize_pyrit_async, keeping DB-awareness scoped to ConfigurationLoader. - Document initializer configuration precedence in doc/gui/0_gui.md. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 76ab1772-aef5-48ad-a83f-a3fb28270993
apply_initializer_async ran the initializer's build/validate/initialize_async inline on the event loop. Because an initializer's initialize_async can perform blocking I/O (e.g. target construction acquiring Entra tokens), this froze the single-threaded backend for the duration of the apply, causing concurrent requests (health polls, other pages) to fail with 'backend can't be reached'. Run the blocking work via asyncio.to_thread so the event loop stays responsive. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 76ab1772-aef5-48ad-a83f-a3fb28270993
The GUI's effective initializer list shows only the target initializer under the default config, so the user-facing 'Initializer Settings' button and dialog now read 'Auto-Register Targets' with target-centric copy. Component and backend names stay generic since custom .pyrit_conf entries can still surface multiple rows. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 76ab1772-aef5-48ad-a83f-a3fb28270993
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 76ab1772-aef5-48ad-a83f-a3fb28270993
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 76ab1772-aef5-48ad-a83f-a3fb28270993
jbolor21
reviewed
Jul 27, 2026
jbolor21
reviewed
Jul 27, 2026
behnam-o
reviewed
Jul 27, 2026
Change the persisted-initializer design from name-keyed overrides (merged into the .pyrit_conf baseline at startup) to an ordered list of additional initializers, each with a surrogate id, that run after the baseline. This allows multiple invocations of the same initializer type and aligns with the framework's existing multi-instance initializer semantics. - New AdditionalInitializer domain model + AdditionalInitializers table - ConfigurationLoader and module-level initialize_pyrit_async are DB-unaware again; the backend composition root owns running additional initializers - Backend models use composition instead of subclassing; routes/services no longer import the configuration loader (baseline passed via app.state) - GUI: Initializers moved to its own page with a left-nav entry; read-only baseline section plus an editable additional-initializers list - Update docs and tests Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 76ab1772-aef5-48ad-a83f-a3fb28270993
Move the registered-initializer catalog into a header dialog, merge the baseline cards into a single read-only box, and let users add any registered initializer via a dropdown. Adding now opens a parameter config dialog before creating; additional-initializer rows are read-only with an Edit dialog for changing parameters. Broaden the backend service to expose all registered initializers in the GUI. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 76ab1772-aef5-48ad-a83f-a3fb28270993
Refactor BaselineInitializerSetting/AdditionalInitializerSetting to reference the registered initializer by name instead of embedding it, resolving catalog metadata on the frontend. Auto-assign order_index on create and preserve it on update for deterministic run order. Stabilize Fluent dialog tests by tolerating the transient aria-hidden modalizer state. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 76ab1772-aef5-48ad-a83f-a3fb28270993
…itializers # Conflicts: # frontend/src/components/Sidebar/Navigation.tsx
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a98b9a92-b8c2-4aca-86b3-4759f9991373
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add GUI Initializer Management
Implements Part 1 of the initializer/target persistence design: design gist.
Summary
The GUI could not manage built-in initializers —
.pyrit_confwas the only way to configure them, requiring a config edit and restart. This PR adds GUI-driven initializer management backed by a newInitializerSettingsdatabase table:.pyrit_confstays the deployment-owned, read-only baseline, and GUI-added initializer invocations (parameters,order_index) are saved as database rows. At startup, the backend merges the baseline with the saved additional invocations into one effective, ordered list — the scanner, which drives the same backend process, sees the same merged list. Save and Apply now stay separate: Save only persists the invocation; Apply now re-runs that initializer live without restartingCentralMemory.What's included
Backend:
InitializerSettingmodel + migration, memory interface support, and service/routes for listing (baseline + additional invocations + source), validating, creating, updating, applying, and removing an additional initializer invocation. All registered initializers are exposed to the GUI-facing list. Settings reference the registered initializer by name (initializer_name) rather than embedding its full catalog metadata — the frontend joins the name against the registered-initializer catalog.order_indexis auto-assigned on create (appended after existing rows) and preserved on update, so additional initializers run in a deterministic order.Frontend: An Initializers page (opened from Target Configuration) with three parts:
.pyrit_confbaseline that ran at startup;Future work
Save GUI-created targets (
RegisteredTargetstable pointing toTargetIdentifiers) so targets survive a restart, plus restore logic at startup (children rebuilt in order, name-conflict checks, unavailable-target reporting).Custom initializer management in the GUI — backend already supports guarded upload/removal; GUI surfacing is a separate security-focused follow-up.
initializer_gui.mp4
Tests and Documentation
order_indexassignment), the startup baseline+additional merge, and React components