FEAT: Security & Azure deployment for CoPyRIT GUI

[adrian-gavrila]

Changes

• Authentication: Entra ID login with MSAL PKCE on the frontend, JWT validation and group-based authorization
  on the backend. Automatically disabled for local development.
• Security headers: CSP, HSTS, X-Frame-Options, Cache-Control, and other standard browser security headers.
• Infrastructure: Bicep template for Azure Container Apps — managed identity, Key Vault secrets, logging, and
  optional private networking.
• Deployment pipeline: Azure DevOps pipeline that builds, pushes, and deploys to test with opt-in production
  promotion.
• Docker: Updated container setup for Azure credential forwarding and config file mounting.

Tests & docs

• Frontend auth tests (AuthProvider, msalConfig, API service).
• Deployment guide (infra/README.md) and Docker quickstart (docker/QUICKSTART.md).

[Copilot]

Pull request overview

This PR adds Entra ID (MSAL PKCE) authentication plus backend JWT validation and security headers for the CoPyRIT GUI, and introduces Azure Container Apps IaC + an Azure DevOps deployment pipeline to support hardened deployments.

Changes:

• Add frontend MSAL PKCE auth flow and attach Bearer tokens to API requests; add backend JWT validation and security headers middleware.
• Add Azure Container Apps Bicep templates + deployment documentation and example parameters.
• Update Docker startup/config mounting and introduce an ADO pipeline for build/push/deploy.

Reviewed changes

Copilot reviewed 31 out of 33 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
uv.lock	Adds PyJWT dependency to lockfile.
pyproject.toml	Adds PyJWT dependency for backend JWT validation.
pyrit/backend/main.py	Wires in security headers + Entra auth middleware; tightens CORS; disables docs in prod.
pyrit/backend/middleware/init.py	Exposes SecurityHeadersMiddleware.
pyrit/backend/middleware/security_headers.py	Adds CSP/HSTS/etc security header injection middleware.
pyrit/backend/middleware/auth.py	Adds Entra JWT validation + group authorization middleware.
pyrit/backend/routes/auth.py	Adds /api/auth/config endpoint to serve non-secret MSAL config.
infra/README.md	Adds deployment guide for Azure Container Apps hardened setup.
infra/parameters.example.json	Adds example deployment parameters.
infra/main.bicep	Adds Bicep template for ACA, MI, KV secret refs, logging, optional private networking.
infra/main.json	Generated ARM JSON for the Bicep template.
gui-deploy.yml	Adds Azure DevOps pipeline to build/push image and deploy to test/prod.
frontend/src/main.tsx	Wraps app in AuthProvider.
frontend/src/auth/msalConfig.ts	Adds runtime MSAL configuration + API scope helpers.
frontend/src/auth/msalConfig.test.ts	Adds unit tests for MSAL config helpers.
frontend/src/auth/AuthConfigContext.ts	Adds context for auth config values.
frontend/src/auth/AuthProvider.tsx	Adds MSAL initialization/login redirect wrapper for the app.
frontend/src/auth/AuthProvider.test.tsx	Adds tests for auth init and auth-disabled behavior.
frontend/src/services/api.ts	Adds token acquisition + Authorization header injection + 401 retry.
frontend/src/services/api.test.ts	Updates tests for async request interceptor.
frontend/src/App.tsx	Wires MSAL instance into API client from within the app.
frontend/src/App.test.tsx	Mocks MSAL hooks and API client wiring in tests.
frontend/package.json	Adds MSAL deps and related test tooling deps.
frontend/package-lock.json	Updates lockfile for new dependencies.
frontend/.npmrc	Pins npm registry and enables legacy peer deps.
build_scripts/prepare_package.py	Changes npm install to use --legacy-peer-deps.
docker/start.sh	Writes .env from PYRIT_ENV_CONTENTS; starts backend with args for GUI/AzureSQL/initializers.
docker/run_pyrit_docker.py	Mounts .pyrit_conf and ~/.azure; enables interactive -it.
docker/QUICKSTART.md	Updates Docker quickstart with new mounting + auth notes.
docker/Dockerfile	Requires explicit BASE_IMAGE build arg (no default).
docker/docker-compose.yaml	Mounts .pyrit_conf and ~/.azure into GUI container.
.pyrit_conf_example	Updates example config (currently duplicates operator/operation).
.devcontainer/Dockerfile	Changes uv installation method in devcontainer image.

Files not reviewed (1)

• frontend/package-lock.json: Language not supported

Comments suppressed due to low confidence (1)

frontend/package.json:33

• @azure/msal-react@^5.0.7 declares a peer dependency on React ^19.2.1 (see package-lock), but this project depends on React ^18.3.1. The current workaround (legacy-peer-deps) bypasses npm's resolver but leaves an unsupported dependency combination that can break at runtime. Either pin @azure/msal-react to a version that supports React 18, or upgrade React (and related tooling) to the required major version.

  "dependencies": {
    "@azure/msal-browser": "^5.5.0",
    "@azure/msal-react": "^5.0.7",
    "@fluentui/react-components": "^9.54.0",
    "@fluentui/react-icons": "^2.0.258",
    "axios": "^1.13.5",
    "react": "^18.3.1",
    "react-dom": "^18.3.1",
    "react-error-boundary": "^6.1.1"
  },