fix: reject technique enum collisions

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 4b6d69d3-3f92-4c5b-8991-f481820dfe70

Author: Copilot

doc/code/scenarios/0_scenarios.py

@@ -59,9 +59,7 @@
 #    - Each enum member represents an **attack technique** (the *how* of an attack)
 #    - Each member is defined as `(value, tags)` where value is a string and tags is a set of strings
 #    - Include an `ALL` aggregate technique that expands to all available techniques
-#    - The default technique (what runs when the caller selects nothing) is owned by the
-#      catalog, not the scenario: override the `default()` classmethod to return the default
-#      member (omit it to fall back to `ALL`)
+#    - The default technique (what runs when the caller selects nothing) is owned by the catalog, not the scenario: override the `default()` classmethod to return the default member (omit it to fall back to `ALL`)
 #
 # 2. **Scenario Class**: Extend `Scenario` and pass these to `super().__init__()`:
 #    - `technique_class`: Your technique enum class

pyrit/registry/components/attack_technique_registry.py

@@ -53,6 +53,46 @@ def _attack_technique_factory_type() -> type[AttackTechniqueFactory]:
     return AttackTechniqueFactory
 
 
+def _validate_generated_member_collisions(
+    *,
+    class_name: str,
+    factories: list[AttackTechniqueFactory],
+    aggregate_tags: set[str],
+) -> None:
+    """
+    Validate that generated enum member names and values are unambiguous.
+
+    Args:
+        class_name (str): Name of the enum class being generated.
+        factories (list[AttackTechniqueFactory]): Technique factories that become enum members.
+        aggregate_tags (set[str]): Catalog tags that become aggregate members.
+
+    Raises:
+        ValueError: If a factory or aggregate would collide with a reserved or generated member.
+    """
+    member_sources = {"ALL": "reserved aggregate 'all'", "DEFAULT": "reserved aggregate 'default'"}
+    value_sources = {"all": "reserved aggregate 'all'", "default": "reserved aggregate 'default'"}
+
+    def _reserve(*, member_name: str, member_value: str, source: str) -> None:
+        if existing := member_sources.get(member_name):
+            raise ValueError(
+                f"Cannot build {class_name}: {source} maps to enum member name {member_name!r}, "
+                f"already used by {existing}. Rename the tag or factory."
+            )
+        if existing := value_sources.get(member_value):
+            raise ValueError(
+                f"Cannot build {class_name}: {source} maps to enum value {member_value!r}, "
+                f"already used by {existing}. Rename the tag or factory."
+            )
+        member_sources[member_name] = source
+        value_sources[member_value] = source
+
+    for tag in sorted(aggregate_tags):
+        _reserve(member_name=tag.upper(), member_value=tag, source=f"aggregate tag {tag!r}")
+    for factory in factories:
+        _reserve(member_name=factory.name, member_value=factory.name, source=f"technique factory {factory.name!r}")
+
+
 @dataclass(frozen=True)
 class AttackTechniqueMetadata(RegistryMetadata):
     """
@@ -216,7 +256,8 @@ def build_technique_class_from_factories(
             type: A ``ScenarioTechnique`` subclass with the generated members.
 
         Raises:
-            ValueError: If both ``default_tags`` and ``default_names`` are provided.
+            ValueError: If both ``default_tags`` and ``default_names`` are provided, or if generated
+                enum member names or values collide.
         """
         from pyrit.scenario import ScenarioTechnique
 
@@ -245,6 +286,11 @@ def build_technique_class_from_factories(
         # technique (name selection wins).
         reserved_aggregate_tags = {"all", "default"}
         auto_aggregate_tags = pool_tags - reserved_aggregate_tags - pool_technique_names
+        _validate_generated_member_collisions(
+            class_name=class_name,
+            factories=pool,
+            aggregate_tags=auto_aggregate_tags,
+        )
 
         all_aggregate_tag_names = {"all"} | auto_aggregate_tags
         if default_member_names:

tests/unit/registry/test_attack_technique_registry.py

@@ -651,3 +651,49 @@ def test_both_default_tags_and_names_raises(self):
                 default_tags={"light"},
                 default_names={"gamma"},
             )
+
+    @pytest.mark.parametrize("name", ["ALL", "all", "DEFAULT", "default"])
+    def test_reserved_factory_name_raises(self, name: str):
+        """Factories cannot shadow the synthetic ALL or DEFAULT members."""
+        factories = [AttackTechniqueFactory(name=name, attack_class=_StubAttack)]
+
+        with pytest.raises(ValueError, match="reserved aggregate"):
+            AttackTechniqueRegistry.build_technique_class_from_factories(
+                class_name="ReservedFactoryTechnique",
+                factories=factories,
+            )
+
+    def test_duplicate_factory_name_raises(self):
+        """Duplicate factory names fail instead of silently overwriting an enum member."""
+        factories = [
+            AttackTechniqueFactory(name="duplicate", attack_class=_StubAttack),
+            AttackTechniqueFactory(name="duplicate", attack_class=_StubAttack),
+        ]
+
+        with pytest.raises(ValueError, match="enum member name 'duplicate'"):
+            AttackTechniqueRegistry.build_technique_class_from_factories(
+                class_name="DuplicateFactoryTechnique",
+                factories=factories,
+            )
+
+    def test_reserved_aggregate_tag_raises(self):
+        """An uppercase reserved tag cannot overwrite the synthetic ALL member."""
+        factories = [AttackTechniqueFactory(name="alpha", attack_class=_StubAttack, technique_tags=["ALL"])]
+
+        with pytest.raises(ValueError, match="enum member name 'ALL'"):
+            AttackTechniqueRegistry.build_technique_class_from_factories(
+                class_name="ReservedTagTechnique",
+                factories=factories,
+            )
+
+    def test_case_colliding_aggregate_tags_raise(self):
+        """Tags that normalize to the same enum member name fail explicitly."""
+        factories = [
+            AttackTechniqueFactory(name="alpha", attack_class=_StubAttack, technique_tags=["foo", "FOO"]),
+        ]
+
+        with pytest.raises(ValueError, match="enum member name 'FOO'"):
+            AttackTechniqueRegistry.build_technique_class_from_factories(
+                class_name="CollidingTagTechnique",
+                factories=factories,
+            )