@hoanghainh/komagu 2.1.0 → 2.1.1

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to `@hoanghainh/komagu` (published as `komainu-guard` up to v1.7.0) are documented here. From v1.2.2 on, entries are generated by [release-please](https://github.com/googleapis/release-please) from [Conventional Commits](https://www.conventionalcommits.org/). Earlier entries are copied from the [GitHub Releases](https://github.com/hoanghainh1188/komainu/releases).
 
+## [2.1.1](https://github.com/hoanghainh1188/komagu/compare/v2.1.0...v2.1.1) (2026-11-01)
+
+
+### Bug Fixes
+
+* **assess:** build privilege batches after route mapping and verify privilege findings ([#332](https://github.com/hoanghainh1188/komagu/issues/332)) ([b81f15b](https://github.com/hoanghainh1188/komagu/commit/b81f15b45c1c76c4be55beab48fb637516f3ff46))
+
 ## [2.1.0](https://github.com/hoanghainh1188/komagu/compare/v2.0.1...v2.1.0) (2026-11-01)
 
 

package/assess/lsa/prompts/00-orchestrator.md

@@ -26,7 +26,7 @@ Skip nothing. If a phase fails, stop and report the failure.
 |---|---|---|---|
 | 1 | Pre-scan | script `python3 KIT/scripts/run_prescan.py TARGET OUT [--config CONFIG]` | `stack-profile.json`, `routes.candidates.json`, `injection.candidates.json`, `mass-assignment.candidates.json`, `batches/*.json` |
 | 2 | Stack & auth model | agent `10-stack-detector` | `stack-profile.json` (confirmed), `auth-model.md` |
-| 3 | Route inventory | agent `20-route-mapper` (one run per route batch) | `routes/<batch>.json` → merged `routes.json` |
+| 3 | Route inventory | agent `20-route-mapper` (one run per route batch), then scripts `merge_findings.py OUT` and `make_privilege_batches.py OUT` | `routes/<batch>.json` → merged `routes.json`; extra `batches/privilege-<n>.json` |
 | 4a | BOLA audit | agent `30-bola-auditor` (parallel, one per route batch) | `findings/bola-<batch>.json` |
 | 4b | Injection audit | agent `40-injection-auditor` (parallel, one per injection batch) | `findings/inj-<batch>.json` |
 | 4c | Privilege audit (BFLA, mass assignment) | agent `35-privilege-auditor` (parallel, one per `batches/privilege-<n>.json`) | `findings/priv-<batch>.json` |
@@ -51,10 +51,13 @@ Skip nothing. If a phase fails, stop and report the failure.
   `routes.candidates.json`. Every candidate must be either in `routes.json` or
   listed in `routes.json → rejected[]` with a reason. Missing items = rerun.
 - **Privilege batches.** The pre-scan puts BFLA-hinted routes and mass
-  assignment candidates into `batches/privilege-<n>.json`. If the route mapper
-  sets `needs_bfla_audit: true` on a route that is in no privilege batch, give
-  it to `35-privilege-auditor` as a one-route batch. `merge_findings.py`
-  reports BFLA routes and mass candidates without a verdict as coverage gaps.
+  assignment candidates into `batches/privilege-<n>.json`. The route mapper
+  usually flags more routes (`needs_bfla_audit: true`) than the pre-scan hints.
+  After phase 3, run `merge_findings.py OUT` (writes `routes.json`), then
+  `make_privilege_batches.py OUT`: it adds `privilege-<n>.json` batches for the
+  flagged routes that are in no batch yet. Run phase 4c on every privilege batch.
+  `merge_findings.py` reports BFLA routes and mass candidates without a verdict
+  as coverage gaps; if any remain, run `make_privilege_batches.py` again.
 - **Verifier new issues.** `merge_findings.py` lists verifier `new_issues`
   in `coverage.json`. Send each one back to the matching auditor (BOLA,
   injection or privilege) as a one-item batch, then verify the result. Repeat once at most.

package/assess/lsa/scripts/make_privilege_batches.py

@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Add privilege batches for routes the route mapper flagged for a BFLA audit.
+
+Usage: make_privilege_batches.py OUT [--config audit-config.json]
+Run after phase 3, once merge_findings.py has written OUT/routes.json.
+Reads  OUT/routes.json, OUT/batches/privilege-*.json, OUT/findings/priv-*.json, OUT/stack-profile.json
+Writes OUT/batches/privilege-NNN.json for routes with needs_bfla_audit: true that are in no
+       privilege batch yet and have no privilege verdict (numbering continues after the existing
+       batches). Running it again writes nothing new. Give each new batch to the privilege auditor.
+"""
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+from pathlib import Path
+from typing import Dict, List, Set
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from lsa_common import load_config, read_json, write_json  # noqa: E402
+from make_batches import PRIVILEGE_KNOWLEDGE, group_by_file, pack  # noqa: E402
+from merge_findings import extract_json  # noqa: E402
+
+BATCH_RE = re.compile(r"^privilege-(\d+)\.json$")
+
+
+def _covered(out: Path) -> Set[str]:
+    """Route ids already in a privilege batch or with a privilege verdict."""
+    ids: Set[str] = set()
+    for p in (out / "batches").glob("privilege-*.json"):
+        ids |= {r.get("route_id") for r in read_json(p).get("routes", []) if isinstance(r, dict)}
+    for p in (out / "findings").glob("priv-*.json"):
+        doc = extract_json(p)
+        verdicts = doc.get("privilege_route_verdicts", []) if isinstance(doc, dict) else []
+        ids |= {v.get("route_id") for v in verdicts if isinstance(v, dict)}
+    return ids
+
+
+def _stack_knowledge(out: Path) -> List[str]:
+    prof = out / "stack-profile.json"
+    files = read_json(prof).get("knowledge_files", []) if prof.is_file() else []
+    return [f for f in files if isinstance(f, str) and f.startswith("knowledge/stacks/")]
+
+
+def make_privilege_batches(out: Path, config: Dict) -> List[str]:
+    """Write privilege batches for uncovered BFLA routes; return the new batch ids."""
+    if not (out / "routes.json").is_file():
+        return []
+    covered = _covered(out)
+    todo = [r for r in read_json(out / "routes.json").get("routes", [])
+            if isinstance(r, dict) and r.get("needs_bfla_audit") and r.get("route_id") not in covered]
+    if not todo:
+        return []
+    bdir = out / "batches"
+    numbers = [int(m.group(1)) for p in bdir.glob("privilege-*.json") for m in [BATCH_RE.match(p.name)] if m]
+    n = max(numbers, default=0)
+    knowledge = PRIVILEGE_KNOWLEDGE + _stack_knowledge(out)
+    limit = int(config["batch"].get("max_privilege_items", 20))
+    written = []
+    for chunk in pack(group_by_file(todo, lambda r: r["handler"]["file"]), limit):
+        n += 1
+        bid = f"privilege-{n:03d}"
+        write_json(bdir / f"{bid}.json", {"batch_id": bid, "files": sorted({r["handler"]["file"] for r in chunk}),
+                                          "knowledge_files": knowledge, "routes": chunk, "mass_candidates": [],
+                                          "source": "routes.json (needs_bfla_audit set by the route mapper)"})
+        written.append(bid)
+    return written
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("out")
+    ap.add_argument("--config")
+    a = ap.parse_args()
+    written = make_privilege_batches(Path(a.out), load_config(a.config))
+    print(f"new privilege batches: {len(written)}" + (f" ({', '.join(written)})" if written else ""))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/assess/lsa/scripts/make_verify_batches.py

@@ -20,7 +20,8 @@ from merge_findings import extract_json  # noqa: E402
 
 EXT_LANG = {".php": "php", ".inc": "php", ".java": "java", ".jsp": "java", ".xml": "java", ".cs": "cs", ".vb": "vb",
             ".aspx": "aspx", ".ashx": "cs", ".asmx": "cs", ".asp": "vb", ".pl": "perl", ".cgi": "perl", ".pm": "perl",
-            ".cfm": "cfml", ".cfc": "cfml", ".js": "js", ".py": "python", ".rb": "ruby", ".kt": "java"}
+            ".cfm": "cfml", ".cfc": "cfml", ".js": "js", ".mjs": "js", ".cjs": "js", ".ts": "js", ".tsx": "js",
+            ".jsx": "js", ".py": "python", ".rb": "ruby", ".kt": "java"}
 
 
 def ext_lang(path: str) -> str:
@@ -35,7 +36,7 @@ def main() -> int:
     out = Path(a.out)
     findings = []
     for p in sorted((out / "findings").glob("*.json")):
-        if p.name.startswith(("bola-", "inj-")):
+        if p.name.startswith(("bola-", "inj-", "priv-")):
             findings += extract_json(p).get("findings", [])
     # keep findings on the same file together, highest severity first
     order = {"critical": 0, "high": 1, "medium": 2, "low": 3, "info": 4}

package/assess/lsa/scripts/privilege.py

@@ -42,6 +42,9 @@ SENSITIVE_WRITE_RES = [
     re.compile(r"(?i)\bupdate\s+[`\"\[]?(?:\w+\.)?(users?|accounts?|members?)[`\"\]]?\s+set\b[^;\n]{0,120}?"
                r"\b(?:role|is_?admin|admin|permissions?|privileges?|level|user_?type)\s*="),
     re.compile(r"(?i)\bupdate\s+[`\"\[]?(?:\w+\.)?(roles?|permissions?|settings|config)\b"),
+    # ORM writes: Drizzle db.update(users) / db.delete(roles) / db.insert(userRoles), Prisma prisma.user.update(...)
+    re.compile(r"\.(?:update|delete|insert)\s*\(\s*(?:\w+\.)?(users?|accounts?|members?|roles?|permissions?|user_?[Rr]oles?)\s*\)"),
+    re.compile(r"\bprisma\.(users?|accounts?|members?|roles?|permissions?|userRoles?)\.(?:update|updateMany|upsert|delete|deleteMany|create|createMany)\s*\("),
 ]
 
 ROLE_CHECK_RE = re.compile("|".join([
@@ -55,6 +58,7 @@ ROLE_CHECK_RE = re.compile("|".join([
     r"\$_SESSION\s*\[\s*['\"](?:role|is_?admin|admin|user_?role|level|privilege)['\"]\s*\]",
     r"Session\s*[\(\[]\s*\"(?:role|isadmin|is_admin|admin|level)\"|session\.(?:role|isadmin|is_admin|admin)\b",
     r"\$session->param\s*\(\s*['\"](?:role|admin)",
+    r"\bpermission\s*:\s*['\"][\w.:-]+['\"]|\bcan\s*\(\s*[\w.]+\s*,\s*['\"]|\b(?:require|has)(?:Permission|Role)\s*\(",
     r"(?:include|require)(?:_once)?\s*\(?\s*['\"](?:[^'\"]*/)?[^/'\"]*(?:admin|role|perm|acl)[^/'\"]*['\"]",
 ]), re.I)
 

package/assess/lsa/tests/test_privilege_followup.py

@@ -0,0 +1,138 @@
+#!/usr/bin/env python3
+"""Privilege work after route mapping, verification of privilege findings, modern BFLA hints (Issue #331)."""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+SCRIPTS = HERE.parent / "scripts"
+sys.path.insert(0, str(SCRIPTS))
+
+from lsa_common import load_config, read_json, write_json  # noqa: E402
+from make_privilege_batches import make_privilege_batches  # noqa: E402
+from privilege import annotate_privilege  # noqa: E402
+
+
+def _mapped(rid: str, rel: str, bfla: bool) -> dict:
+    return {"route_id": rid, "method": ["POST"], "path": "/api/" + rid.lower(),
+            "handler": {"file": rel, "line": 3, "symbol": "POST"}, "id_inputs": [], "guards": [], "data_ops": [],
+            "needs_bola_audit": False, "needs_bfla_audit": bfla, "privilege": "privileged" if bfla else "user", "notes": ""}
+
+
+def _finding(fid: str, rel: str, category: str) -> dict:
+    return {"id": fid, "category": category, "severity": "high", "location": {"file": rel, "start_line": 3}}
+
+
+class TestMakePrivilegeBatches(unittest.TestCase):
+    def setUp(self) -> None:
+        tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(tmp.cleanup)
+        self.out = Path(tmp.name)
+        self.config = load_config(None)
+        write_json(self.out / "stack-profile.json", {"stacks": [{"id": "node-nextjs"}],
+                                                     "knowledge_files": ["knowledge/stacks/nextjs.md"]})
+        write_json(self.out / "routes.json", {"routes": [
+            _mapped("R-0001", "src/app/api/a/route.ts", True),
+            _mapped("R-0002", "src/app/api/b/route.ts", True),
+            _mapped("R-0003", "src/app/api/c/route.ts", True),
+            _mapped("R-0004", "src/app/api/d/route.ts", False),
+            _mapped("R-0005", "src/app/api/e/route.ts", True),
+        ]})
+        write_json(self.out / "batches" / "privilege-001.json",
+                   {"batch_id": "privilege-001", "files": [], "routes": [{"route_id": "R-0001"}], "mass_candidates": []})
+        (self.out / "findings").mkdir()
+        write_json(self.out / "findings" / "priv-privilege-001.json",
+                   {"batch_id": "privilege-001", "privilege_route_verdicts": [{"route_id": "R-0005", "verdict": "safe"}]})
+
+    def test_new_batch_for_uncovered_routes_only(self) -> None:
+        self.assertEqual(make_privilege_batches(self.out, self.config), ["privilege-002"])
+        b = read_json(self.out / "batches" / "privilege-002.json")
+        self.assertEqual([r["route_id"] for r in b["routes"]], ["R-0002", "R-0003"])
+        self.assertEqual(b["files"], ["src/app/api/b/route.ts", "src/app/api/c/route.ts"])
+        self.assertIn("knowledge/bfla-patterns.md", b["knowledge_files"])
+        self.assertIn("knowledge/stacks/nextjs.md", b["knowledge_files"])
+        self.assertEqual(b["mass_candidates"], [])
+
+    def test_second_run_writes_nothing(self) -> None:
+        make_privilege_batches(self.out, self.config)
+        self.assertEqual(make_privilege_batches(self.out, self.config), [])
+        self.assertFalse((self.out / "batches" / "privilege-003.json").exists())
+
+    def test_batch_size_limit(self) -> None:
+        cfg = load_config(None)
+        cfg["batch"]["max_privilege_items"] = 1
+        self.assertEqual(make_privilege_batches(self.out, cfg), ["privilege-002", "privilege-003"])
+
+    def test_no_routes_json(self) -> None:
+        (self.out / "routes.json").unlink()
+        self.assertEqual(make_privilege_batches(self.out, self.config), [])
+
+
+class TestVerifyBatchesIncludePrivilege(unittest.TestCase):
+    def test_priv_findings_are_batched_with_stack_knowledge(self) -> None:
+        with tempfile.TemporaryDirectory() as td:
+            out = Path(td)
+            write_json(out / "findings" / "bola-routes-001.json",
+                       {"findings": [_finding("F-1", "src/app/api/x/route.ts", "bola")]})
+            write_json(out / "findings" / "priv-privilege-001.json",
+                       {"findings": [_finding("F-2", "src/app/api/users/route.ts", "bfla")]})
+            res = subprocess.run([sys.executable, str(SCRIPTS / "make_verify_batches.py"), str(out)],
+                                 capture_output=True, text=True)
+            self.assertEqual(res.returncode, 0, res.stderr)
+            b = read_json(out / "batches" / "verify-001.json")
+            self.assertEqual(sorted(f["id"] for f in b["findings"]), ["F-1", "F-2"])
+            self.assertIn("knowledge/stacks/node-python-ruby.md", b["knowledge_files"])
+
+
+class TestModernRoleChecks(unittest.TestCase):
+    def _annotate(self, rel: str, code: str, path: str, line: int = 2) -> dict:
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            (root / rel).parent.mkdir(parents=True, exist_ok=True)
+            (root / rel).write_text(code, encoding="utf-8")
+            route = {"route_id": "R-0001", "path": path, "method": ["GET"],
+                     "handler": {"file": rel, "line": line, "symbol": "GET"}}
+            return annotate_privilege([route], root, load_config(None))[0]
+
+    def test_permission_option_is_a_role_check(self) -> None:
+        r = self._annotate("src/app/api/activity/export/route.ts",
+                           'import { withAuth } from "@/lib/auth/guard";\n'
+                           "export const GET = withAuth(\n"
+                           "  async () => exportCsv(),\n"
+                           '  { permission: "activity.view" },\n'
+                           ");\n", "/api/activity/export")
+        self.assertEqual(r["privilege_hint"], "privileged")
+        self.assertTrue(r["role_checks"])
+        self.assertFalse(any(s["signal"] == "no_role_check" for s in r["bfla_signals"]))
+
+    def test_can_call_is_a_role_check(self) -> None:
+        r = self._annotate("src/app/api/export/route.ts",
+                           "export async function GET() {\n"
+                           '  if (!can(actor, "activity.view")) return forbidden();\n'
+                           "}\n", "/api/export", line=1)
+        self.assertTrue(r["role_checks"])
+
+    def test_orm_write_to_users_is_privileged(self) -> None:
+        r = self._annotate("src/app/api/x/route.ts",
+                           "export async function PATCH(req) {\n"
+                           "  await db.update(users).set({ role: body.role }).where(eq(users.id, id));\n"
+                           "}\n", "/api/x", line=1)
+        self.assertEqual(r["privilege_hint"], "privileged")
+        self.assertIn("write:users", r["privilege_reasons"])
+        self.assertTrue(any(s["signal"] == "no_role_check" for s in r["bfla_signals"]))
+
+    def test_prisma_write_to_role_is_privileged(self) -> None:
+        r = self._annotate("api/role.js",
+                           "async function handler(req, res) {\n"
+                           "  await prisma.role.update({ where: { id }, data });\n"
+                           "}\n", "/api/x", line=1)
+        self.assertIn("write:role", r["privilege_reasons"])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/operate/cli/__init__.py

@@ -2,4 +2,4 @@
 
 from __future__ import annotations
 
-__version__ = "2.1.0"  # x-release-please-version
+__version__ = "2.1.1"  # x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hoanghainh/komagu",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Security-First Legacy Modernization Platform CLI (LSA Kit, IAM Perimeter, Cross-User Testing)",
   "main": "remediate/authz/nodejs/src/index.js",
   "types": "remediate/authz/nodejs/src/index.d.ts",