@hoanghainh/komagu 1.7.0 → 2.0.0

package/operate/remediator/runner.py

@@ -191,10 +191,6 @@ class RemediationRunner:
             self.target_dir / "out" / "findings.json",
             self.target_dir / ".komagu-devsecops" / "sca.sarif",
             self.target_dir / ".komagu-devsecops" / "komagu-devsecops.sarif",
-            # Pre-rename output locations (#290)
-            self.target_dir / "komainu-out" / "findings.json",
-            self.target_dir / ".komainu-devsecops" / "sca.sarif",
-            self.target_dir / ".komainu-devsecops" / "komainu-devsecops.sarif",
         ]
         for candidate in candidates:
             if candidate.is_file():
@@ -236,7 +232,7 @@ class RemediationRunner:
                     rule_upper = rule_id.upper()
 
                     if (
-                        rule_upper.startswith(("CVE-", "GHSA-", "OSV-", "KOMAINU-SCA-", "DEP-"))
+                        rule_upper.startswith(("CVE-", "GHSA-", "OSV-", "KOMAGU-SCA-", "DEP-"))
                         or base_name in self.MANIFEST_FILENAMES
                         or base_name.endswith(".csproj")
                         or any(k in driver_name for k in ("trivy", "sca", "dependency", "osv", "pip-audit", "govulncheck"))

package/operate/remediator/strategies.py

@@ -139,7 +139,7 @@ class DependencyVulnerabilityRemediationStrategy(BaseRemediationStrategy):
             return True
         if any(code in cwe for code in ("CWE-1395", "CWE-1104", "CWE-937")):
             return True
-        if finding_id.startswith(("CVE-", "GHSA-", "OSV-", "KOMAINU-SCA-", "DEP-")):
+        if finding_id.startswith(("CVE-", "GHSA-", "OSV-", "KOMAGU-SCA-", "DEP-")):
             return True
         if base_name in self.MANIFEST_FILES or base_name.endswith(".csproj"):
             return True

package/operate/tests/test_cli_baseline.py

@@ -58,7 +58,7 @@ class TestScanBaseline(unittest.TestCase):
     def test_default_scan_adds_fingerprint_and_passes(self) -> None:
         res = self.scan()
         self.assertEqual(res.returncode, 0, res.stderr + res.stdout)
-        self.assertTrue(self.sarif_result()["partialFingerprints"]["komainu/v1"].startswith("kfp1:"))
+        self.assertTrue(self.sarif_result()["partialFingerprints"]["komagu/v1"].startswith("kfp1:"))
 
     def test_fail_on_new_without_baseline_fails(self) -> None:
         res = self.scan("--fail-on", "new")
@@ -117,14 +117,6 @@ class TestScanSuppressions(unittest.TestCase):
         sarif = json.loads((self.out / "findings.sarif").read_text(encoding="utf-8"))
         self.assertEqual(sarif["runs"][0]["results"][0]["suppressions"][0]["status"], "accepted")
 
-    def test_legacy_komainu_suppressions_dir_still_used(self) -> None:
-        self.write_suppressions(self.target / ".komainu" / "suppressions.json", "2999-12-31")
-        res = self.scan("--fail-on", "new")
-        self.assertEqual(res.returncode, 0, res.stderr + res.stdout)
-        self.assertIn(".komainu/suppressions.json is deprecated", res.stderr)
-        sarif = json.loads((self.out / "findings.sarif").read_text(encoding="utf-8"))
-        self.assertEqual(sarif["runs"][0]["results"][0]["suppressions"][0]["status"], "accepted")
-
     def test_expired_explicit_suppression_fails_gate_and_warns(self) -> None:
         path = self.out.parent / "suppressions.json"
         self.write_suppressions(path, "2020-01-01")

package/operate/tests/test_cli_env.py

@@ -1,44 +1,23 @@
 #!/usr/bin/env python3
-"""KOMAGU_* environment variables with the deprecated KOMAINU_* fallback (#290)."""
+"""KOMAGU_* environment variables; the pre-rename KOMAINU_* names are no longer read (#312)."""
 
 from __future__ import annotations
 
-import contextlib
-import io
 import unittest
 
 from operate.cli import env as cli_env
 
 
 class TestGetenv(unittest.TestCase):
-    def setUp(self) -> None:
-        cli_env._warned.clear()
-
-    def lookup(self, environ, default=None):
-        stderr = io.StringIO()
-        with contextlib.redirect_stderr(stderr):
-            value = cli_env.getenv("AI_MODEL", default, env=environ)
-        return value, stderr.getvalue()
-
-    def test_new_name_wins_without_warning(self) -> None:
-        value, err = self.lookup({"KOMAGU_AI_MODEL": "new", "KOMAINU_AI_MODEL": "old"})
-        self.assertEqual(value, "new")
-        self.assertEqual(err, "")
-
-    def test_legacy_name_is_read_with_warning(self) -> None:
-        value, err = self.lookup({"KOMAINU_AI_MODEL": "old"})
-        self.assertEqual(value, "old")
-        self.assertIn("KOMAINU_AI_MODEL is deprecated, set KOMAGU_AI_MODEL", err)
-
-    def test_legacy_warning_is_printed_once(self) -> None:
-        self.lookup({"KOMAINU_AI_MODEL": "old"})
-        _, err = self.lookup({"KOMAINU_AI_MODEL": "old"})
-        self.assertEqual(err, "")
+    def test_reads_komagu_name(self) -> None:
+        self.assertEqual(cli_env.getenv("AI_MODEL", env={"KOMAGU_AI_MODEL": "new"}), "new")
+
+    def test_legacy_name_is_ignored(self) -> None:
+        self.assertEqual(cli_env.getenv("AI_MODEL", "llama3.1", env={"KOMAINU_AI_MODEL": "old"}), "llama3.1")
 
     def test_default_when_unset(self) -> None:
-        value, err = self.lookup({}, default="llama3.1")
-        self.assertEqual(value, "llama3.1")
-        self.assertEqual(err, "")
+        self.assertEqual(cli_env.getenv("AI_MODEL", "llama3.1", env={}), "llama3.1")
+        self.assertIsNone(cli_env.getenv("AI_MODEL", env={}))
 
 
 if __name__ == "__main__":

package/operate/tests/test_cross_user_pipeline.py

@@ -208,7 +208,7 @@ class TestCrossUserPipeline(unittest.TestCase):
 
         # Check BOLA result mapping
         bola_res = run["results"][0]
-        self.assertEqual(bola_res["ruleId"], "KOMAINU-BOLA-CWE639")
+        self.assertEqual(bola_res["ruleId"], "KOMAGU-BOLA-CWE639")
         self.assertEqual(bola_res["level"], "error")
         loc = bola_res["locations"][0]["physicalLocation"]
         self.assertEqual(loc["artifactLocation"]["uri"], "legacy/orders.php")
@@ -217,7 +217,7 @@ class TestCrossUserPipeline(unittest.TestCase):
 
         # Check SQLi result mapping
         sqli_res = run["results"][1]
-        self.assertEqual(sqli_res["ruleId"], "KOMAINU-INJ-CWE89")
+        self.assertEqual(sqli_res["ruleId"], "KOMAGU-INJ-CWE89")
         self.assertEqual(sqli_res["level"], "error")
 
     def test_sarif_cli_execution(self) -> None:

package/operate/tests/test_exploit_and_virtual_patch.py

@@ -111,9 +111,9 @@ class TestExploitAndVirtualPatcher(unittest.TestCase):
             self.assertIn("SecRule REQUEST_URI", conf_content)
             self.assertIn("id:1100001", conf_content)
             self.assertIn("id:1100002", conf_content)
-            self.assertIn("tag:'komainu-virtual-patch'", conf_content)
-            self.assertIn("tag:'komainu-bola'", conf_content)
-            self.assertIn("tag:'komainu-sqli'", conf_content)
+            self.assertIn("tag:'komagu-virtual-patch'", conf_content)
+            self.assertIn("tag:'komagu-bola'", conf_content)
+            self.assertIn("tag:'komagu-sqli'", conf_content)
 
     def test_cli_protect_with_virtual_patch(self) -> None:
         """komagu protect --virtual-patch must synthesize rules via CLI."""

package/operate/tests/test_npm_package.py

@@ -14,7 +14,6 @@ from pathlib import Path
 REPO_ROOT = Path(__file__).resolve().parents[2]
 PACKAGE_JSON = REPO_ROOT / "package.json"
 BIN_KOMAGU_JS = REPO_ROOT / "bin" / "komagu.js"
-BIN_LEGACY_JS = REPO_ROOT / "bin" / "komainu-legacy.js"
 WORKFLOW_FILE = REPO_ROOT / ".github" / "workflows" / "npm-publish.yml"
 RELEASE_PLEASE_WORKFLOW = REPO_ROOT / ".github" / "workflows" / "release-please.yml"
 RELEASE_PLEASE_CONFIG = REPO_ROOT / "release-please-config.json"
@@ -35,9 +34,8 @@ class TestNPMPackage(unittest.TestCase):
         self.assertEqual(data.get("publishConfig", {}).get("access"), "public")
         self.assertIn("version", data)
         self.assertEqual(data.get("bin", {}).get("komagu"), "bin/komagu.js")
-        # Deprecated pre-rename aliases (#290)
-        self.assertEqual(data.get("bin", {}).get("komainu"), "bin/komainu-legacy.js")
-        self.assertEqual(data.get("bin", {}).get("komainu-guard"), "bin/komainu-legacy.js")
+        # Pre-rename aliases were removed in 2.0 (#312)
+        self.assertEqual(set(data.get("bin", {})), {"komagu"})
         self.assertEqual(data.get("license"), "Apache-2.0")
 
         # Whitelisted files must include platform modules
@@ -72,18 +70,6 @@ class TestNPMPackage(unittest.TestCase):
         self.assertIn("test", res_h.stdout)
         self.assertIn("demo", res_h.stdout)
 
-    def test_legacy_bin_alias_warns_and_delegates(self) -> None:
-        """Deprecated komainu / komainu-guard bins must print a rename notice and still run (#290)."""
-        node_bin = shutil.which("node")
-        if not node_bin:
-            self.skipTest("Node.js runtime not installed on host")
-
-        self.assertTrue(BIN_LEGACY_JS.stat().st_mode & 0o111 != 0, "bin/komainu-legacy.js is not executable")
-        res = subprocess.run([node_bin, str(BIN_LEGACY_JS), "--version"], capture_output=True, text=True)
-        self.assertEqual(res.returncode, 0, res.stderr)
-        self.assertIn("komagu v", res.stdout)
-        self.assertIn("renamed to `komagu`", res.stderr)
-
     def test_node_launcher_error_on_missing_python(self) -> None:
         """Launcher must show friendly error with Docker fallback if Python is missing."""
         node_bin = shutil.which("node")

package/operate/tests/test_sarif_from_scan.py

@@ -0,0 +1,156 @@
+#!/usr/bin/env python3
+"""SARIF input for BFLA and mass assignment in `komagu test --from-scan` and `--export-poc` (#289)."""
+
+from __future__ import annotations
+
+import copy
+import importlib.util
+import io
+import json
+import os
+import sys
+import tempfile
+import unittest
+from contextlib import redirect_stdout
+from pathlib import Path
+from unittest import mock
+
+PROJECT_ROOT = Path(__file__).resolve().parents[2]
+if str(PROJECT_ROOT) not in sys.path:
+    sys.path.insert(0, str(PROJECT_ROOT))
+
+from operate.cli.main import main as cli_main  # noqa: E402
+from operate.cross_user_tester.mock_test_server import start_mock_server  # noqa: E402
+from operate.cross_user_tester.persona_matrix import generate_matrix_cases_from_findings  # noqa: E402
+from operate.exploit.generator import ExploitGenerator  # noqa: E402
+from operate.lsa_sarif.lsa_to_sarif import convert_findings_to_sarif  # noqa: E402
+from operate.lsa_sarif.sarif_findings import findings_from_sarif  # noqa: E402
+
+_spec = importlib.util.spec_from_file_location(
+    "lsa_findings_to_sarif", PROJECT_ROOT / "assess" / "lsa" / "scripts" / "findings_to_sarif.py"
+)
+assert _spec and _spec.loader
+lsa_findings_to_sarif = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(lsa_findings_to_sarif)
+
+ENV = {"T_USER": "user-secret-token"}
+
+FINDINGS = {
+    "findings": [
+        {"finding_id": "BFLA-R-0001-1", "category": "bfla", "title": "Any user deletes accounts",
+         "location": {"file": "app.py", "line": 10},
+         "endpoint": {"method": "DELETE", "path": "/api/admin/users/{id}"}, "status": "confirmed",
+         "consensus": {"score": 0.9}},
+        {"finding_id": "MASS-M-0001-1", "category": "mass_assignment", "title": "Profile binds body",
+         "location": {"file": "app.py", "line": 20},
+         "endpoint": {"method": "PUT", "path": "/api/profile"},
+         "attack_vector": {"fields": {"role": "admin"}, "readback": "GET /api/profile",
+                           "suggested_payload": "{\"role\": \"admin\"}"},
+         "status": "unverified", "consensus": {"score": 0.6}},
+        {"finding_id": "BFLA-R-0002-1", "category": "bfla", "title": "Rejected one",
+         "location": {"file": "app.py", "line": 30},
+         "endpoint": {"method": "DELETE", "path": "/api/x"}, "status": "rejected"},
+        {"finding_id": "BOLA-R-0003-1", "category": "bola", "title": "Not ours",
+         "location": {"file": "app.py", "line": 40},
+         "endpoint": {"method": "GET", "path": "/api/orders/{id}"}},
+    ]
+}
+
+
+def case_key(c):
+    return (c.kind, c.finding_id, c.method, c.path, c.probe_fields, c.readback)
+
+
+def sarif_from_assess(doc):
+    return lsa_findings_to_sarif.to_sarif(copy.deepcopy(doc), include_rejected=True)
+
+
+def sarif_from_operate(doc):
+    return convert_findings_to_sarif(copy.deepcopy(doc["findings"]))
+
+
+class TestSarifMatrixCases(unittest.TestCase):
+    def test_both_exporters_give_the_same_cases_as_findings_json(self):
+        expected = [case_key(c) for c in generate_matrix_cases_from_findings(FINDINGS, "T_USER", default_id="7")]
+        self.assertEqual([k[1] for k in expected], ["BFLA-R-0001-1", "MASS-M-0001-1"])
+        for export in (sarif_from_assess, sarif_from_operate):
+            with self.subTest(exporter=export.__name__):
+                cases = generate_matrix_cases_from_findings(export(FINDINGS), "T_USER", default_id="7")
+                self.assertEqual([case_key(c) for c in cases], expected)
+
+    def test_min_consensus_applies_to_sarif(self):
+        cases = generate_matrix_cases_from_findings(sarif_from_assess(FINDINGS), "T_USER", min_consensus=0.8)
+        self.assertEqual([c.finding_id for c in cases], ["BFLA-R-0001-1"])
+
+    def test_suggested_payload_is_not_written_to_sarif(self):
+        text = json.dumps(sarif_from_assess(FINDINGS)) + json.dumps(sarif_from_operate(FINDINGS))
+        self.assertNotIn("suggested_payload", text)
+
+    def test_sarif_without_replay_properties_falls_back_to_rule_and_message(self):
+        sarif = sarif_from_assess(FINDINGS)
+        for result in sarif["runs"][0]["results"]:
+            for key in ("finding_id", "category", "endpoint", "attack_vector", "consensus_score"):
+                result["properties"].pop(key, None)
+        findings = {f["finding_id"]: f for f in findings_from_sarif(sarif)}
+        self.assertEqual(findings["BFLA-R-0001-1"]["category"], "bfla")
+        self.assertEqual(findings["BFLA-R-0001-1"]["endpoint"], {"method": "DELETE", "path": "/api/admin/users/{id}"})
+        cases = generate_matrix_cases_from_findings(sarif, "T_USER", default_id="7")
+        mass = next(c for c in cases if c.kind == "mass_assignment")
+        self.assertIn("role", mass.probe_fields)  # default probe fields without attack_vector
+        self.assertEqual(mass.readback, ("GET", "/api/profile"))
+
+    def test_owasp_tag_identifies_category_when_rule_id_does_not(self):
+        sarif = sarif_from_assess(FINDINGS)
+        run = sarif["runs"][0]
+        renamed = {}
+        for i, rule in enumerate(run["tool"]["driver"]["rules"]):
+            renamed[rule["id"]] = f"custom-{i}"
+            rule["id"] = f"custom-{i}"
+        for result in run["results"]:
+            result["ruleId"] = renamed[result["ruleId"]]
+            result["properties"].pop("category", None)
+        kinds = {f["finding_id"]: f["category"] for f in findings_from_sarif(sarif)}
+        self.assertEqual(kinds["BFLA-R-0001-1"], "bfla")
+        self.assertEqual(kinds["MASS-M-0001-1"], "mass_assignment")
+
+
+class TestSarifPocExport(unittest.TestCase):
+    def test_pocs_from_sarif_match_findings_json(self):
+        gen = ExploitGenerator(base_url="http://127.0.0.1:1", default_resource_id="7")
+        expected = {a.finding_id: (a.category, a.method, a.target_path) for a in gen.generate_from_findings_data(FINDINGS)}
+        for export in (sarif_from_assess, sarif_from_operate):
+            with self.subTest(exporter=export.__name__):
+                arts = {a.finding_id: a for a in gen.generate_from_findings_data(export(FINDINGS))}
+                self.assertEqual({k: (a.category, a.method, a.target_path) for k, a in arts.items()}, expected)
+                self.assertIn('"role": "admin"', arts["MASS-M-0001-1"].python_script)
+                self.assertNotIn("BFLA-R-0002-1", arts)
+
+
+class TestCliFromScanSarif(unittest.TestCase):
+    def setUp(self):
+        self.server, _, self.base_url = start_mock_server(port=0)
+        self.tmp = tempfile.TemporaryDirectory()
+        self.dir = Path(self.tmp.name)
+
+    def tearDown(self):
+        self.server.shutdown()
+        self.server.server_close()
+        self.tmp.cleanup()
+
+    def test_from_scan_sarif_runs_bfla_and_mass_cases(self):
+        scan = self.dir / "findings.sarif"
+        scan.write_text(json.dumps(sarif_from_assess(FINDINGS)), encoding="utf-8")
+        out = self.dir / "res.json"
+        buf = io.StringIO()
+        with mock.patch.dict(os.environ, ENV), redirect_stdout(buf):
+            code = cli_main(["test", "--url", self.base_url, "--from-scan", str(scan),
+                             "--token-env", "T_USER", "--resource-id", "7", "--output", str(out)])
+        self.assertEqual(code, 1)
+        report = json.loads(out.read_text(encoding="utf-8"))
+        ids = {r["finding_id"] for r in report["matrix_results"] if r["is_breach"]}
+        self.assertEqual(ids, {"BFLA-R-0001-1", "MASS-M-0001-1"})
+        self.assertNotIn(ENV["T_USER"], out.read_text(encoding="utf-8") + buf.getvalue())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/package.json

@@ -1,13 +1,11 @@
 {
   "name": "@hoanghainh/komagu",
-  "version": "1.7.0",
+  "version": "2.0.0",
   "description": "Security-First Legacy Modernization Platform CLI (LSA Kit, IAM Perimeter, Cross-User Testing)",
   "main": "remediate/authz/nodejs/src/index.js",
   "types": "remediate/authz/nodejs/src/index.d.ts",
   "bin": {
-    "komagu": "bin/komagu.js",
-    "komainu": "bin/komainu-legacy.js",
-    "komainu-guard": "bin/komainu-legacy.js"
+    "komagu": "bin/komagu.js"
   },
   "files": [
     "bin/",

package/remediate/authz/README.md

@@ -16,7 +16,7 @@ All implementations strictly enforce these architectural guarantees:
    - **Imperative (Programmatic):** Explicit service calls (`AuthorizeAsync` / `requireOwnership`) for complex business workflows and multi-condition rules.
    - **Declarative (Metadata/Attribute/Annotation):** Endpoint filter (`[RequireOwnership]`) or AOP Aspect (`@RequireOwnership`) for clean, declarative controller boundaries.
 4. **Scoped Data-Access Helpers:** Query pipeline extensions (EF Core `WithUserScope`, Spring Data `ScopedRepository`) automatically appending tenant and owner constraints to SQL queries before execution.
-5. **Structured Security Audit Logging:** Every denial emits a structured event (`Komainu.Authorization.Denied`) with `actorUserId`, `actorTenantId`, `resourceType`, `resourceId`, and failure rationale for SIEM and security monitoring.
+5. **Structured Security Audit Logging:** Every denial emits a structured event (`Komagu.Authorization.Denied`) with `actorUserId`, `actorTenantId`, `resourceType`, `resourceId`, and failure rationale for SIEM and security monitoring.
 
 ---
 

package/remediate/authz/dotnet/src/Komagu.Security.Authorization/DefaultKomaguAuthorizationService.cs

@@ -220,7 +220,7 @@ public sealed class DefaultKomaguAuthorizationService : IKomaguAuthorizationServ
             var auditEvent = new SecurityAuditEvent
             {
                 Timestamp = DateTimeOffset.UtcNow,
-                EventName = "Komainu.Authorization.Denied",
+                EventName = "Komagu.Authorization.Denied",
                 ActorUserId = actorUserId,
                 ActorTenantId = actorTenantId,
                 ResourceType = typeof(T).Name,

package/remediate/authz/dotnet/src/Komagu.Security.Authorization/SecurityAuditEvent.cs

@@ -11,9 +11,9 @@ public record SecurityAuditEvent
     public DateTimeOffset Timestamp { get; init; } = DateTimeOffset.UtcNow;
 
     /// <summary>
-    /// Event name or category. Kept as "Komainu.*" after the rename so existing SIEM rules still match (#290).
+    /// Event name or category.
     /// </summary>
-    public string EventName { get; init; } = "Komainu.Authorization.Denied";
+    public string EventName { get; init; } = "Komagu.Authorization.Denied";
 
     /// <summary>
     /// Distributed tracing identifier (W3C traceparent or correlation ID).

package/remediate/authz/golang/authz.go

@@ -210,7 +210,7 @@ func (a *Authorizer) emitDenial(userId, tenantId string, resource IOwnedResource
 
 	a.Sink.Emit(SecurityAuditEvent{
 		Timestamp:     time.Now().UTC(),
-		EventName:     "Komainu.Authorization.Denied",
+		EventName:     "Komagu.Authorization.Denied",
 		ActorUserID:   userId,
 		ActorTenantID: tenantId,
 		ResourceType:  resType,

package/remediate/authz/nodejs/src/service.js

@@ -140,7 +140,7 @@ class KomaguSecurityService {
 
       const event = {
         timestamp: new Date().toISOString(),
-        eventName: 'Komainu.Authorization.Denied',
+        eventName: 'Komagu.Authorization.Denied',
         actorUserId: actorUserId || undefined,
         actorTenantId: actorTenantId || undefined,
         resourceType: resource && resource.constructor ? resource.constructor.name : 'Object',

package/remediate/authz/nodejs/tests/test-authz.js

@@ -59,7 +59,7 @@ test('KomaguSecurityService: denies attacker with 404 and emits audit', async ()
   // Verify audit event
   assert.strictEqual(auditSink.events.length, 2); // 1 from authorize + 1 from requireOwnership
   const event = auditSink.events[0];
-  assert.strictEqual(event.eventName, 'Komainu.Authorization.Denied');
+  assert.strictEqual(event.eventName, 'Komagu.Authorization.Denied');
   assert.strictEqual(event.actorUserId, 'user-b');
   assert.strictEqual(event.actorTenantId, 'tenant-komagu');
   assert.strictEqual(event.resourceId, 'ord-01');

package/remediate/authz/patcher.py

@@ -85,10 +85,8 @@ class BOLAOwnershipPatcher:
     def ensure_imports(self, content: str, lang: str) -> Tuple[str, bool]:
         """Ensure necessary Komagu authorization import is present at the top of the file."""
         if lang in ("typescript", "javascript"):
-            # komainu-guard: package name before the rename (#290), already-patched files keep it
-            for pkg in ("@hoanghainh/komagu", "komainu-guard"):
-                if f"from '{pkg}'" in content or f'from "{pkg}"' in content:
-                    return content, False
+            if "from '@hoanghainh/komagu'" in content or 'from "@hoanghainh/komagu"' in content:
+                return content, False
             import_stmt = "import { RequireOwnership, OwnershipGuard, ResourceOperation } from '@hoanghainh/komagu';\n"
             return import_stmt + content, True
 
@@ -143,6 +141,7 @@ class BOLAOwnershipPatcher:
 
         # Check if guard is already present on or adjacent to this line
         surrounding = "".join(lines[max(0, idx - 3):min(len(lines), idx + 3)])
+        # [KOMAINU-FIX] is only read: nothing writes it since #216, but files patched before that still carry it (#312)
         if "RequireOwnership" in surrounding or "OwnershipGuard" in surrounding or "[KOMAINU-FIX]" in surrounding:
             return content, BOLARewriteResult(
                 original_line=target_line,

package/remediate/authz/python/komagu_authz/models.py

@@ -48,7 +48,7 @@ class AuthorizationResult:
 class SecurityAuditEvent:
     """Structured security audit event for authorization failures."""
     timestamp: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
-    event_name: str = "Komainu.Authorization.Denied"
+    event_name: str = "Komagu.Authorization.Denied"
     actor_user_id: Optional[str] = None
     actor_tenant_id: Optional[str] = None
     resource_type: str = "Unknown"
@@ -81,7 +81,7 @@ class ISecurityAuditSink(ABC):
 class LoggingSecurityAuditSink(ISecurityAuditSink):
     """Default logger-based audit sink emitting JSON to standard logging."""
 
-    def __init__(self, logger_name: str = "komainu.security.audit") -> None:
+    def __init__(self, logger_name: str = "komagu.security.audit") -> None:
         import logging
         self.logger = logging.getLogger(logger_name)
 

package/remediate/authz/python/tests/test_fastapi_adapter.py

@@ -67,7 +67,7 @@ class TestFastApiAdapter(unittest.TestCase):
         self.authz_service = KomaguAuthorizationService(audit_sink=self.audit_sink)
         self.validator = OidcTokenValidator(
             issuer="https://auth.komagu.test",
-            audience="komainu-api",
+            audience="komagu-api",
             allow_dev_tokens=True,
         )
 

package/remediate/authz/python/tests/test_fastapi_d5_crosstest.py

@@ -42,7 +42,7 @@ class MockFastApiServer(http.server.BaseHTTPRequestHandler):
     authz_service = KomaguAuthorizationService(audit_sink=InMemorySecurityAuditSink())
     validator = OidcTokenValidator(
         issuer="https://auth.komagu.test",
-        audience="komainu-api",
+        audience="komagu-api",
         allow_dev_tokens=True,
     )
 

package/remediate/authz/python/tests/test_python_authz.py

@@ -38,7 +38,7 @@ class TestPythonAuthz(unittest.TestCase):
         self.authz_service = KomaguAuthorizationService(audit_sink=self.audit_sink)
         self.validator = OidcTokenValidator(
             issuer="https://auth.komagu.test",
-            audience="komainu-api",
+            audience="komagu-api",
             allow_dev_tokens=True,
         )
 
@@ -77,7 +77,7 @@ class TestPythonAuthz(unittest.TestCase):
         self.assertEqual(len(self.audit_sink.events), 0)
 
     def test_02_attacker_same_tenant_denied_with_audit(self) -> None:
-        """Attacker Bob (same tenant) is denied access; emits Komainu.Authorization.Denied event."""
+        """Attacker Bob (same tenant) is denied access; emits Komagu.Authorization.Denied event."""
         result = self.authz_service.authorize(
             user=self.bob_attacker,
             resource=self.alice_order,
@@ -89,7 +89,7 @@ class TestPythonAuthz(unittest.TestCase):
         # Verify audit emission
         self.assertEqual(len(self.audit_sink.events), 1)
         event = self.audit_sink.events[0]
-        self.assertEqual(event.event_name, "Komainu.Authorization.Denied")
+        self.assertEqual(event.event_name, "Komagu.Authorization.Denied")
         self.assertEqual(event.actor_user_id, "user-b")
         self.assertEqual(event.actor_tenant_id, "tenant-komagu")
         self.assertEqual(event.resource_id, "ord-001")

package/remediate/authz/spring/src/main/kotlin/io/komagu/security/authorization/DefaultKomaguSecurityManager.kt

@@ -182,7 +182,7 @@ class DefaultKomaguSecurityManager(
 
             val auditEvent = SecurityAuditEvent(
                 timestamp = Instant.now(),
-                eventName = "Komainu.Authorization.Denied",
+                eventName = "Komagu.Authorization.Denied",
                 actorUserId = actorUserId,
                 actorTenantId = actorTenantId,
                 resourceType = resource?.let { it::class.java.simpleName } ?: "Unknown",

package/remediate/authz/spring/src/main/kotlin/io/komagu/security/authorization/SecurityAuditEvent.kt

@@ -7,8 +7,7 @@ import java.time.Instant
  */
 data class SecurityAuditEvent(
     val timestamp: Instant = Instant.now(),
-    // Kept as "Komainu.*" after the rename so existing SIEM rules still match (#290).
-    val eventName: String = "Komainu.Authorization.Denied",
+    val eventName: String = "Komagu.Authorization.Denied",
     val traceId: String? = null,
     val actorUserId: String? = null,
     val actorTenantId: String? = null,

package/remediate/authz/tests/test_bola_patcher.py

@@ -157,7 +157,7 @@ class TestBOLAOwnershipPatcher(unittest.TestCase):
         """If file already contains ownership guards, patcher must skip to prevent duplicates."""
         controller_file = self.test_dir / "protected_order.ts"
         controller_file.write_text(
-            "import { RequireOwnership } from 'komainu-guard';\n"
+            "import { RequireOwnership } from '@hoanghainh/komagu';\n"
             "export class OrderController {\n"
             "    @UseGuards(OwnershipGuard)\n"
             "    @RequireOwnership(ResourceOperation.READ)\n"

package/remediate/edge/coraza/rules/coraza-crs-custom.conf

@@ -1,6 +1,5 @@
 # ==============================================================================
 # Komagu Custom OWASP CRS v4 Tuning & Rule Exclusions
-# Rule tags stay 'komainu-*' after the rename so existing WAF log alerts still match (#290).
 # ==============================================================================
 
 # Enable JSON request body inspection for application/json Content-Type
@@ -33,7 +32,7 @@ SecRule ARGS|REQUEST_URI|REQUEST_HEADERS "@rx (?i)(?:(?:\bunion\b[\s\S]*?\bselec
    msg:'Komagu WAF: SQL Injection Attack Detected',\
    logdata:'Matched Data: %{TX.0}',\
    severity:'CRITICAL',\
-   tag:'komainu-sqli',\
+   tag:'komagu-sqli',\
    setvar:'tx.sql_injection_score=+5',\
    setvar:'tx.inbound_anomaly_score_exceeded=1'"
 
@@ -48,7 +47,7 @@ SecRule ARGS|REQUEST_URI "@rx (?i)(?:<script[^>]*>|javascript:[^\"']*|onerror\s*
    msg:'Komagu WAF: Cross-Site Scripting (XSS) Attack Detected',\
    logdata:'Matched Data: %{TX.0}',\
    severity:'CRITICAL',\
-   tag:'komainu-xss',\
+   tag:'komagu-xss',\
    setvar:'tx.xss_score=+5',\
    setvar:'tx.inbound_anomaly_score_exceeded=1'"
 
@@ -62,4 +61,4 @@ SecRule REQUEST_URI|ARGS "@rx (?i)(?:\.\./|\.\.\\)" \
    msg:'Komagu WAF: Path Traversal Attack Detected',\
    logdata:'Matched Data: %{TX.0}',\
    severity:'CRITICAL',\
-   tag:'komainu-path-traversal'"
+   tag:'komagu-path-traversal'"

package/remediate/edge/coraza/virtual_patcher.py

@@ -3,8 +3,6 @@
 
 Translates confirmed LSA findings (BOLA & SQLi) into deterministic,
 production-ready SecRule configurations for instant Day-2 edge protection.
-
-Rule tags stay 'komainu-*' after the rename so existing WAF log alerts still match (#290).
 """
 
 from __future__ import annotations
@@ -74,8 +72,8 @@ SecRule REQUEST_URI "@rx {path_regex}" \\
    msg:'Komagu Virtual Patch: SQL Injection blocked on {path}',\\
    logdata:'Matched Data: %{{TX.0}}',\\
    severity:'CRITICAL',\\
-   tag:'komainu-virtual-patch',\\
-   tag:'komainu-sqli',\\
+   tag:'komagu-virtual-patch',\\
+   tag:'komagu-sqli',\\
    tag:'{finding_id}',\\
    setvar:'tx.sql_injection_score=+5',\\
    setvar:'tx.inbound_anomaly_score_exceeded=1',\\
@@ -115,8 +113,8 @@ SecRule REQUEST_URI "@rx {path_regex}" \\
    t:urlDecodeUni,\\
    msg:'Komagu Virtual Patch: Missing Authorization Token on BOLA Endpoint {path}',\\
    severity:'CRITICAL',\\
-   tag:'komainu-virtual-patch',\\
-   tag:'komainu-bola',\\
+   tag:'komagu-virtual-patch',\\
+   tag:'komagu-bola',\\
    tag:'{finding_id}',\\
    chain"
   SecRule &REQUEST_HEADERS:Authorization "@eq 0"

package/remediate/edge/docker-compose.yml

@@ -11,7 +11,7 @@ services:
       KONG_PROXY_ERROR_LOG: /dev/stderr
       KONG_ADMIN_ERROR_LOG: /dev/stderr
       KONG_ADMIN_LISTEN: 0.0.0.0:8001
-      KOMAGU_JWT_SECRET: ${KOMAGU_JWT_SECRET:-${KOMAINU_JWT_SECRET:-komagu-default-test-jwt-secret-key-32chars}}
+      KOMAGU_JWT_SECRET: ${KOMAGU_JWT_SECRET:-komagu-default-test-jwt-secret-key-32chars}
     volumes:
       - ./kong/kong.yaml:/kong/declarative/kong.yaml:ro
     ports:

package/remediate/ekyc/server/jpki_verifier.py

@@ -16,18 +16,12 @@ import os
 import secrets
 import threading
 import time
-import warnings
 from typing import Any, Callable, Dict, List, Optional, Tuple
 
 
 def _env(name: str, default: Optional[str] = None) -> Optional[str]:
-    """Read KOMAGU_<name>, falling back to the deprecated KOMAINU_<name> (#290)."""
-    value = os.environ.get("KOMAGU_" + name)
-    if value is None:
-        value = os.environ.get("KOMAINU_" + name)
-        if value is not None:
-            warnings.warn(f"KOMAINU_{name} is deprecated, set KOMAGU_{name} instead", DeprecationWarning, stacklevel=2)
-    return default if value is None else value
+    """Read KOMAGU_<name>."""
+    return os.environ.get("KOMAGU_" + name, default)
 
 
 try: