@hoanghainh/komagu 1.7.0 → 2.0.0

package/remediate/ekyc/server/tokenization.py

@@ -22,18 +22,12 @@ import re
 import secrets
 import sys
 import time
-import warnings
 from typing import Any, Dict, List, Optional, Set, Tuple
 
 
 def _env(name: str, default: Optional[str] = None) -> Optional[str]:
-    """Read KOMAGU_<name>, falling back to the deprecated KOMAINU_<name> (#290)."""
-    value = os.environ.get("KOMAGU_" + name)
-    if value is None:
-        value = os.environ.get("KOMAINU_" + name)
-        if value is not None:
-            warnings.warn(f"KOMAINU_{name} is deprecated, set KOMAGU_{name} instead", DeprecationWarning, stacklevel=2)
-    return default if value is None else value
+    """Read KOMAGU_<name>."""
+    return os.environ.get("KOMAGU_" + name, default)
 
 
 # Allowed fields in API requests under Zero-PII contract

package/remediate/identity/README.md

@@ -15,7 +15,7 @@ Every incoming request bearing an access token is validated against 5 mandatory
 | **Missing Token** | No `Authorization: Bearer <token>` header supplied. | **HTTP 401 Unauthorized** |
 | **Token Expiry** | Current timestamp > `exp` claim (`ClockSkew` enforced to 0s or strict delta). | **HTTP 401 Unauthorized** |
 | **Issuer Validation** | Token `iss` claim does not match configured trusted IdP authority. | **HTTP 401 Unauthorized** |
-| **Audience Validation** | Token `aud` claim does not include the target resource server ID (`komainu-api`). | **HTTP 401 Unauthorized** |
+| **Audience Validation** | Token `aud` claim does not include the target resource server ID (`komagu-api`). | **HTTP 401 Unauthorized** |
 | **Cryptographic Signature** | Token signed by untrusted key or payload tampered with. | **HTTP 401 Unauthorized** |
 
 ---
@@ -36,7 +36,7 @@ Keycloak starts at `http://localhost:8080` with the `komagu` realm pre-loaded:
 - **Realm Discovery URL:** `http://localhost:8080/realms/komagu/.well-known/openid-configuration`
 - **Clients:**
   - `komagu-portal`: Public SPA client (Standard Flow + PKCE enforced)
-  - `komainu-api`: Resource server bearer-only client (`aud`: `komainu-api`)
+  - `komagu-api`: Resource server bearer-only client (`aud`: `komagu-api`)
 - **Test Personas:**
   - `alice` (Password: `password123`, Tenant: `tenant-alpha`, Role: `Member`)
   - `bob` (Password: `password123`, Tenant: `tenant-alpha`, Role: `Member`)
@@ -58,7 +58,7 @@ var builder = WebApplication.CreateBuilder(args);
 builder.Services.AddKomaguJwtAuthentication(options =>
 {
     options.Issuer = builder.Configuration["Authentication:Issuer"] ?? "https://auth.komagu.test/realms/komagu";
-    options.Audience = "komainu-api";
+    options.Audience = "komagu-api";
     options.RequireHttpsMetadata = builder.Environment.IsProduction();
     options.ClockSkew = TimeSpan.Zero;
 });
@@ -82,13 +82,13 @@ komagu:
   security:
     oidc:
       issuer: "https://auth.komagu.test/realms/komagu"
-      audience: "komainu-api"
+      audience: "komagu-api"
       jwk-set-uri: "https://auth.komagu.test/realms/komagu/protocol/openid-connect/certs"
       clock-skew-seconds: 0
 ```
 
 The auto-configuration registers:
-1. `KomaguAudienceValidator`: Enforces `aud == komainu-api`.
+1. `KomaguAudienceValidator`: Enforces `aud == komagu-api`.
 2. `KomaguJwtAuthenticationConverter`: Maps `sub` to principal and `tenant_id` claim to authentication details.
 3. Stateless `SecurityFilterChain` permitting public endpoints and enforcing authentication on all other APIs.
 

package/remediate/identity/dotnet/src/Komagu.Security.Identity/KomaguOidcOptions.cs

@@ -13,10 +13,10 @@ public sealed class KomaguOidcOptions
     public string Issuer { get; set; } = string.Empty;
 
     /// <summary>
-    /// Expected resource server audience identifier (e.g. "komainu-api").
+    /// Expected resource server audience identifier (e.g. "komagu-api").
     /// The pre-rename default is kept so issued tokens stay valid (#290).
     /// </summary>
-    public string Audience { get; set; } = "komainu-api";
+    public string Audience { get; set; } = "komagu-api";
 
     /// <summary>
     /// OIDC well-known configuration endpoint URI.

package/remediate/identity/dotnet/tests/Komagu.Security.Identity.Tests/TestTokenGenerator.cs

@@ -18,7 +18,7 @@ public sealed class TestTokenGenerator : IDisposable
 
     public string GenerateToken(
         string issuer = "https://auth.komagu.test/realms/komagu",
-        string audience = "komainu-api",
+        string audience = "komagu-api",
         string userId = "user-alice",
         string tenantId = "tenant-alpha",
         DateTime? expires = null,

package/remediate/identity/dotnet/tests/Komagu.Security.Identity.Tests/TokenValidationTests.cs

@@ -14,7 +14,7 @@ using Xunit;
 public class TokenValidationTests : IDisposable
 {
     private const string ExpectedIssuer = "https://auth.komagu.test/realms/komagu";
-    private const string ExpectedAudience = "komainu-api";
+    private const string ExpectedAudience = "komagu-api";
 
     private readonly TestTokenGenerator _tokenGenerator;
     private readonly TestServer _server;

package/remediate/identity/python/komagu_identity/oidc_validator.py

@@ -11,7 +11,6 @@ from __future__ import annotations
 import math
 import os
 import sys
-import warnings
 from typing import Any, Dict, List, Optional, Union
 
 import jwt
@@ -33,13 +32,8 @@ from .models import UserPrincipal
 
 
 def _env(name: str, default: Optional[str] = None) -> Optional[str]:
-    """Read KOMAGU_<name>, falling back to the deprecated KOMAINU_<name> (#290)."""
-    value = os.environ.get("KOMAGU_" + name)
-    if value is None:
-        value = os.environ.get("KOMAINU_" + name)
-        if value is not None:
-            warnings.warn(f"KOMAINU_{name} is deprecated, set KOMAGU_{name} instead", DeprecationWarning, stacklevel=2)
-    return default if value is None else value
+    """Read KOMAGU_<name>."""
+    return os.environ.get("KOMAGU_" + name, default)
 
 
 # Standard test/dev personas matching Komagu cross-user test fixtures

package/remediate/identity/python/tests/test_oidc_validator.py

@@ -44,7 +44,7 @@ class TestOidcTokenValidator(unittest.TestCase):
         cls.attacker_private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
 
         cls.issuer = "https://identity.komagu.test"
-        cls.audience = "komainu-api"
+        cls.audience = "komagu-api"
 
     def _create_token(
         self,

package/remediate/identity/spring/src/main/kotlin/io/komagu/security/identity/KomaguOidcProperties.kt

@@ -13,10 +13,10 @@ data class KomaguOidcProperties(
     var issuer: String = "",
 
     /**
-     * Expected resource server audience (default: "komainu-api"). Must not be blank.
+     * Expected resource server audience (default: "komagu-api"). Must not be blank.
      * The pre-rename default is kept so issued tokens stay valid (#290).
      */
-    var audience: String = "komainu-api",
+    var audience: String = "komagu-api",
 
     /**
      * JSON Web Key Set (JWKS) endpoint URI. Must use HTTPS unless allowInsecureHttpJwks is true.

package/remediate/identity/spring/src/test/kotlin/io/komagu/security/identity/KomaguIdentityAutoConfigurationTest.kt

@@ -101,7 +101,7 @@ class KomaguIdentityAutoConfigurationTest {
 
         val port = server.address.port
         val issuer = "https://auth.komagu.test/realms/komagu"
-        val audience = "komainu-api"
+        val audience = "komagu-api"
 
         try {
             contextRunner
@@ -255,7 +255,7 @@ class KomaguIdentityAutoConfigurationTest {
         }
         server.start()
 
-        val audience = "komainu-api"
+        val audience = "komagu-api"
 
         try {
             // Configure ONLY spring.security.oauth2.resourceserver.jwt.issuer-uri

package/remediate/identity/spring/src/test/kotlin/io/komagu/security/identity/TestJwtFactory.kt

@@ -26,7 +26,7 @@ class TestJwtFactory {
 
     fun createToken(
         issuer: String = "https://auth.komagu.test/realms/komagu",
-        audience: String = "komainu-api",
+        audience: String = "komagu-api",
         subject: String? = "alice-100",
         tenantId: String = "tenant-alpha",
         issueTime: Instant = Instant.now(),

package/remediate/identity/spring/src/test/kotlin/io/komagu/security/identity/TokenValidationIntegrationTest.kt

@@ -27,7 +27,7 @@ class TokenValidationIntegrationTest {
 
     companion object {
         const val EXPECTED_ISSUER = "https://auth.komagu.test/realms/komagu"
-        const val EXPECTED_AUDIENCE = "komainu-api"
+        const val EXPECTED_AUDIENCE = "komagu-api"
         val jwtFactory = TestJwtFactory()
     }
 

package/remediate/identity/test-env/realm-komagu.json

@@ -37,7 +37,7 @@
       ]
     },
     {
-      "clientId": "komainu-api",
+      "clientId": "komagu-api",
       "name": "Komagu Resource Server API",
       "enabled": true,
       "bearerOnly": true,

package/remediate/legacy_shims/coldfusion/KomaguSecurityShim.cfc

@@ -18,12 +18,12 @@
     <cfargument name="idValue" type="any" required="true">
 
     <cfif isNull(arguments.idValue)>
-      <cfthrow type="Komainu.InvalidId" message="Identifier cannot be null.">
+      <cfthrow type="Komagu.InvalidId" message="Identifier cannot be null.">
     </cfif>
 
     <cfset var s = trim(toString(arguments.idValue))>
     <cfif len(s) EQ 0 OR NOT reFind("^[1-9][0-9]{0,18}$", s)>
-      <cfthrow type="Komainu.InvalidId" message="Identifier must be a positive canonical decimal integer.">
+      <cfthrow type="Komagu.InvalidId" message="Identifier must be a positive canonical decimal integer.">
     </cfif>
 
     <cfreturn s>
@@ -59,10 +59,10 @@
     <cfargument name="allowList" type="array" required="true">
 
     <cfif NOT arrayFind(arguments.allowList, arguments.identifier)>
-      <cfthrow type="Komainu.DisallowedIdentifier" message="Disallowed SQL identifier.">
+      <cfthrow type="Komagu.DisallowedIdentifier" message="Disallowed SQL identifier.">
     </cfif>
     <cfif NOT reFind("^[a-zA-Z_][a-zA-Z0-9_]*$", arguments.identifier)>
-      <cfthrow type="Komainu.InvalidIdentifier" message="Invalid SQL identifier format.">
+      <cfthrow type="Komagu.InvalidIdentifier" message="Invalid SQL identifier format.">
     </cfif>
     <cfreturn arguments.identifier>
   </cffunction>
@@ -99,7 +99,7 @@
       </cfquery>
 
       <cfif qOwnership.recordCount EQ 0>
-        <cfthrow type="Komainu.AccessDenied" message="Record not found or not owned.">
+        <cfthrow type="Komagu.AccessDenied" message="Record not found or not owned.">
       </cfif>
 
       <cfreturn normResId>

package/remediate/query/README.md

@@ -42,7 +42,7 @@ val safeClause = allowList.buildSortClause(userInputColumn, "DESC")
 
 The `Komagu.Security.Query.Analyzers` package inspects syntax trees during build time and inside the IDE to flag any string concatenation or string interpolation passed into raw SQL query methods:
 
-- **Diagnostic ID:** `KOMAINU001`
+- **Diagnostic ID:** `KOMAGU001`
 - **Severity:** `Warning` / `Error`
 - **Target APIs:** `FromSqlRaw`, `ExecuteSqlRaw`, `ExecuteSqlRawAsync`, `SqlQueryRaw`, `Query`, `Execute`.
 

package/remediate/query/dotnet/src/Komagu.Security.Query.Analyzers/DiagnosticIds.cs

@@ -3,5 +3,5 @@ namespace Komagu.Security.Query.Analyzers;
 public static class DiagnosticIds
 {
     // Kept after the rename so existing #pragma / .editorconfig suppressions still apply (#290).
-    public const string SqlInjectionDiagnosticId = "KOMAINU001";
+    public const string SqlInjectionDiagnosticId = "KOMAGU001";
 }

package/remediate/query/dotnet/src/Komagu.Security.Query.Analyzers/Komagu.Security.Query.Analyzers.csproj

@@ -10,7 +10,7 @@
     <Version>1.0.0-preview.1</Version>
     <Authors>Komagu Contributors</Authors>
     <Company>Komagu Security</Company>
-    <Description>Roslyn analyzer rule KOMAINU001 detecting SQL injection from string-built queries in C#.</Description>
+    <Description>Roslyn analyzer rule KOMAGU001 detecting SQL injection from string-built queries in C#.</Description>
     <PackageLicenseExpression>Apache-2.0</PackageLicenseExpression>
     <IsRoslynComponent>true</IsRoslynComponent>
     <EnforceExtendedAnalyzerRules>true</EnforceExtendedAnalyzerRules>

package/remediate/query/spring/src/main/kotlin/io/komagu/security/query/detekt/KomaguRuleSetProvider.kt

@@ -9,7 +9,7 @@ import io.gitlab.arturbosch.detekt.api.RuleSetProvider
  */
 class KomaguRuleSetProvider : RuleSetProvider {
     // Kept after the rename so existing detekt.yml sections and @Suppress ids still apply (#290).
-    override val ruleSetId: String = "komainu-security"
+    override val ruleSetId: String = "komagu-security"
 
     override fun instance(config: Config): RuleSet {
         return RuleSet(

package/remediate/resilience/dr/dr_manager.py

@@ -15,18 +15,12 @@ import json
 import os
 import sys
 import time
-import warnings
 from typing import Any, Dict, List, Optional, Tuple
 
 
 def _env(name: str, default: Optional[str] = None) -> Optional[str]:
-    """Read KOMAGU_<name>, falling back to the deprecated KOMAINU_<name> (#290)."""
-    value = os.environ.get("KOMAGU_" + name)
-    if value is None:
-        value = os.environ.get("KOMAINU_" + name)
-        if value is not None:
-            warnings.warn(f"KOMAINU_{name} is deprecated, set KOMAGU_{name} instead", DeprecationWarning, stacklevel=2)
-    return default if value is None else value
+    """Read KOMAGU_<name>."""
+    return os.environ.get("KOMAGU_" + name, default)
 
 
 

package/remediate/resilience/dr/runbook.md

@@ -34,7 +34,7 @@ A Disaster Recovery failover is declared by the Incident Commander / Principal A
 ### Phase 2: Secondary Cluster Activation (大阪スタンバイ環境起動)
 1. Scale Osaka ECS tasks from 0 (warm standby) to production capacity:
    ```bash
-   aws ecs update-service --cluster komainu-production-standby-dr-cluster \
+   aws ecs update-service --cluster komagu-production-standby-dr-cluster \
      --service api-gateway --desired-count 4 --region ap-northeast-3
    ```
 2. Rehydrate relational state from S3 Object Lock Compliance WORM bucket:
@@ -43,7 +43,7 @@ A Disaster Recovery failover is declared by the Incident Commander / Principal A
    ```
 
 ### Phase 3: Route53 Traffic Cutover (DNS切替)
-1. Update DNS failover record to point to Osaka ALB (`osaka-dr-alb.komainu.internal`).
+1. Update DNS failover record to point to Osaka ALB (`osaka-dr-alb.komagu.internal`).
 2. Verify smoke test health check returns HTTP 200 on all core endpoints.
 
 ---

package/remediate/resilience/terraform/variables.tf

@@ -15,7 +15,7 @@ variable "secondary_region" {
 variable "project_name" {
   description = "Project and workload prefix"
   type        = string
-  default     = "komainu"
+  default     = "komagu"
 }
 
 variable "environment" {

package/remediate/tenancy/audit/audit_trail.py

@@ -17,18 +17,12 @@ import os
 import secrets
 import sys
 import threading
-import warnings
 from typing import Any, Dict, List, Optional, Tuple
 
 
 def _env(name: str, default: Optional[str] = None) -> Optional[str]:
-    """Read KOMAGU_<name>, falling back to the deprecated KOMAINU_<name> (#290)."""
-    value = os.environ.get("KOMAGU_" + name)
-    if value is None:
-        value = os.environ.get("KOMAINU_" + name)
-        if value is not None:
-            warnings.warn(f"KOMAINU_{name} is deprecated, set KOMAGU_{name} instead", DeprecationWarning, stacklevel=2)
-    return default if value is None else value
+    """Read KOMAGU_<name>."""
+    return os.environ.get("KOMAGU_" + name, default)
 
 
 

package/remediate/tenancy/crypto/byok_manager.py

@@ -15,18 +15,12 @@ import json
 import os
 import secrets
 import sys
-import warnings
 from typing import Any, Dict, Optional, Tuple
 
 
 def _env(name: str, default: Optional[str] = None) -> Optional[str]:
-    """Read KOMAGU_<name>, falling back to the deprecated KOMAINU_<name> (#290)."""
-    value = os.environ.get("KOMAGU_" + name)
-    if value is None:
-        value = os.environ.get("KOMAINU_" + name)
-        if value is not None:
-            warnings.warn(f"KOMAINU_{name} is deprecated, set KOMAGU_{name} instead", DeprecationWarning, stacklevel=2)
-    return default if value is None else value
+    """Read KOMAGU_<name>."""
+    return os.environ.get("KOMAGU_" + name, default)
 
 
 try:

package/remediate/tenancy/middleware/tenant_context.py

@@ -12,18 +12,12 @@ from contextlib import contextmanager
 import hmac
 import os
 import re
-import warnings
 from typing import Any, Dict, Iterator, Optional
 
 
 def _env(name: str, default: Optional[str] = None) -> Optional[str]:
-    """Read KOMAGU_<name>, falling back to the deprecated KOMAINU_<name> (#290)."""
-    value = os.environ.get("KOMAGU_" + name)
-    if value is None:
-        value = os.environ.get("KOMAINU_" + name)
-        if value is not None:
-            warnings.warn(f"KOMAINU_{name} is deprecated, set KOMAGU_{name} instead", DeprecationWarning, stacklevel=2)
-    return default if value is None else value
+    """Read KOMAGU_<name>."""
+    return os.environ.get("KOMAGU_" + name, default)
 
 
 # Context variable holding the active tenant_id for the current execution thread/coroutine

package/remediate/tenancy/sql/rls_isolation.sql

@@ -8,16 +8,16 @@
 --    In autocommit connection pools, session state expires immediately after set_current_tenant().
 -- 2. ROLE RESTRICTION: FORCE ROW LEVEL SECURITY enforces policies on table owners
 --    and standard users, but NEVER applies to PostgreSQL superusers or roles with BYPASSRLS.
---    Applications MUST connect using a non-owner, non-BYPASSRLS application role (komainu_app).
+--    Applications MUST connect using a non-owner, non-BYPASSRLS application role (komagu_app).
 
 -- 0. Provision Dedicated Non-Owner Application Role (without hard-coded password)
 -- NOTE: In production environments requiring LOGIN connections, configure passwords
--- exclusively via deployment orchestration or vault parameters (ALTER ROLE komainu_app WITH LOGIN PASSWORD ...),
+-- exclusively via deployment orchestration or vault parameters (ALTER ROLE komagu_app WITH LOGIN PASSWORD ...),
 -- NEVER hard-code credentials in committed migration scripts.
 DO $$
 BEGIN
-    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'komainu_app') THEN
-        CREATE ROLE komainu_app WITH NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE NOLOGIN;
+    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'komagu_app') THEN
+        CREATE ROLE komagu_app WITH NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE NOLOGIN;
     END IF;
 END;
 $$;
@@ -55,7 +55,7 @@ ALTER TABLE orders FORCE ROW LEVEL SECURITY;
 DROP POLICY IF EXISTS tenant_org_isolation_policy ON tenant_organizations;
 CREATE POLICY tenant_org_isolation_policy ON tenant_organizations
     FOR ALL
-    TO komainu_app
+    TO komagu_app
     USING (
         id = NULLIF(current_setting('app.current_tenant_id', true), '')
     )
@@ -67,7 +67,7 @@ CREATE POLICY tenant_org_isolation_policy ON tenant_organizations
 DROP POLICY IF EXISTS tenant_isolation_policy ON orders;
 CREATE POLICY tenant_isolation_policy ON orders
     FOR ALL
-    TO komainu_app
+    TO komagu_app
     USING (
         tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')
     )
@@ -126,11 +126,11 @@ CREATE TRIGGER trg_orders_tenant_injection
 
 -- 6. Grant Least-Privilege Access to Application Role & Revoke Public Execution
 REVOKE ALL ON FUNCTION trg_inject_current_tenant() FROM PUBLIC;
-GRANT USAGE ON SCHEMA public TO komainu_app;
-GRANT SELECT, INSERT, UPDATE, DELETE ON tenant_organizations TO komainu_app;
-GRANT SELECT, INSERT, UPDATE, DELETE ON orders TO komainu_app;
+GRANT USAGE ON SCHEMA public TO komagu_app;
+GRANT SELECT, INSERT, UPDATE, DELETE ON tenant_organizations TO komagu_app;
+GRANT SELECT, INSERT, UPDATE, DELETE ON orders TO komagu_app;
 
 REVOKE ALL ON FUNCTION set_current_tenant(VARCHAR) FROM PUBLIC;
 REVOKE ALL ON FUNCTION reset_current_tenant() FROM PUBLIC;
-GRANT EXECUTE ON FUNCTION set_current_tenant(VARCHAR) TO komainu_app;
-GRANT EXECUTE ON FUNCTION reset_current_tenant() TO komainu_app;
+GRANT EXECUTE ON FUNCTION set_current_tenant(VARCHAR) TO komagu_app;
+GRANT EXECUTE ON FUNCTION reset_current_tenant() TO komagu_app;

package/remediate/tenancy/sql/schema_per_tenant.sql

@@ -59,10 +59,10 @@ BEGIN
 
 
     -- Grant least-privilege tenant access to application role
-    IF EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'komainu_app') THEN
-        EXECUTE format('GRANT USAGE ON SCHEMA %I TO komainu_app', v_schema_name);
-        EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO komainu_app', v_schema_name);
-        EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO komainu_app', v_schema_name);
+    IF EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'komagu_app') THEN
+        EXECUTE format('GRANT USAGE ON SCHEMA %I TO komagu_app', v_schema_name);
+        EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO komagu_app', v_schema_name);
+        EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO komagu_app', v_schema_name);
     END IF;
 
 END;
@@ -101,11 +101,11 @@ $$ LANGUAGE plpgsql;
 REVOKE ALL ON FUNCTION create_tenant_schema(VARCHAR) FROM PUBLIC;
 REVOKE ALL ON FUNCTION switch_tenant_schema(VARCHAR) FROM PUBLIC;
 REVOKE ALL ON TABLE public.tenant_registry FROM PUBLIC;
--- Note: No SELECT grant on tenant_registry for komainu_app. Namespace‑only isolation is enforced; cross‑tenant queries must use tenant‑specific schemas.
+-- Note: No SELECT grant on tenant_registry for komagu_app. Namespace‑only isolation is enforced; cross‑tenant queries must use tenant‑specific schemas.
 DO $$
 BEGIN
-    IF EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'komainu_app') THEN
-        GRANT EXECUTE ON FUNCTION switch_tenant_schema(VARCHAR) TO komainu_app;
+    IF EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'komagu_app') THEN
+        GRANT EXECUTE ON FUNCTION switch_tenant_schema(VARCHAR) TO komagu_app;
     END IF;
 END $$;
 

package/remediate/tenancy/test_sql_postgres.py

@@ -16,7 +16,7 @@ import psycopg2
 from psycopg2 import sql
 
 # Paths to the SQL scripts relative to the repository root.
-REPO_ROOT = Path("/Users/hoanghainh/Projects/komainu")
+REPO_ROOT = Path(__file__).resolve().parents[2]
 SCHEMA_SQL = REPO_ROOT / "remediate" / "tenancy" / "sql" / "schema_per_tenant.sql"
 RLS_SQL = REPO_ROOT / "remediate" / "tenancy" / "sql" / "rls_isolation.sql"
 

package/remediate/tenancy/tests/test_tenancy.py

@@ -206,8 +206,8 @@ class TestTenantIsolationAndBYOK(unittest.TestCase):
         self.assertIn("REVOKE ALL ON ALL TABLES IN SCHEMA %I FROM PUBLIC", sql_content)
         self.assertIn("REVOKE ALL ON FUNCTION create_tenant_schema(VARCHAR) FROM PUBLIC", sql_content)
         self.assertIn("REVOKE ALL ON FUNCTION switch_tenant_schema(VARCHAR) FROM PUBLIC", sql_content)
-        self.assertIn("GRANT USAGE ON SCHEMA %I TO komainu_app", sql_content)
-        self.assertIn("GRANT EXECUTE ON FUNCTION switch_tenant_schema(VARCHAR) TO komainu_app", sql_content)
+        self.assertIn("GRANT USAGE ON SCHEMA %I TO komagu_app", sql_content)
+        self.assertIn("GRANT EXECUTE ON FUNCTION switch_tenant_schema(VARCHAR) TO komagu_app", sql_content)
 
     def test_11_rls_sql_app_role_and_tenant_organizations_security(self) -> None:
         """Verifies RLS template defines non-owner app role, protects tenant_organizations, and pins search_path."""
@@ -215,7 +215,7 @@ class TestTenantIsolationAndBYOK(unittest.TestCase):
         with open(rls_file, "r", encoding="utf-8") as f:
             sql_content = f.read()
 
-        self.assertIn("CREATE ROLE komainu_app WITH NOSUPERUSER NOBYPASSRLS", sql_content)
+        self.assertIn("CREATE ROLE komagu_app WITH NOSUPERUSER NOBYPASSRLS", sql_content)
         self.assertIn("NOLOGIN", sql_content)
         self.assertNotIn("replace_with_secure_app_password", sql_content)
         self.assertIn("ALTER TABLE tenant_organizations ENABLE ROW LEVEL SECURITY", sql_content)
@@ -225,7 +225,7 @@ class TestTenantIsolationAndBYOK(unittest.TestCase):
         self.assertIn("TRANSACTION REQUIREMENT", sql_content)
         self.assertIn("BEGIN ... COMMIT", sql_content)
         self.assertIn("REVOKE ALL ON FUNCTION set_current_tenant(VARCHAR) FROM PUBLIC", sql_content)
-        self.assertIn("GRANT EXECUTE ON FUNCTION set_current_tenant(VARCHAR) TO komainu_app", sql_content)
+        self.assertIn("GRANT EXECUTE ON FUNCTION set_current_tenant(VARCHAR) TO komagu_app", sql_content)
 
     def test_12_rls_cross_tenant_isolation_logic_simulation(self) -> None:
         """Simulates RLS policy evaluation: verifying cross-tenant records cannot be read."""

package/bin/komainu

@@ -1,16 +0,0 @@
-#!/usr/bin/env python3
-"""Deprecated `bin/komainu` entrypoint: use `bin/komagu` (#290)."""
-
-from __future__ import annotations
-
-import sys
-from pathlib import Path
-
-REPO_ROOT = Path(__file__).resolve().parent.parent
-sys.path.insert(0, str(REPO_ROOT))
-
-from operate.cli.main import main  # noqa: E402
-
-if __name__ == "__main__":
-    print("[DEPRECATED] bin/komainu was renamed to bin/komagu.", file=sys.stderr)
-    sys.exit(main())

package/bin/komainu-legacy.js

@@ -1,16 +0,0 @@
-#!/usr/bin/env node
-/**
- * Deprecated `komainu` / `komainu-guard` npm bin aliases.
- *
- * Prints a rename notice to stderr, then runs the Komagu launcher unchanged.
- * Remove in the next major release (#290).
- */
-
-'use strict';
-
-console.error(
-  '\x1b[33m[DEPRECATED]\x1b[0m `komainu` / `komainu-guard` were renamed to `komagu`. ' +
-  'Install @hoanghainh/komagu and run `komagu` instead.'
-);
-
-require('./komagu.js');

package/remediate/ekyc/tests/test_legacy_env.py

@@ -1,33 +0,0 @@
-#!/usr/bin/env python3
-"""KOMAGU_* environment variables with the deprecated KOMAINU_* fallback (#290)."""
-
-from __future__ import annotations
-
-import os
-import unittest
-import warnings
-from unittest.mock import patch
-
-from remediate.ekyc.server import tokenization, jpki_verifier
-
-MODULES = (tokenization, jpki_verifier)
-
-
-class TestLegacyEnvFallback(unittest.TestCase):
-    def test_new_name_wins_without_warning(self) -> None:
-        env = {"KOMAGU_EKYC_HMAC_KEY": "new", "KOMAINU_EKYC_HMAC_KEY": "old"}
-        for mod in MODULES:
-            with self.subTest(module=mod.__name__), patch.dict(os.environ, env), warnings.catch_warnings(record=True) as caught:
-                warnings.simplefilter("always")
-                self.assertEqual(mod._env("EKYC_HMAC_KEY"), "new")
-                self.assertEqual(caught, [])
-
-    def test_legacy_name_is_read_with_deprecation_warning(self) -> None:
-        for mod in MODULES:
-            with self.subTest(module=mod.__name__), patch.dict(os.environ, {"KOMAINU_EKYC_HMAC_KEY": "old"}, clear=True):
-                with self.assertWarnsRegex(DeprecationWarning, "KOMAINU_EKYC_HMAC_KEY is deprecated"):
-                    self.assertEqual(mod._env("EKYC_HMAC_KEY"), "old")
-
-
-if __name__ == "__main__":
-    unittest.main()

package/remediate/identity/python/tests/test_legacy_env.py

@@ -1,33 +0,0 @@
-#!/usr/bin/env python3
-"""KOMAGU_* environment variables with the deprecated KOMAINU_* fallback (#290)."""
-
-from __future__ import annotations
-
-import os
-import unittest
-import warnings
-from unittest.mock import patch
-
-from remediate.identity.python.komagu_identity import oidc_validator
-
-MODULES = (oidc_validator,)
-
-
-class TestLegacyEnvFallback(unittest.TestCase):
-    def test_new_name_wins_without_warning(self) -> None:
-        env = {"KOMAGU_ALLOW_DEV_TOKENS": "new", "KOMAINU_ALLOW_DEV_TOKENS": "old"}
-        for mod in MODULES:
-            with self.subTest(module=mod.__name__), patch.dict(os.environ, env), warnings.catch_warnings(record=True) as caught:
-                warnings.simplefilter("always")
-                self.assertEqual(mod._env("ALLOW_DEV_TOKENS"), "new")
-                self.assertEqual(caught, [])
-
-    def test_legacy_name_is_read_with_deprecation_warning(self) -> None:
-        for mod in MODULES:
-            with self.subTest(module=mod.__name__), patch.dict(os.environ, {"KOMAINU_ALLOW_DEV_TOKENS": "old"}, clear=True):
-                with self.assertWarnsRegex(DeprecationWarning, "KOMAINU_ALLOW_DEV_TOKENS is deprecated"):
-                    self.assertEqual(mod._env("ALLOW_DEV_TOKENS"), "old")
-
-
-if __name__ == "__main__":
-    unittest.main()