@hoanghainh/komagu 1.8.0 → 2.0.1

package/operate/tests/test_sarif_from_scan.py

@@ -0,0 +1,156 @@
+#!/usr/bin/env python3
+"""SARIF input for BFLA and mass assignment in `komagu test --from-scan` and `--export-poc` (#289)."""
+
+from __future__ import annotations
+
+import copy
+import importlib.util
+import io
+import json
+import os
+import sys
+import tempfile
+import unittest
+from contextlib import redirect_stdout
+from pathlib import Path
+from unittest import mock
+
+PROJECT_ROOT = Path(__file__).resolve().parents[2]
+if str(PROJECT_ROOT) not in sys.path:
+    sys.path.insert(0, str(PROJECT_ROOT))
+
+from operate.cli.main import main as cli_main  # noqa: E402
+from operate.cross_user_tester.mock_test_server import start_mock_server  # noqa: E402
+from operate.cross_user_tester.persona_matrix import generate_matrix_cases_from_findings  # noqa: E402
+from operate.exploit.generator import ExploitGenerator  # noqa: E402
+from operate.lsa_sarif.lsa_to_sarif import convert_findings_to_sarif  # noqa: E402
+from operate.lsa_sarif.sarif_findings import findings_from_sarif  # noqa: E402
+
+_spec = importlib.util.spec_from_file_location(
+    "lsa_findings_to_sarif", PROJECT_ROOT / "assess" / "lsa" / "scripts" / "findings_to_sarif.py"
+)
+assert _spec and _spec.loader
+lsa_findings_to_sarif = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(lsa_findings_to_sarif)
+
+ENV = {"T_USER": "user-secret-token"}
+
+FINDINGS = {
+    "findings": [
+        {"finding_id": "BFLA-R-0001-1", "category": "bfla", "title": "Any user deletes accounts",
+         "location": {"file": "app.py", "line": 10},
+         "endpoint": {"method": "DELETE", "path": "/api/admin/users/{id}"}, "status": "confirmed",
+         "consensus": {"score": 0.9}},
+        {"finding_id": "MASS-M-0001-1", "category": "mass_assignment", "title": "Profile binds body",
+         "location": {"file": "app.py", "line": 20},
+         "endpoint": {"method": "PUT", "path": "/api/profile"},
+         "attack_vector": {"fields": {"role": "admin"}, "readback": "GET /api/profile",
+                           "suggested_payload": "{\"role\": \"admin\"}"},
+         "status": "unverified", "consensus": {"score": 0.6}},
+        {"finding_id": "BFLA-R-0002-1", "category": "bfla", "title": "Rejected one",
+         "location": {"file": "app.py", "line": 30},
+         "endpoint": {"method": "DELETE", "path": "/api/x"}, "status": "rejected"},
+        {"finding_id": "BOLA-R-0003-1", "category": "bola", "title": "Not ours",
+         "location": {"file": "app.py", "line": 40},
+         "endpoint": {"method": "GET", "path": "/api/orders/{id}"}},
+    ]
+}
+
+
+def case_key(c):
+    return (c.kind, c.finding_id, c.method, c.path, c.probe_fields, c.readback)
+
+
+def sarif_from_assess(doc):
+    return lsa_findings_to_sarif.to_sarif(copy.deepcopy(doc), include_rejected=True)
+
+
+def sarif_from_operate(doc):
+    return convert_findings_to_sarif(copy.deepcopy(doc["findings"]))
+
+
+class TestSarifMatrixCases(unittest.TestCase):
+    def test_both_exporters_give_the_same_cases_as_findings_json(self):
+        expected = [case_key(c) for c in generate_matrix_cases_from_findings(FINDINGS, "T_USER", default_id="7")]
+        self.assertEqual([k[1] for k in expected], ["BFLA-R-0001-1", "MASS-M-0001-1"])
+        for export in (sarif_from_assess, sarif_from_operate):
+            with self.subTest(exporter=export.__name__):
+                cases = generate_matrix_cases_from_findings(export(FINDINGS), "T_USER", default_id="7")
+                self.assertEqual([case_key(c) for c in cases], expected)
+
+    def test_min_consensus_applies_to_sarif(self):
+        cases = generate_matrix_cases_from_findings(sarif_from_assess(FINDINGS), "T_USER", min_consensus=0.8)
+        self.assertEqual([c.finding_id for c in cases], ["BFLA-R-0001-1"])
+
+    def test_suggested_payload_is_not_written_to_sarif(self):
+        text = json.dumps(sarif_from_assess(FINDINGS)) + json.dumps(sarif_from_operate(FINDINGS))
+        self.assertNotIn("suggested_payload", text)
+
+    def test_sarif_without_replay_properties_falls_back_to_rule_and_message(self):
+        sarif = sarif_from_assess(FINDINGS)
+        for result in sarif["runs"][0]["results"]:
+            for key in ("finding_id", "category", "endpoint", "attack_vector", "consensus_score"):
+                result["properties"].pop(key, None)
+        findings = {f["finding_id"]: f for f in findings_from_sarif(sarif)}
+        self.assertEqual(findings["BFLA-R-0001-1"]["category"], "bfla")
+        self.assertEqual(findings["BFLA-R-0001-1"]["endpoint"], {"method": "DELETE", "path": "/api/admin/users/{id}"})
+        cases = generate_matrix_cases_from_findings(sarif, "T_USER", default_id="7")
+        mass = next(c for c in cases if c.kind == "mass_assignment")
+        self.assertIn("role", mass.probe_fields)  # default probe fields without attack_vector
+        self.assertEqual(mass.readback, ("GET", "/api/profile"))
+
+    def test_owasp_tag_identifies_category_when_rule_id_does_not(self):
+        sarif = sarif_from_assess(FINDINGS)
+        run = sarif["runs"][0]
+        renamed = {}
+        for i, rule in enumerate(run["tool"]["driver"]["rules"]):
+            renamed[rule["id"]] = f"custom-{i}"
+            rule["id"] = f"custom-{i}"
+        for result in run["results"]:
+            result["ruleId"] = renamed[result["ruleId"]]
+            result["properties"].pop("category", None)
+        kinds = {f["finding_id"]: f["category"] for f in findings_from_sarif(sarif)}
+        self.assertEqual(kinds["BFLA-R-0001-1"], "bfla")
+        self.assertEqual(kinds["MASS-M-0001-1"], "mass_assignment")
+
+
+class TestSarifPocExport(unittest.TestCase):
+    def test_pocs_from_sarif_match_findings_json(self):
+        gen = ExploitGenerator(base_url="http://127.0.0.1:1", default_resource_id="7")
+        expected = {a.finding_id: (a.category, a.method, a.target_path) for a in gen.generate_from_findings_data(FINDINGS)}
+        for export in (sarif_from_assess, sarif_from_operate):
+            with self.subTest(exporter=export.__name__):
+                arts = {a.finding_id: a for a in gen.generate_from_findings_data(export(FINDINGS))}
+                self.assertEqual({k: (a.category, a.method, a.target_path) for k, a in arts.items()}, expected)
+                self.assertIn('"role": "admin"', arts["MASS-M-0001-1"].python_script)
+                self.assertNotIn("BFLA-R-0002-1", arts)
+
+
+class TestCliFromScanSarif(unittest.TestCase):
+    def setUp(self):
+        self.server, _, self.base_url = start_mock_server(port=0)
+        self.tmp = tempfile.TemporaryDirectory()
+        self.dir = Path(self.tmp.name)
+
+    def tearDown(self):
+        self.server.shutdown()
+        self.server.server_close()
+        self.tmp.cleanup()
+
+    def test_from_scan_sarif_runs_bfla_and_mass_cases(self):
+        scan = self.dir / "findings.sarif"
+        scan.write_text(json.dumps(sarif_from_assess(FINDINGS)), encoding="utf-8")
+        out = self.dir / "res.json"
+        buf = io.StringIO()
+        with mock.patch.dict(os.environ, ENV), redirect_stdout(buf):
+            code = cli_main(["test", "--url", self.base_url, "--from-scan", str(scan),
+                             "--token-env", "T_USER", "--resource-id", "7", "--output", str(out)])
+        self.assertEqual(code, 1)
+        report = json.loads(out.read_text(encoding="utf-8"))
+        ids = {r["finding_id"] for r in report["matrix_results"] if r["is_breach"]}
+        self.assertEqual(ids, {"BFLA-R-0001-1", "MASS-M-0001-1"})
+        self.assertNotIn(ENV["T_USER"], out.read_text(encoding="utf-8") + buf.getvalue())
+
+
+if __name__ == "__main__":
+    unittest.main()

package/package.json

@@ -1,13 +1,11 @@
 {
   "name": "@hoanghainh/komagu",
-  "version": "1.8.0",
+  "version": "2.0.1",
   "description": "Security-First Legacy Modernization Platform CLI (LSA Kit, IAM Perimeter, Cross-User Testing)",
   "main": "remediate/authz/nodejs/src/index.js",
   "types": "remediate/authz/nodejs/src/index.d.ts",
   "bin": {
-    "komagu": "bin/komagu.js",
-    "komainu": "bin/komainu-legacy.js",
-    "komainu-guard": "bin/komainu-legacy.js"
+    "komagu": "bin/komagu.js"
   },
   "files": [
     "bin/",

package/remediate/authz/README.md

@@ -16,7 +16,7 @@ All implementations strictly enforce these architectural guarantees:
    - **Imperative (Programmatic):** Explicit service calls (`AuthorizeAsync` / `requireOwnership`) for complex business workflows and multi-condition rules.
    - **Declarative (Metadata/Attribute/Annotation):** Endpoint filter (`[RequireOwnership]`) or AOP Aspect (`@RequireOwnership`) for clean, declarative controller boundaries.
 4. **Scoped Data-Access Helpers:** Query pipeline extensions (EF Core `WithUserScope`, Spring Data `ScopedRepository`) automatically appending tenant and owner constraints to SQL queries before execution.
-5. **Structured Security Audit Logging:** Every denial emits a structured event (`Komainu.Authorization.Denied`) with `actorUserId`, `actorTenantId`, `resourceType`, `resourceId`, and failure rationale for SIEM and security monitoring.
+5. **Structured Security Audit Logging:** Every denial emits a structured event (`Komagu.Authorization.Denied`) with `actorUserId`, `actorTenantId`, `resourceType`, `resourceId`, and failure rationale for SIEM and security monitoring.
 
 ---
 

package/remediate/authz/dotnet/src/Komagu.Security.Authorization/DefaultKomaguAuthorizationService.cs

@@ -220,7 +220,7 @@ public sealed class DefaultKomaguAuthorizationService : IKomaguAuthorizationServ
             var auditEvent = new SecurityAuditEvent
             {
                 Timestamp = DateTimeOffset.UtcNow,
-                EventName = "Komainu.Authorization.Denied",
+                EventName = "Komagu.Authorization.Denied",
                 ActorUserId = actorUserId,
                 ActorTenantId = actorTenantId,
                 ResourceType = typeof(T).Name,

package/remediate/authz/dotnet/src/Komagu.Security.Authorization/SecurityAuditEvent.cs

@@ -11,9 +11,9 @@ public record SecurityAuditEvent
     public DateTimeOffset Timestamp { get; init; } = DateTimeOffset.UtcNow;
 
     /// <summary>
-    /// Event name or category. Kept as "Komainu.*" after the rename so existing SIEM rules still match (#290).
+    /// Event name or category.
     /// </summary>
-    public string EventName { get; init; } = "Komainu.Authorization.Denied";
+    public string EventName { get; init; } = "Komagu.Authorization.Denied";
 
     /// <summary>
     /// Distributed tracing identifier (W3C traceparent or correlation ID).

package/remediate/authz/golang/authz.go

@@ -210,7 +210,7 @@ func (a *Authorizer) emitDenial(userId, tenantId string, resource IOwnedResource
 
 	a.Sink.Emit(SecurityAuditEvent{
 		Timestamp:     time.Now().UTC(),
-		EventName:     "Komainu.Authorization.Denied",
+		EventName:     "Komagu.Authorization.Denied",
 		ActorUserID:   userId,
 		ActorTenantID: tenantId,
 		ResourceType:  resType,

package/remediate/authz/nodejs/src/service.js

@@ -140,7 +140,7 @@ class KomaguSecurityService {
 
       const event = {
         timestamp: new Date().toISOString(),
-        eventName: 'Komainu.Authorization.Denied',
+        eventName: 'Komagu.Authorization.Denied',
         actorUserId: actorUserId || undefined,
         actorTenantId: actorTenantId || undefined,
         resourceType: resource && resource.constructor ? resource.constructor.name : 'Object',

package/remediate/authz/nodejs/tests/test-authz.js

@@ -59,7 +59,7 @@ test('KomaguSecurityService: denies attacker with 404 and emits audit', async ()
   // Verify audit event
   assert.strictEqual(auditSink.events.length, 2); // 1 from authorize + 1 from requireOwnership
   const event = auditSink.events[0];
-  assert.strictEqual(event.eventName, 'Komainu.Authorization.Denied');
+  assert.strictEqual(event.eventName, 'Komagu.Authorization.Denied');
   assert.strictEqual(event.actorUserId, 'user-b');
   assert.strictEqual(event.actorTenantId, 'tenant-komagu');
   assert.strictEqual(event.resourceId, 'ord-01');

package/remediate/authz/patcher.py

@@ -85,10 +85,8 @@ class BOLAOwnershipPatcher:
     def ensure_imports(self, content: str, lang: str) -> Tuple[str, bool]:
         """Ensure necessary Komagu authorization import is present at the top of the file."""
         if lang in ("typescript", "javascript"):
-            # komainu-guard: package name before the rename (#290), already-patched files keep it
-            for pkg in ("@hoanghainh/komagu", "komainu-guard"):
-                if f"from '{pkg}'" in content or f'from "{pkg}"' in content:
-                    return content, False
+            if "from '@hoanghainh/komagu'" in content or 'from "@hoanghainh/komagu"' in content:
+                return content, False
             import_stmt = "import { RequireOwnership, OwnershipGuard, ResourceOperation } from '@hoanghainh/komagu';\n"
             return import_stmt + content, True
 
@@ -143,6 +141,7 @@ class BOLAOwnershipPatcher:
 
         # Check if guard is already present on or adjacent to this line
         surrounding = "".join(lines[max(0, idx - 3):min(len(lines), idx + 3)])
+        # [KOMAINU-FIX] is only read: nothing writes it since #216, but files patched before that still carry it (#312)
         if "RequireOwnership" in surrounding or "OwnershipGuard" in surrounding or "[KOMAINU-FIX]" in surrounding:
             return content, BOLARewriteResult(
                 original_line=target_line,

package/remediate/authz/python/komagu_authz/models.py

@@ -48,7 +48,7 @@ class AuthorizationResult:
 class SecurityAuditEvent:
     """Structured security audit event for authorization failures."""
     timestamp: datetime = field(default_factory=lambda: datetime.now(timezone.utc))
-    event_name: str = "Komainu.Authorization.Denied"
+    event_name: str = "Komagu.Authorization.Denied"
     actor_user_id: Optional[str] = None
     actor_tenant_id: Optional[str] = None
     resource_type: str = "Unknown"
@@ -81,7 +81,7 @@ class ISecurityAuditSink(ABC):
 class LoggingSecurityAuditSink(ISecurityAuditSink):
     """Default logger-based audit sink emitting JSON to standard logging."""
 
-    def __init__(self, logger_name: str = "komainu.security.audit") -> None:
+    def __init__(self, logger_name: str = "komagu.security.audit") -> None:
         import logging
         self.logger = logging.getLogger(logger_name)
 

package/remediate/authz/python/tests/test_fastapi_adapter.py

@@ -67,7 +67,7 @@ class TestFastApiAdapter(unittest.TestCase):
         self.authz_service = KomaguAuthorizationService(audit_sink=self.audit_sink)
         self.validator = OidcTokenValidator(
             issuer="https://auth.komagu.test",
-            audience="komainu-api",
+            audience="komagu-api",
             allow_dev_tokens=True,
         )
 

package/remediate/authz/python/tests/test_fastapi_d5_crosstest.py

@@ -42,7 +42,7 @@ class MockFastApiServer(http.server.BaseHTTPRequestHandler):
     authz_service = KomaguAuthorizationService(audit_sink=InMemorySecurityAuditSink())
     validator = OidcTokenValidator(
         issuer="https://auth.komagu.test",
-        audience="komainu-api",
+        audience="komagu-api",
         allow_dev_tokens=True,
     )
 

package/remediate/authz/python/tests/test_python_authz.py

@@ -38,7 +38,7 @@ class TestPythonAuthz(unittest.TestCase):
         self.authz_service = KomaguAuthorizationService(audit_sink=self.audit_sink)
         self.validator = OidcTokenValidator(
             issuer="https://auth.komagu.test",
-            audience="komainu-api",
+            audience="komagu-api",
             allow_dev_tokens=True,
         )
 
@@ -77,7 +77,7 @@ class TestPythonAuthz(unittest.TestCase):
         self.assertEqual(len(self.audit_sink.events), 0)
 
     def test_02_attacker_same_tenant_denied_with_audit(self) -> None:
-        """Attacker Bob (same tenant) is denied access; emits Komainu.Authorization.Denied event."""
+        """Attacker Bob (same tenant) is denied access; emits Komagu.Authorization.Denied event."""
         result = self.authz_service.authorize(
             user=self.bob_attacker,
             resource=self.alice_order,
@@ -89,7 +89,7 @@ class TestPythonAuthz(unittest.TestCase):
         # Verify audit emission
         self.assertEqual(len(self.audit_sink.events), 1)
         event = self.audit_sink.events[0]
-        self.assertEqual(event.event_name, "Komainu.Authorization.Denied")
+        self.assertEqual(event.event_name, "Komagu.Authorization.Denied")
         self.assertEqual(event.actor_user_id, "user-b")
         self.assertEqual(event.actor_tenant_id, "tenant-komagu")
         self.assertEqual(event.resource_id, "ord-001")

package/remediate/authz/spring/src/main/kotlin/io/komagu/security/authorization/DefaultKomaguSecurityManager.kt

@@ -182,7 +182,7 @@ class DefaultKomaguSecurityManager(
 
             val auditEvent = SecurityAuditEvent(
                 timestamp = Instant.now(),
-                eventName = "Komainu.Authorization.Denied",
+                eventName = "Komagu.Authorization.Denied",
                 actorUserId = actorUserId,
                 actorTenantId = actorTenantId,
                 resourceType = resource?.let { it::class.java.simpleName } ?: "Unknown",

package/remediate/authz/spring/src/main/kotlin/io/komagu/security/authorization/SecurityAuditEvent.kt

@@ -7,8 +7,7 @@ import java.time.Instant
  */
 data class SecurityAuditEvent(
     val timestamp: Instant = Instant.now(),
-    // Kept as "Komainu.*" after the rename so existing SIEM rules still match (#290).
-    val eventName: String = "Komainu.Authorization.Denied",
+    val eventName: String = "Komagu.Authorization.Denied",
     val traceId: String? = null,
     val actorUserId: String? = null,
     val actorTenantId: String? = null,

package/remediate/authz/tests/test_bola_patcher.py

@@ -157,7 +157,7 @@ class TestBOLAOwnershipPatcher(unittest.TestCase):
         """If file already contains ownership guards, patcher must skip to prevent duplicates."""
         controller_file = self.test_dir / "protected_order.ts"
         controller_file.write_text(
-            "import { RequireOwnership } from 'komainu-guard';\n"
+            "import { RequireOwnership } from '@hoanghainh/komagu';\n"
             "export class OrderController {\n"
             "    @UseGuards(OwnershipGuard)\n"
             "    @RequireOwnership(ResourceOperation.READ)\n"

package/remediate/edge/coraza/rules/coraza-crs-custom.conf

@@ -1,6 +1,5 @@
 # ==============================================================================
 # Komagu Custom OWASP CRS v4 Tuning & Rule Exclusions
-# Rule tags stay 'komainu-*' after the rename so existing WAF log alerts still match (#290).
 # ==============================================================================
 
 # Enable JSON request body inspection for application/json Content-Type
@@ -33,7 +32,7 @@ SecRule ARGS|REQUEST_URI|REQUEST_HEADERS "@rx (?i)(?:(?:\bunion\b[\s\S]*?\bselec
    msg:'Komagu WAF: SQL Injection Attack Detected',\
    logdata:'Matched Data: %{TX.0}',\
    severity:'CRITICAL',\
-   tag:'komainu-sqli',\
+   tag:'komagu-sqli',\
    setvar:'tx.sql_injection_score=+5',\
    setvar:'tx.inbound_anomaly_score_exceeded=1'"
 
@@ -48,7 +47,7 @@ SecRule ARGS|REQUEST_URI "@rx (?i)(?:<script[^>]*>|javascript:[^\"']*|onerror\s*
    msg:'Komagu WAF: Cross-Site Scripting (XSS) Attack Detected',\
    logdata:'Matched Data: %{TX.0}',\
    severity:'CRITICAL',\
-   tag:'komainu-xss',\
+   tag:'komagu-xss',\
    setvar:'tx.xss_score=+5',\
    setvar:'tx.inbound_anomaly_score_exceeded=1'"
 
@@ -62,4 +61,4 @@ SecRule REQUEST_URI|ARGS "@rx (?i)(?:\.\./|\.\.\\)" \
    msg:'Komagu WAF: Path Traversal Attack Detected',\
    logdata:'Matched Data: %{TX.0}',\
    severity:'CRITICAL',\
-   tag:'komainu-path-traversal'"
+   tag:'komagu-path-traversal'"

package/remediate/edge/coraza/virtual_patcher.py

@@ -3,8 +3,6 @@
 
 Translates confirmed LSA findings (BOLA & SQLi) into deterministic,
 production-ready SecRule configurations for instant Day-2 edge protection.
-
-Rule tags stay 'komainu-*' after the rename so existing WAF log alerts still match (#290).
 """
 
 from __future__ import annotations
@@ -74,8 +72,8 @@ SecRule REQUEST_URI "@rx {path_regex}" \\
    msg:'Komagu Virtual Patch: SQL Injection blocked on {path}',\\
    logdata:'Matched Data: %{{TX.0}}',\\
    severity:'CRITICAL',\\
-   tag:'komainu-virtual-patch',\\
-   tag:'komainu-sqli',\\
+   tag:'komagu-virtual-patch',\\
+   tag:'komagu-sqli',\\
    tag:'{finding_id}',\\
    setvar:'tx.sql_injection_score=+5',\\
    setvar:'tx.inbound_anomaly_score_exceeded=1',\\
@@ -115,8 +113,8 @@ SecRule REQUEST_URI "@rx {path_regex}" \\
    t:urlDecodeUni,\\
    msg:'Komagu Virtual Patch: Missing Authorization Token on BOLA Endpoint {path}',\\
    severity:'CRITICAL',\\
-   tag:'komainu-virtual-patch',\\
-   tag:'komainu-bola',\\
+   tag:'komagu-virtual-patch',\\
+   tag:'komagu-bola',\\
    tag:'{finding_id}',\\
    chain"
   SecRule &REQUEST_HEADERS:Authorization "@eq 0"

package/remediate/edge/docker-compose.yml

@@ -11,7 +11,7 @@ services:
       KONG_PROXY_ERROR_LOG: /dev/stderr
       KONG_ADMIN_ERROR_LOG: /dev/stderr
       KONG_ADMIN_LISTEN: 0.0.0.0:8001
-      KOMAGU_JWT_SECRET: ${KOMAGU_JWT_SECRET:-${KOMAINU_JWT_SECRET:-komagu-default-test-jwt-secret-key-32chars}}
+      KOMAGU_JWT_SECRET: ${KOMAGU_JWT_SECRET:-komagu-default-test-jwt-secret-key-32chars}
     volumes:
       - ./kong/kong.yaml:/kong/declarative/kong.yaml:ro
     ports:

package/remediate/ekyc/server/jpki_verifier.py

@@ -16,18 +16,12 @@ import os
 import secrets
 import threading
 import time
-import warnings
 from typing import Any, Callable, Dict, List, Optional, Tuple
 
 
 def _env(name: str, default: Optional[str] = None) -> Optional[str]:
-    """Read KOMAGU_<name>, falling back to the deprecated KOMAINU_<name> (#290)."""
-    value = os.environ.get("KOMAGU_" + name)
-    if value is None:
-        value = os.environ.get("KOMAINU_" + name)
-        if value is not None:
-            warnings.warn(f"KOMAINU_{name} is deprecated, set KOMAGU_{name} instead", DeprecationWarning, stacklevel=2)
-    return default if value is None else value
+    """Read KOMAGU_<name>."""
+    return os.environ.get("KOMAGU_" + name, default)
 
 
 try:

package/remediate/ekyc/server/tokenization.py

@@ -22,18 +22,12 @@ import re
 import secrets
 import sys
 import time
-import warnings
 from typing import Any, Dict, List, Optional, Set, Tuple
 
 
 def _env(name: str, default: Optional[str] = None) -> Optional[str]:
-    """Read KOMAGU_<name>, falling back to the deprecated KOMAINU_<name> (#290)."""
-    value = os.environ.get("KOMAGU_" + name)
-    if value is None:
-        value = os.environ.get("KOMAINU_" + name)
-        if value is not None:
-            warnings.warn(f"KOMAINU_{name} is deprecated, set KOMAGU_{name} instead", DeprecationWarning, stacklevel=2)
-    return default if value is None else value
+    """Read KOMAGU_<name>."""
+    return os.environ.get("KOMAGU_" + name, default)
 
 
 # Allowed fields in API requests under Zero-PII contract

package/remediate/identity/README.md

@@ -15,7 +15,7 @@ Every incoming request bearing an access token is validated against 5 mandatory
 | **Missing Token** | No `Authorization: Bearer <token>` header supplied. | **HTTP 401 Unauthorized** |
 | **Token Expiry** | Current timestamp > `exp` claim (`ClockSkew` enforced to 0s or strict delta). | **HTTP 401 Unauthorized** |
 | **Issuer Validation** | Token `iss` claim does not match configured trusted IdP authority. | **HTTP 401 Unauthorized** |
-| **Audience Validation** | Token `aud` claim does not include the target resource server ID (`komainu-api`). | **HTTP 401 Unauthorized** |
+| **Audience Validation** | Token `aud` claim does not include the target resource server ID (`komagu-api`). | **HTTP 401 Unauthorized** |
 | **Cryptographic Signature** | Token signed by untrusted key or payload tampered with. | **HTTP 401 Unauthorized** |
 
 ---
@@ -36,7 +36,7 @@ Keycloak starts at `http://localhost:8080` with the `komagu` realm pre-loaded:
 - **Realm Discovery URL:** `http://localhost:8080/realms/komagu/.well-known/openid-configuration`
 - **Clients:**
   - `komagu-portal`: Public SPA client (Standard Flow + PKCE enforced)
-  - `komainu-api`: Resource server bearer-only client (`aud`: `komainu-api`)
+  - `komagu-api`: Resource server bearer-only client (`aud`: `komagu-api`)
 - **Test Personas:**
   - `alice` (Password: `password123`, Tenant: `tenant-alpha`, Role: `Member`)
   - `bob` (Password: `password123`, Tenant: `tenant-alpha`, Role: `Member`)
@@ -58,7 +58,7 @@ var builder = WebApplication.CreateBuilder(args);
 builder.Services.AddKomaguJwtAuthentication(options =>
 {
     options.Issuer = builder.Configuration["Authentication:Issuer"] ?? "https://auth.komagu.test/realms/komagu";
-    options.Audience = "komainu-api";
+    options.Audience = "komagu-api";
     options.RequireHttpsMetadata = builder.Environment.IsProduction();
     options.ClockSkew = TimeSpan.Zero;
 });
@@ -82,13 +82,13 @@ komagu:
   security:
     oidc:
       issuer: "https://auth.komagu.test/realms/komagu"
-      audience: "komainu-api"
+      audience: "komagu-api"
       jwk-set-uri: "https://auth.komagu.test/realms/komagu/protocol/openid-connect/certs"
       clock-skew-seconds: 0
 ```
 
 The auto-configuration registers:
-1. `KomaguAudienceValidator`: Enforces `aud == komainu-api`.
+1. `KomaguAudienceValidator`: Enforces `aud == komagu-api`.
 2. `KomaguJwtAuthenticationConverter`: Maps `sub` to principal and `tenant_id` claim to authentication details.
 3. Stateless `SecurityFilterChain` permitting public endpoints and enforcing authentication on all other APIs.
 

package/remediate/identity/dotnet/src/Komagu.Security.Identity/KomaguOidcOptions.cs

@@ -13,10 +13,10 @@ public sealed class KomaguOidcOptions
     public string Issuer { get; set; } = string.Empty;
 
     /// <summary>
-    /// Expected resource server audience identifier (e.g. "komainu-api").
+    /// Expected resource server audience identifier (e.g. "komagu-api").
     /// The pre-rename default is kept so issued tokens stay valid (#290).
     /// </summary>
-    public string Audience { get; set; } = "komainu-api";
+    public string Audience { get; set; } = "komagu-api";
 
     /// <summary>
     /// OIDC well-known configuration endpoint URI.

package/remediate/identity/dotnet/tests/Komagu.Security.Identity.Tests/TestTokenGenerator.cs

@@ -18,7 +18,7 @@ public sealed class TestTokenGenerator : IDisposable
 
     public string GenerateToken(
         string issuer = "https://auth.komagu.test/realms/komagu",
-        string audience = "komainu-api",
+        string audience = "komagu-api",
         string userId = "user-alice",
         string tenantId = "tenant-alpha",
         DateTime? expires = null,

package/remediate/identity/dotnet/tests/Komagu.Security.Identity.Tests/TokenValidationTests.cs

@@ -14,7 +14,7 @@ using Xunit;
 public class TokenValidationTests : IDisposable
 {
     private const string ExpectedIssuer = "https://auth.komagu.test/realms/komagu";
-    private const string ExpectedAudience = "komainu-api";
+    private const string ExpectedAudience = "komagu-api";
 
     private readonly TestTokenGenerator _tokenGenerator;
     private readonly TestServer _server;

package/remediate/identity/python/komagu_identity/oidc_validator.py

@@ -11,7 +11,6 @@ from __future__ import annotations
 import math
 import os
 import sys
-import warnings
 from typing import Any, Dict, List, Optional, Union
 
 import jwt
@@ -33,13 +32,8 @@ from .models import UserPrincipal
 
 
 def _env(name: str, default: Optional[str] = None) -> Optional[str]:
-    """Read KOMAGU_<name>, falling back to the deprecated KOMAINU_<name> (#290)."""
-    value = os.environ.get("KOMAGU_" + name)
-    if value is None:
-        value = os.environ.get("KOMAINU_" + name)
-        if value is not None:
-            warnings.warn(f"KOMAINU_{name} is deprecated, set KOMAGU_{name} instead", DeprecationWarning, stacklevel=2)
-    return default if value is None else value
+    """Read KOMAGU_<name>."""
+    return os.environ.get("KOMAGU_" + name, default)
 
 
 # Standard test/dev personas matching Komagu cross-user test fixtures

package/remediate/identity/python/tests/test_oidc_validator.py

@@ -44,7 +44,7 @@ class TestOidcTokenValidator(unittest.TestCase):
         cls.attacker_private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
 
         cls.issuer = "https://identity.komagu.test"
-        cls.audience = "komainu-api"
+        cls.audience = "komagu-api"
 
     def _create_token(
         self,

package/remediate/identity/spring/src/main/kotlin/io/komagu/security/identity/KomaguOidcProperties.kt

@@ -13,10 +13,10 @@ data class KomaguOidcProperties(
     var issuer: String = "",
 
     /**
-     * Expected resource server audience (default: "komainu-api"). Must not be blank.
+     * Expected resource server audience (default: "komagu-api"). Must not be blank.
      * The pre-rename default is kept so issued tokens stay valid (#290).
      */
-    var audience: String = "komainu-api",
+    var audience: String = "komagu-api",
 
     /**
      * JSON Web Key Set (JWKS) endpoint URI. Must use HTTPS unless allowInsecureHttpJwks is true.

package/remediate/identity/spring/src/test/kotlin/io/komagu/security/identity/KomaguIdentityAutoConfigurationTest.kt

@@ -101,7 +101,7 @@ class KomaguIdentityAutoConfigurationTest {
 
         val port = server.address.port
         val issuer = "https://auth.komagu.test/realms/komagu"
-        val audience = "komainu-api"
+        val audience = "komagu-api"
 
         try {
             contextRunner
@@ -255,7 +255,7 @@ class KomaguIdentityAutoConfigurationTest {
         }
         server.start()
 
-        val audience = "komainu-api"
+        val audience = "komagu-api"
 
         try {
             // Configure ONLY spring.security.oauth2.resourceserver.jwt.issuer-uri

package/remediate/identity/spring/src/test/kotlin/io/komagu/security/identity/TestJwtFactory.kt

@@ -26,7 +26,7 @@ class TestJwtFactory {
 
     fun createToken(
         issuer: String = "https://auth.komagu.test/realms/komagu",
-        audience: String = "komainu-api",
+        audience: String = "komagu-api",
         subject: String? = "alice-100",
         tenantId: String = "tenant-alpha",
         issueTime: Instant = Instant.now(),