@bgord/bun 1.10.23 → 1.11.0

package/src/shield-basic-auth.strategy.ts

@@ -1,17 +1,28 @@
-import { basicAuth } from "hono/basic-auth";
-import { createMiddleware } from "hono/factory";
 import type { BasicAuthPasswordType } from "./basic-auth-password.vo";
 import type { BasicAuthUsernameType } from "./basic-auth-username.vo";
-import type { ShieldStrategy } from "./shield.strategy";
+import type { HasRequestHeader } from "./request-context.port";
 
-type ShieldBasicAuthConfigType = { username: BasicAuthUsernameType; password: BasicAuthPasswordType };
+export type ShieldBasicAuthConfig = { username: BasicAuthUsernameType; password: BasicAuthPasswordType };
 
-export class ShieldBasicAuthStrategy implements ShieldStrategy {
-  private readonly basicAuth;
+export const ShieldBasicAuthStrategyError = { Rejected: "shield.basic.auth.rejected" };
 
-  constructor(config: ShieldBasicAuthConfigType) {
-    this.basicAuth = basicAuth(config);
-  }
+export class ShieldBasicAuthStrategy {
+  constructor(private readonly config: ShieldBasicAuthConfig) {}
+
+  evaluate(context: HasRequestHeader): boolean {
+    const header = context.request.header("authorization");
+
+    try {
+      const credentials = atob(String(header).replace("Basic ", ""));
 
-  verify = createMiddleware(async (context, next) => this.basicAuth(context, next));
+      const [username, password] = credentials.split(":");
+
+      if (username !== this.config.username) return false;
+      if (password !== this.config.password) return false;
+
+      return true;
+    } catch {
+      return false;
+    }
+  }
 }

package/src/shield-body-limit-hono.strategy.ts

@@ -0,0 +1,30 @@
+import { createMiddleware } from "hono/factory";
+import { HTTPException } from "hono/http-exception";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
+import {
+  type ShieldBodyLimitConfig,
+  ShieldBodyLimitError,
+  ShieldBodyLimitStrategy,
+} from "./shield-body-limit.strategy";
+
+export const ShieldBodyLimitTooBigError = new HTTPException(413, { message: ShieldBodyLimitError.TooBig });
+
+export class ShieldBodyLimitHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldBodyLimitStrategy;
+
+  constructor(config: ShieldBodyLimitConfig) {
+    this.strategy = new ShieldBodyLimitStrategy(config);
+  }
+
+  handle() {
+    return createMiddleware(async (c, next) => {
+      const context = new RequestContextHonoAdapter(c);
+
+      const result = this.strategy.evaluate(context);
+
+      if (!result) throw ShieldBodyLimitTooBigError;
+      return next();
+    });
+  }
+}

package/src/shield-body-limit.strategy.ts

@@ -0,0 +1,23 @@
+import * as tools from "@bgord/tools";
+import type { HasRequestHeader } from "./request-context.port";
+
+export type ShieldBodyLimitConfig = { maxSize: tools.Size };
+
+export const ShieldBodyLimitError = { TooBig: "shield.body.limit.rejected" };
+
+export class ShieldBodyLimitStrategy {
+  constructor(private readonly config: ShieldBodyLimitConfig) {}
+
+  evaluate(context: HasRequestHeader): boolean {
+    const header = context.request.header("content-length");
+
+    const contentLength = tools.SizeBytes.safeParse(Number(header));
+
+    if (!contentLength.success) return true;
+
+    const size = tools.Size.fromBytes(contentLength.data);
+
+    if (size.isGreaterThan(this.config.maxSize)) return false;
+    return true;
+  }
+}

package/src/shield-csrf-hono.strategy.ts

@@ -0,0 +1,24 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
+import { type ShieldCsrfConfig, ShieldCsrfStrategy, ShieldCsrfStrategyError } from "./shield-csrf.strategy";
+
+export const ShieldCsrfError = new HTTPException(403, { message: ShieldCsrfStrategyError.Rejected });
+
+export class ShieldCsrfHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldCsrfStrategy;
+
+  constructor(config: ShieldCsrfConfig) {
+    this.strategy = new ShieldCsrfStrategy(config);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (c, next) => {
+      const context = new RequestContextHonoAdapter(c);
+
+      if (this.strategy.evaluate(context)) return next();
+      throw ShieldCsrfError;
+    };
+  }
+}

package/src/shield-csrf.strategy.ts

@@ -1,26 +1,21 @@
-import { createMiddleware } from "hono/factory";
-import { HTTPException } from "hono/http-exception";
-import { RequestContextAdapterHono } from "./request-context-hono.adapter";
-import type { ShieldStrategy } from "./shield.strategy";
+import type { HasRequestHeader, HasRequestMethod } from "./request-context.port";
 
 const STATE_CHANGING_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
 
-export type ShieldCsrfConfigType = { origin: ReadonlyArray<string> };
+export type ShieldCsrfConfig = { origin: ReadonlyArray<string> };
 
-export const ShieldCsrfError = new HTTPException(403, { message: "shield.csrf" });
+export const ShieldCsrfStrategyError = { Rejected: "shield.csrf.rejected" };
 
-export class ShieldCsrfStrategy implements ShieldStrategy {
-  constructor(private readonly config: ShieldCsrfConfigType) {}
+export class ShieldCsrfStrategy {
+  constructor(private readonly config: ShieldCsrfConfig) {}
 
-  verify = createMiddleware(async (c, next) => {
-    const context = new RequestContextAdapterHono(c);
-
-    if (!STATE_CHANGING_METHODS.includes(context.request.method)) return next();
+  evaluate(context: HasRequestMethod & HasRequestHeader): boolean {
+    if (!STATE_CHANGING_METHODS.includes(context.request.method)) return true;
 
     const origin = context.request.header("origin");
 
-    if (!origin) return next();
-    if (!this.config.origin.includes(origin)) throw ShieldCsrfError;
-    return next();
-  });
+    if (!origin) return true;
+    if (!this.config.origin.includes(origin)) return false;
+    return true;
+  }
 }

package/src/shield-hcaptcha-hono-local.strategy.ts

@@ -0,0 +1,26 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import type { HCaptchaSecretKeyType } from "./hcaptcha-secret-key.vo";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { ShieldHcaptchaStrategy } from "./shield-hcaptcha.strategy";
+
+export const ShieldHcaptchaLocalStrategyError = { Rejected: "shield.hcaptcha.local.rejected" };
+
+export const ShieldHcaptchaLocalError = new HTTPException(403, {
+  message: ShieldHcaptchaLocalStrategyError.Rejected,
+});
+
+export class ShieldHcaptchaLocalHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldHcaptchaStrategy;
+
+  constructor(secretKey: HCaptchaSecretKeyType) {
+    this.strategy = new ShieldHcaptchaStrategy(secretKey);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (_c, next) => {
+      if (await this.strategy.evaluate("10000000-aaaa-bbbb-cccc-000000000001")) return next();
+      throw ShieldHcaptchaLocalError;
+    };
+  }
+}

package/src/shield-hcaptcha-hono.strategy.ts

@@ -0,0 +1,25 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import type { HCaptchaSecretKeyType } from "./hcaptcha-secret-key.vo";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { ShieldHcaptchaStrategy, ShieldHcaptchaStrategyError } from "./shield-hcaptcha.strategy";
+
+export const ShieldHcaptchaError = new HTTPException(403, { message: ShieldHcaptchaStrategyError.Rejected });
+
+export class ShieldHcaptchaHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldHcaptchaStrategy;
+
+  constructor(secretKey: HCaptchaSecretKeyType) {
+    this.strategy = new ShieldHcaptchaStrategy(secretKey);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (c, next) => {
+      const form = await c.req.formData();
+      const token = form.get("h-captcha-response")?.toString();
+
+      if (await this.strategy.evaluate(token)) return next();
+      throw ShieldHcaptchaError;
+    };
+  }
+}

package/src/shield-hcaptcha.strategy.ts

@@ -1,26 +1,20 @@
-import { createMiddleware } from "hono/factory";
-import { HTTPException } from "hono/http-exception";
 import { HCaptchaService } from "./hcaptcha.service";
 import type { HCaptchaSecretKeyType } from "./hcaptcha-secret-key.vo";
-import type { ShieldStrategy } from "./shield.strategy";
 
-export const ShieldHcaptchaError = new HTTPException(403, { message: "shield.hcaptcha" });
+export const ShieldHcaptchaStrategyError = { Rejected: "shield.hcaptcha.rejected" };
 
-export class ShieldHcaptchaStrategy implements ShieldStrategy {
+export class ShieldHcaptchaStrategy {
   private readonly hcaptcha = new HCaptchaService();
 
   constructor(private readonly secretKey: HCaptchaSecretKeyType) {}
 
-  verify = createMiddleware(async (context, next) => {
+  async evaluate(token: string | undefined): Promise<boolean> {
     try {
-      const form = await context.req.formData();
-      const hcaptchaTokenFormData = form.get("h-captcha-response")?.toString();
-      const result = await this.hcaptcha.verify(this.secretKey, hcaptchaTokenFormData);
+      const result = await this.hcaptcha.verify(this.secretKey, token);
 
-      if (!result.success) throw ShieldHcaptchaError;
-      return next();
+      return result.success;
     } catch {
-      throw ShieldHcaptchaError;
+      return false;
     }
-  });
+  }
 }

package/src/shield-maintenance-hono.strategy.ts

@@ -0,0 +1,23 @@
+import type { MiddlewareHandler } from "hono";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { type ShieldMaintenanceConfig, ShieldMaintenanceStrategy } from "./shield-maintenance.strategy";
+
+export class ShieldMaintenanceHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldMaintenanceStrategy;
+
+  constructor(config?: ShieldMaintenanceConfig) {
+    this.strategy = new ShieldMaintenanceStrategy(config);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (c, next) => {
+      const maintenance = this.strategy.evaluate();
+
+      if (!maintenance.enabled) return next();
+
+      return c.json({ reason: "maintenance" }, 503, {
+        "Retry-After": maintenance.RetryAfter.seconds.toString(),
+      });
+    };
+  }
+}

package/src/shield-maintenance.strategy.ts

@@ -0,0 +1,17 @@
+import * as tools from "@bgord/tools";
+
+export type ShieldMaintenanceConfig = { enabled: boolean; RetryAfter?: tools.Duration };
+
+export class ShieldMaintenanceStrategy {
+  private readonly enabled: boolean;
+  private readonly RetryAfter: tools.Duration;
+
+  constructor(config?: ShieldMaintenanceConfig) {
+    this.enabled = config?.enabled ?? false;
+    this.RetryAfter = config?.RetryAfter ?? tools.Duration.Hours(1);
+  }
+
+  evaluate(): { enabled: boolean; RetryAfter: tools.Duration } {
+    return { enabled: this.enabled, RetryAfter: this.RetryAfter };
+  }
+}

package/src/shield-rate-limit-hono.strategy.ts

@@ -0,0 +1,34 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import type { CacheResolverStrategy } from "./cache-resolver.strategy";
+import type { ClockPort } from "./clock.port";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
+import {
+  type ShieldRateLimitConfig,
+  ShieldRateLimitStrategy,
+  ShieldRateLimitStrategyError,
+} from "./shield-rate-limit.strategy";
+
+type Dependencies = { Clock: ClockPort; CacheResolver: CacheResolverStrategy };
+
+export const ShieldRateLimitError = new HTTPException(429, {
+  message: ShieldRateLimitStrategyError.Rejected,
+});
+
+export class ShieldRateLimitHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldRateLimitStrategy;
+
+  constructor(config: ShieldRateLimitConfig, deps: Dependencies) {
+    this.strategy = new ShieldRateLimitStrategy(config, deps);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (c, next) => {
+      const context = new RequestContextHonoAdapter(c);
+
+      if (await this.strategy.evaluate(context)) return next();
+      throw ShieldRateLimitError;
+    };
+  }
+}

package/src/shield-rate-limit.strategy.ts

@@ -1,37 +1,29 @@
 import * as tools from "@bgord/tools";
-import { createMiddleware } from "hono/factory";
-import { HTTPException } from "hono/http-exception";
 import type { CacheResolverStrategy } from "./cache-resolver.strategy";
-import type { CacheSubjectRequestResolver } from "./cache-subject-request-resolver.vo";
 import type { ClockPort } from "./clock.port";
-import { RequestContextAdapterHono } from "./request-context-hono.adapter";
-import type { ShieldStrategy } from "./shield.strategy";
+import type { RequestContext } from "./request-context.port";
+import type { SubjectRequestResolver } from "./subject-request-resolver.vo";
 
-type ShieldRateLimitOptionsType = { resolver: CacheSubjectRequestResolver; window: tools.Duration };
+export type ShieldRateLimitConfig = { resolver: SubjectRequestResolver; window: tools.Duration };
 
 type Dependencies = { Clock: ClockPort; CacheResolver: CacheResolverStrategy };
 
-export const ShieldRateLimitError = new HTTPException(429, { message: "shield.rate.limit" });
+export const ShieldRateLimitStrategyError = { Rejected: "shield.rate.limit.rejected" };
 
-export class ShieldRateLimitStrategy implements ShieldStrategy {
+export class ShieldRateLimitStrategy {
   constructor(
-    private readonly options: ShieldRateLimitOptionsType,
+    private readonly config: ShieldRateLimitConfig,
     private readonly deps: Dependencies,
   ) {}
 
-  verify = createMiddleware(async (c, next) => {
-    const context = new RequestContextAdapterHono(c);
-    const subject = await this.options.resolver.resolve(context);
+  async evaluate(context: RequestContext): Promise<boolean> {
+    const subject = await this.config.resolver.resolve(context);
 
     const limiter = await this.deps.CacheResolver.resolve(
       subject.hex,
-      async () => new tools.RateLimiter(this.options.window),
+      async () => new tools.RateLimiter(this.config.window),
     );
 
-    const result = limiter.verify(this.deps.Clock.now());
-
-    if (!result.allowed) throw ShieldRateLimitError;
-
-    return next();
-  });
+    return limiter.verify(this.deps.Clock.now()).allowed;
+  }
 }

package/src/shield-recaptcha-hono.strategy.ts

@@ -0,0 +1,31 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
+import {
+  type ShieldRecaptchaConfig,
+  ShieldRecaptchaStrategy,
+  ShieldRecaptchaStrategyError,
+} from "./shield-recaptcha.strategy";
+
+export const ShieldRecaptchaError = new HTTPException(403, {
+  message: ShieldRecaptchaStrategyError.Rejected,
+});
+
+export class ShieldRecaptchaHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldRecaptchaStrategy;
+
+  constructor(config: ShieldRecaptchaConfig) {
+    this.strategy = new ShieldRecaptchaStrategy(config);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (c, next) => {
+      const context = new RequestContextHonoAdapter(c);
+      const token = (await c.req.formData()).get("g-recaptcha-response")?.toString() ?? null;
+
+      if (await this.strategy.evaluate(context, token)) return next();
+      throw ShieldRecaptchaError;
+    };
+  }
+}

package/src/shield-recaptcha.strategy.ts

@@ -1,34 +1,28 @@
 import * as tools from "@bgord/tools";
-import { createMiddleware } from "hono/factory";
-import { HTTPException } from "hono/http-exception";
 import type { RecaptchaSecretKeyType } from "./recaptcha-secret-key.vo";
-import { RequestContextAdapterHono } from "./request-context-hono.adapter";
-import type { ShieldStrategy } from "./shield.strategy";
+import type { HasRequestHeader, HasRequestQuery } from "./request-context.port";
 
-export type RecaptchaVerifierConfigType = { secretKey: RecaptchaSecretKeyType };
-export type RecaptchaResultType = { success: boolean; score: number };
+export type ShieldRecaptchaConfig = { secretKey: RecaptchaSecretKeyType };
+export type RecaptchaResult = { success: boolean; score: number };
 
-export const ShieldRecaptchaError = new HTTPException(403, { message: "shield.recaptcha" });
+export const ShieldRecaptchaStrategyError = { Rejected: "shield.recaptcha.rejected" };
 
-export class ShieldRecaptchaStrategy implements ShieldStrategy {
+export class ShieldRecaptchaStrategy {
   private static readonly URL = tools.UrlWithoutSlash.parse(
     "https://www.google.com/recaptcha/api/siteverify",
   );
 
-  constructor(private readonly config: RecaptchaVerifierConfigType) {}
+  constructor(private readonly config: ShieldRecaptchaConfig) {}
 
-  verify = createMiddleware(async (c, next) => {
+  async evaluate(context: HasRequestHeader & HasRequestQuery, formToken: string | null): Promise<boolean> {
     try {
-      const context = new RequestContextAdapterHono(c);
-
       const header = context.request.header("x-recaptcha-token");
       const query = context.request.query().recaptchaToken;
-      const form = (await c.req.formData()).get("g-recaptcha-response")?.toString();
       const remoteip = context.request.header("x-forwarded-for") ?? "";
 
-      const token = header ?? query ?? form;
+      const token = header ?? query ?? formToken;
 
-      if (!token) throw ShieldRecaptchaError;
+      if (!token) return false;
 
       const params = new URLSearchParams({ secret: this.config.secretKey, response: token, remoteip });
 
@@ -38,13 +32,13 @@ export class ShieldRecaptchaStrategy implements ShieldStrategy {
         body: params,
       });
 
-      const result: RecaptchaResultType = await response.json();
+      const result: RecaptchaResult = await response.json();
 
-      if (!result.success || result.score < 0.5) throw ShieldRecaptchaError;
+      if (!result.success || result.score < 0.5) return false;
 
-      await next();
+      return true;
     } catch {
-      throw ShieldRecaptchaError;
+      return false;
     }
-  });
+  }
 }

package/src/shield-security-hono.strategy.ts

@@ -0,0 +1,62 @@
+import type { MiddlewareHandler } from "hono";
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
+import type { SecurityPolicy } from "./security-policy.vo";
+import { ShieldSecurityStrategy } from "./shield-security.strategy";
+import type { SleeperPort } from "./sleeper.port";
+
+type Dependencies = { Sleeper: SleeperPort };
+
+export const ShieldSecurityHonoStrategyError = {
+  Unhandled: "shield.security.hono.strategy.error.unhandled",
+};
+
+export class ShieldSecurityHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldSecurityStrategy;
+
+  constructor(
+    policies: ReadonlyArray<SecurityPolicy>,
+    private readonly deps: Dependencies,
+  ) {
+    this.strategy = new ShieldSecurityStrategy(policies);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (c, next) => {
+      const context = new RequestContextHonoAdapter(c);
+      const action = await this.strategy.evaluate(context);
+
+      if (!action) return next();
+
+      switch (action.kind) {
+        case "allow":
+          return next();
+
+        case "deny":
+          return c.text(action.reason, action.response.status as ContentfulStatusCode);
+
+        case "mirage":
+          return c.json({}, action.response.status as ContentfulStatusCode);
+
+        case "delay": {
+          await this.deps.Sleeper.wait(action.duration);
+
+          switch (action.after.kind) {
+            case "allow":
+              return next();
+
+            case "deny":
+              return c.text(action.after.reason, action.after.response.status as ContentfulStatusCode);
+
+            case "mirage":
+              return c.json({}, action.after.response.status as ContentfulStatusCode);
+
+            default:
+              throw new Error(ShieldSecurityHonoStrategyError.Unhandled);
+          }
+        }
+      }
+    };
+  }
+}

package/src/shield-security.strategy.ts

@@ -1,81 +1,38 @@
-import { createMiddleware } from "hono/factory";
-import type { ContentfulStatusCode } from "hono/utils/http-status";
 import { Client } from "./client.vo";
-import { RequestContextAdapterHono } from "./request-context-hono.adapter";
+import type { HasIdentityIp, HasIdentityUa, HasIdentityUserId, RequestContext } from "./request-context.port";
 import { SecurityContext } from "./security-context.vo";
+import type { SecurityAction } from "./security-countermeasure.strategy";
 import type { SecurityPolicy } from "./security-policy.vo";
-import type { ShieldStrategy } from "./shield.strategy";
-import type { SleeperPort } from "./sleeper.port";
 
-type Dependencies = { Sleeper: SleeperPort };
-
-export const ShieldSecurityAdapterError = {
-  Unhandled: "shield.security.adapter.error.unhandled",
-  MissingPolicies: "shield.security.adapter.error.missing.policies",
-  MaxPolicies: "shield.security.adapter.error.max.policies",
+export const ShieldSecurityStrategyError = {
+  MissingPolicies: "shield.security.strategy.error.missing.policies",
+  MaxPolicies: "shield.security.strategy.error.max.policies",
 };
 
-export class ShieldSecurityStrategy implements ShieldStrategy {
-  constructor(
-    private readonly policies: ReadonlyArray<SecurityPolicy>,
-    private readonly deps: Dependencies,
-  ) {
-    if (policies.length === 0) throw new Error(ShieldSecurityAdapterError.MissingPolicies);
-    if (policies.length > 5) throw new Error(ShieldSecurityAdapterError.MaxPolicies);
+export class ShieldSecurityStrategy {
+  constructor(private readonly policies: ReadonlyArray<SecurityPolicy>) {
+    if (policies.length === 0) throw new Error(ShieldSecurityStrategyError.MissingPolicies);
+    if (policies.length > 5) throw new Error(ShieldSecurityStrategyError.MaxPolicies);
   }
 
-  verify = createMiddleware(async (c, next) => {
+  async evaluate(
+    context: RequestContext & HasIdentityIp & HasIdentityUa & HasIdentityUserId,
+  ): Promise<SecurityAction | null> {
     for (const policy of this.policies) {
-      const request = new RequestContextAdapterHono(c);
-
-      const violation = await policy.rule.isViolated(request);
+      const violation = await policy.rule.isViolated(context);
 
       if (!violation) continue;
 
-      const context = new SecurityContext(
+      const securityContext = new SecurityContext(
         policy.rule.name,
         policy.countermeasure.name,
-        Client.fromParts(request.identity.ip(), request.identity.ua()),
-        request.identity.userId(),
+        Client.fromParts(context.identity.ip(), context.identity.ua()),
+        context.identity.userId(),
       );
 
-      const action = await policy.countermeasure.execute(context);
-
-      // Stryker disable all
-      switch (action.kind) {
-        case "allow":
-          return next();
-
-        case "deny":
-          return c.text(action.reason, action.response.status as ContentfulStatusCode);
-
-        case "mirage":
-          return c.json({}, action.response.status as ContentfulStatusCode);
-
-        case "delay": {
-          await this.deps.Sleeper.wait(action.duration);
-
-          switch (action.after.kind) {
-            case "allow":
-              return next();
-
-            case "deny":
-              return c.text(action.after.reason, action.after.response.status as ContentfulStatusCode);
-
-            case "mirage":
-              return c.json({}, action.after.response.status as ContentfulStatusCode);
-
-            case "delay":
-              throw new Error(ShieldSecurityAdapterError.Unhandled);
-
-            default:
-              throw new Error(ShieldSecurityAdapterError.Unhandled);
-          }
-        }
-      }
-      // Stryker restore all
+      return await policy.countermeasure.execute(securityContext);
     }
 
-    return next();
-  });
+    return null;
+  }
 }

package/src/shield-timeout-hono.strategy.ts

@@ -0,0 +1,25 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { timeout } from "hono/timeout";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import {
+  type ShieldTimeoutConfig,
+  ShieldTimeoutStrategy,
+  ShieldTimeoutStrategyError,
+} from "./shield-timeout.strategy";
+
+export const ShieldTimeoutError = new HTTPException(408, { message: ShieldTimeoutStrategyError.Rejected });
+
+export class ShieldTimeoutHonoStrategy implements MiddlewareHonoPort {
+  private readonly timeout: MiddlewareHandler;
+
+  constructor(config: ShieldTimeoutConfig) {
+    const strategy = new ShieldTimeoutStrategy(config);
+
+    this.timeout = timeout(strategy.config.duration.ms, ShieldTimeoutError);
+  }
+
+  handle(): MiddlewareHandler {
+    return this.timeout;
+  }
+}