@bgord/bun 1.10.23 → 1.12.0

package/src/shield-rate-limit.strategy.ts

@@ -1,37 +1,29 @@
 import * as tools from "@bgord/tools";
-import { createMiddleware } from "hono/factory";
-import { HTTPException } from "hono/http-exception";
 import type { CacheResolverStrategy } from "./cache-resolver.strategy";
-import type { CacheSubjectRequestResolver } from "./cache-subject-request-resolver.vo";
 import type { ClockPort } from "./clock.port";
-import { RequestContextAdapterHono } from "./request-context-hono.adapter";
-import type { ShieldStrategy } from "./shield.strategy";
+import type { RequestContext } from "./request-context.port";
+import type { SubjectRequestResolver } from "./subject-request-resolver.vo";
 
-type ShieldRateLimitOptionsType = { resolver: CacheSubjectRequestResolver; window: tools.Duration };
+export type ShieldRateLimitConfig = { resolver: SubjectRequestResolver; window: tools.Duration };
 
 type Dependencies = { Clock: ClockPort; CacheResolver: CacheResolverStrategy };
 
-export const ShieldRateLimitError = new HTTPException(429, { message: "shield.rate.limit" });
+export const ShieldRateLimitStrategyError = { Rejected: "shield.rate.limit.rejected" };
 
-export class ShieldRateLimitStrategy implements ShieldStrategy {
+export class ShieldRateLimitStrategy {
   constructor(
-    private readonly options: ShieldRateLimitOptionsType,
+    private readonly config: ShieldRateLimitConfig,
     private readonly deps: Dependencies,
   ) {}
 
-  verify = createMiddleware(async (c, next) => {
-    const context = new RequestContextAdapterHono(c);
-    const subject = await this.options.resolver.resolve(context);
+  async evaluate(context: RequestContext): Promise<boolean> {
+    const subject = await this.config.resolver.resolve(context);
 
     const limiter = await this.deps.CacheResolver.resolve(
       subject.hex,
-      async () => new tools.RateLimiter(this.options.window),
+      async () => new tools.RateLimiter(this.config.window),
     );
 
-    const result = limiter.verify(this.deps.Clock.now());
-
-    if (!result.allowed) throw ShieldRateLimitError;
-
-    return next();
-  });
+    return limiter.verify(this.deps.Clock.now()).allowed;
+  }
 }

package/src/shield-recaptcha-hono.strategy.ts

@@ -0,0 +1,31 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
+import {
+  type ShieldRecaptchaConfig,
+  ShieldRecaptchaStrategy,
+  ShieldRecaptchaStrategyError,
+} from "./shield-recaptcha.strategy";
+
+export const ShieldRecaptchaError = new HTTPException(403, {
+  message: ShieldRecaptchaStrategyError.Rejected,
+});
+
+export class ShieldRecaptchaHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldRecaptchaStrategy;
+
+  constructor(config: ShieldRecaptchaConfig) {
+    this.strategy = new ShieldRecaptchaStrategy(config);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (c, next) => {
+      const context = new RequestContextHonoAdapter(c);
+      const token = (await c.req.formData()).get("g-recaptcha-response")?.toString() ?? null;
+
+      if (await this.strategy.evaluate(context, token)) return next();
+      throw ShieldRecaptchaError;
+    };
+  }
+}

package/src/shield-recaptcha.strategy.ts

@@ -1,34 +1,28 @@
 import * as tools from "@bgord/tools";
-import { createMiddleware } from "hono/factory";
-import { HTTPException } from "hono/http-exception";
 import type { RecaptchaSecretKeyType } from "./recaptcha-secret-key.vo";
-import { RequestContextAdapterHono } from "./request-context-hono.adapter";
-import type { ShieldStrategy } from "./shield.strategy";
+import type { HasRequestHeader, HasRequestQuery } from "./request-context.port";
 
-export type RecaptchaVerifierConfigType = { secretKey: RecaptchaSecretKeyType };
-export type RecaptchaResultType = { success: boolean; score: number };
+export type ShieldRecaptchaConfig = { secretKey: RecaptchaSecretKeyType };
+export type RecaptchaResult = { success: boolean; score: number };
 
-export const ShieldRecaptchaError = new HTTPException(403, { message: "shield.recaptcha" });
+export const ShieldRecaptchaStrategyError = { Rejected: "shield.recaptcha.rejected" };
 
-export class ShieldRecaptchaStrategy implements ShieldStrategy {
+export class ShieldRecaptchaStrategy {
   private static readonly URL = tools.UrlWithoutSlash.parse(
     "https://www.google.com/recaptcha/api/siteverify",
   );
 
-  constructor(private readonly config: RecaptchaVerifierConfigType) {}
+  constructor(private readonly config: ShieldRecaptchaConfig) {}
 
-  verify = createMiddleware(async (c, next) => {
+  async evaluate(context: HasRequestHeader & HasRequestQuery, formToken: string | null): Promise<boolean> {
     try {
-      const context = new RequestContextAdapterHono(c);
-
       const header = context.request.header("x-recaptcha-token");
       const query = context.request.query().recaptchaToken;
-      const form = (await c.req.formData()).get("g-recaptcha-response")?.toString();
       const remoteip = context.request.header("x-forwarded-for") ?? "";
 
-      const token = header ?? query ?? form;
+      const token = header ?? query ?? formToken;
 
-      if (!token) throw ShieldRecaptchaError;
+      if (!token) return false;
 
       const params = new URLSearchParams({ secret: this.config.secretKey, response: token, remoteip });
 
@@ -38,13 +32,13 @@ export class ShieldRecaptchaStrategy implements ShieldStrategy {
         body: params,
       });
 
-      const result: RecaptchaResultType = await response.json();
+      const result: RecaptchaResult = await response.json();
 
-      if (!result.success || result.score < 0.5) throw ShieldRecaptchaError;
+      if (!result.success || result.score < 0.5) return false;
 
-      await next();
+      return true;
     } catch {
-      throw ShieldRecaptchaError;
+      return false;
     }
-  });
+  }
 }

package/src/shield-security-hono.strategy.ts

@@ -0,0 +1,62 @@
+import type { MiddlewareHandler } from "hono";
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
+import type { SecurityPolicy } from "./security-policy.vo";
+import { ShieldSecurityStrategy } from "./shield-security.strategy";
+import type { SleeperPort } from "./sleeper.port";
+
+type Dependencies = { Sleeper: SleeperPort };
+
+export const ShieldSecurityHonoStrategyError = {
+  Unhandled: "shield.security.hono.strategy.error.unhandled",
+};
+
+export class ShieldSecurityHonoStrategy implements MiddlewareHonoPort {
+  private readonly strategy: ShieldSecurityStrategy;
+
+  constructor(
+    policies: ReadonlyArray<SecurityPolicy>,
+    private readonly deps: Dependencies,
+  ) {
+    this.strategy = new ShieldSecurityStrategy(policies);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (c, next) => {
+      const context = new RequestContextHonoAdapter(c);
+      const action = await this.strategy.evaluate(context);
+
+      if (!action) return next();
+
+      switch (action.kind) {
+        case "allow":
+          return next();
+
+        case "deny":
+          return c.text(action.reason, action.response.status as ContentfulStatusCode);
+
+        case "mirage":
+          return c.json({}, action.response.status as ContentfulStatusCode);
+
+        case "delay": {
+          await this.deps.Sleeper.wait(action.duration);
+
+          switch (action.after.kind) {
+            case "allow":
+              return next();
+
+            case "deny":
+              return c.text(action.after.reason, action.after.response.status as ContentfulStatusCode);
+
+            case "mirage":
+              return c.json({}, action.after.response.status as ContentfulStatusCode);
+
+            default:
+              throw new Error(ShieldSecurityHonoStrategyError.Unhandled);
+          }
+        }
+      }
+    };
+  }
+}

package/src/shield-security.strategy.ts

@@ -1,81 +1,38 @@
-import { createMiddleware } from "hono/factory";
-import type { ContentfulStatusCode } from "hono/utils/http-status";
 import { Client } from "./client.vo";
-import { RequestContextAdapterHono } from "./request-context-hono.adapter";
+import type { HasIdentityIp, HasIdentityUa, HasIdentityUserId, RequestContext } from "./request-context.port";
 import { SecurityContext } from "./security-context.vo";
+import type { SecurityAction } from "./security-countermeasure.strategy";
 import type { SecurityPolicy } from "./security-policy.vo";
-import type { ShieldStrategy } from "./shield.strategy";
-import type { SleeperPort } from "./sleeper.port";
 
-type Dependencies = { Sleeper: SleeperPort };
-
-export const ShieldSecurityAdapterError = {
-  Unhandled: "shield.security.adapter.error.unhandled",
-  MissingPolicies: "shield.security.adapter.error.missing.policies",
-  MaxPolicies: "shield.security.adapter.error.max.policies",
+export const ShieldSecurityStrategyError = {
+  MissingPolicies: "shield.security.strategy.error.missing.policies",
+  MaxPolicies: "shield.security.strategy.error.max.policies",
 };
 
-export class ShieldSecurityStrategy implements ShieldStrategy {
-  constructor(
-    private readonly policies: ReadonlyArray<SecurityPolicy>,
-    private readonly deps: Dependencies,
-  ) {
-    if (policies.length === 0) throw new Error(ShieldSecurityAdapterError.MissingPolicies);
-    if (policies.length > 5) throw new Error(ShieldSecurityAdapterError.MaxPolicies);
+export class ShieldSecurityStrategy {
+  constructor(private readonly policies: ReadonlyArray<SecurityPolicy>) {
+    if (policies.length === 0) throw new Error(ShieldSecurityStrategyError.MissingPolicies);
+    if (policies.length > 5) throw new Error(ShieldSecurityStrategyError.MaxPolicies);
   }
 
-  verify = createMiddleware(async (c, next) => {
+  async evaluate(
+    context: RequestContext & HasIdentityIp & HasIdentityUa & HasIdentityUserId,
+  ): Promise<SecurityAction | null> {
     for (const policy of this.policies) {
-      const request = new RequestContextAdapterHono(c);
-
-      const violation = await policy.rule.isViolated(request);
+      const violation = await policy.rule.isViolated(context);
 
       if (!violation) continue;
 
-      const context = new SecurityContext(
+      const securityContext = new SecurityContext(
         policy.rule.name,
         policy.countermeasure.name,
-        Client.fromParts(request.identity.ip(), request.identity.ua()),
-        request.identity.userId(),
+        Client.fromParts(context.identity.ip(), context.identity.ua()),
+        context.identity.userId(),
       );
 
-      const action = await policy.countermeasure.execute(context);
-
-      // Stryker disable all
-      switch (action.kind) {
-        case "allow":
-          return next();
-
-        case "deny":
-          return c.text(action.reason, action.response.status as ContentfulStatusCode);
-
-        case "mirage":
-          return c.json({}, action.response.status as ContentfulStatusCode);
-
-        case "delay": {
-          await this.deps.Sleeper.wait(action.duration);
-
-          switch (action.after.kind) {
-            case "allow":
-              return next();
-
-            case "deny":
-              return c.text(action.after.reason, action.after.response.status as ContentfulStatusCode);
-
-            case "mirage":
-              return c.json({}, action.after.response.status as ContentfulStatusCode);
-
-            case "delay":
-              throw new Error(ShieldSecurityAdapterError.Unhandled);
-
-            default:
-              throw new Error(ShieldSecurityAdapterError.Unhandled);
-          }
-        }
-      }
-      // Stryker restore all
+      return await policy.countermeasure.execute(securityContext);
     }
 
-    return next();
-  });
+    return null;
+  }
 }

package/src/shield-timeout-hono.strategy.ts

@@ -0,0 +1,25 @@
+import type { MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { timeout } from "hono/timeout";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import {
+  type ShieldTimeoutConfig,
+  ShieldTimeoutStrategy,
+  ShieldTimeoutStrategyError,
+} from "./shield-timeout.strategy";
+
+export const ShieldTimeoutError = new HTTPException(408, { message: ShieldTimeoutStrategyError.Rejected });
+
+export class ShieldTimeoutHonoStrategy implements MiddlewareHonoPort {
+  private readonly timeout: MiddlewareHandler;
+
+  constructor(config: ShieldTimeoutConfig) {
+    const strategy = new ShieldTimeoutStrategy(config);
+
+    this.timeout = timeout(strategy.config.duration.ms, ShieldTimeoutError);
+  }
+
+  handle(): MiddlewareHandler {
+    return this.timeout;
+  }
+}

package/src/shield-timeout.strategy.ts

@@ -1,19 +1,9 @@
 import type * as tools from "@bgord/tools";
-import { createMiddleware } from "hono/factory";
-import { HTTPException } from "hono/http-exception";
-import { timeout } from "hono/timeout";
-import type { ShieldStrategy } from "./shield.strategy";
 
-export const ShieldTimeoutError = new HTTPException(408, { message: "shield.timeout" });
+export type ShieldTimeoutConfig = { duration: tools.Duration };
 
-type ShieldTimeoutConfigType = { duration: tools.Duration };
+export const ShieldTimeoutStrategyError = { Rejected: "shield.timeout.rejected" };
 
-export class ShieldTimeoutStrategy implements ShieldStrategy {
-  private readonly timeout;
-
-  constructor(config: ShieldTimeoutConfigType) {
-    this.timeout = timeout(config.duration.ms, ShieldTimeoutError);
-  }
-
-  verify = createMiddleware(async (context, next) => this.timeout(context, next));
+export class ShieldTimeoutStrategy {
+  constructor(readonly config: ShieldTimeoutConfig) {}
 }

package/src/simulated-error-hono.middleware.ts

@@ -0,0 +1,17 @@
+import type { MiddlewareHandler } from "hono";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import { SimulatedErrorMiddleware } from "./simulated-error.middleware";
+
+export class SimulatedErrorHonoMiddleware implements MiddlewareHonoPort {
+  private readonly middleware: SimulatedErrorMiddleware;
+
+  constructor() {
+    this.middleware = new SimulatedErrorMiddleware();
+  }
+
+  handle(): MiddlewareHandler {
+    return async (_c, _next) => {
+      this.middleware.evaluate();
+    };
+  }
+}

package/src/simulated-error.middleware.ts

@@ -1,8 +1,5 @@
-import { createMiddleware } from "hono/factory";
-
-export class SimulatedError {
-  static handle = () =>
-    createMiddleware(async (_, _next) => {
-      throw new Error("Simulated error");
-    });
+export class SimulatedErrorMiddleware {
+  evaluate(): never {
+    throw new Error("Simulated error");
+  }
 }

package/src/slower-hono.middleware.ts

@@ -0,0 +1,23 @@
+import type * as tools from "@bgord/tools";
+import type { MiddlewareHandler } from "hono";
+import type { MiddlewareHonoPort } from "./middleware-hono.port";
+import type { SleeperPort } from "./sleeper.port";
+import { SlowerMiddleware } from "./slower.middleware";
+
+type Dependencies = { Sleeper: SleeperPort };
+
+export class SlowerHonoMiddleware implements MiddlewareHonoPort {
+  private readonly middleware: SlowerMiddleware;
+
+  constructor(offset: tools.Duration, deps: Dependencies) {
+    this.middleware = new SlowerMiddleware(offset, deps);
+  }
+
+  handle(): MiddlewareHandler {
+    return async (_c, next) => {
+      await this.middleware.evaluate();
+
+      return next();
+    };
+  }
+}

package/src/slower.middleware.ts

@@ -1,14 +1,15 @@
 import type * as tools from "@bgord/tools";
-import { createMiddleware } from "hono/factory";
 import type { SleeperPort } from "./sleeper.port";
 
 type Dependencies = { Sleeper: SleeperPort };
 
-export class Slower {
-  static handle = (offset: tools.Duration, deps: Dependencies) =>
-    createMiddleware(async (_, next) => {
-      await deps.Sleeper.wait(offset);
+export class SlowerMiddleware {
+  constructor(
+    private readonly offset: tools.Duration,
+    private readonly deps: Dependencies,
+  ) {}
 
-      return next();
-    });
+  async evaluate(): Promise<void> {
+    await this.deps.Sleeper.wait(this.offset);
+  }
 }

package/src/ssr-bun.service.ts

@@ -0,0 +1,25 @@
+import type { NonceProviderPort } from "./nonce-provider.port";
+import type { NonceValueType } from "./nonce-value.vo";
+import { SSRService } from "./ssr.service";
+
+type Dependencies = { NonceProvider: NonceProviderPort };
+
+export class SSRBun {
+  static essentials(
+    handler: (request: Request, nonce: NonceValueType) => Promise<Response>,
+    deps: Dependencies,
+  ) {
+    const service = new SSRService(deps);
+
+    return async (request: Request): Promise<Response> => {
+      const nonce = service.nonce;
+
+      const response = await handler(request, nonce);
+
+      const headers = service.secure(nonce);
+      Object.entries(headers).forEach(([name, value]) => response.headers.set(name, value));
+
+      return response;
+    };
+  }
+}

package/src/ssr.service.ts

@@ -0,0 +1,66 @@
+import type { NonceProviderPort } from "./nonce-provider.port";
+import type { NonceValueType } from "./nonce-value.vo";
+
+type Dependencies = { NonceProvider: NonceProviderPort };
+
+export type SSRSecurityHeaders = {
+  "Content-Security-Policy": string;
+  "Permissions-Policy": string;
+  "Cross-Origin-Opener-Policy": string;
+  "Cross-Origin-Resource-Policy": string;
+  "Referrer-Policy": string;
+  "Strict-Transport-Security": string;
+  "X-Content-Type-Options": string;
+  "X-DNS-Prefetch-Control": string;
+  "X-Download-Options": string;
+  "X-Permitted-Cross-Domain-Policies": string;
+  "X-XSS-Protection": string;
+};
+
+export class SSRService {
+  constructor(private readonly deps: Dependencies) {}
+
+  get nonce(): NonceValueType {
+    return this.deps.NonceProvider.generate();
+  }
+
+  secure(nonce: NonceValueType): SSRSecurityHeaders {
+    return {
+      "Content-Security-Policy": [
+        "default-src 'none'",
+        "base-uri 'none'",
+        "object-src 'none'",
+        "frame-ancestors 'none'",
+        `script-src 'self' 'nonce-${nonce}'`,
+        `script-src-elem 'self' 'nonce-${nonce}'`,
+        `style-src 'self' 'nonce-${nonce}'`,
+        "style-src-attr 'unsafe-inline'",
+        "img-src 'self'",
+        "font-src 'self'",
+        "connect-src 'self'",
+        "form-action 'self'",
+      ].join("; "),
+      "Permissions-Policy": [
+        "accelerometer=()",
+        "autoplay=()",
+        "camera=()",
+        "fullscreen=(self)",
+        "geolocation=()",
+        "gyroscope=()",
+        "magnetometer=()",
+        "microphone=()",
+        "payment=()",
+        "usb=()",
+      ].join(", "),
+      "Cross-Origin-Opener-Policy": "same-origin",
+      "Cross-Origin-Resource-Policy": "same-origin",
+      "Referrer-Policy": "no-referrer",
+      "Strict-Transport-Security": "max-age=15552000; includeSubDomains",
+      "X-Content-Type-Options": "nosniff",
+      "X-DNS-Prefetch-Control": "off",
+      "X-Download-Options": "noopen",
+      "X-Permitted-Cross-Domain-Policies": "none",
+      "X-XSS-Protection": "0",
+    };
+  }
+}

package/src/{static-files.service.ts → static-files-hono.service.ts}

@@ -58,7 +58,7 @@ const staticDocumentHeaders = secureHeaders({
 
 type StaticFilesOptions = { root?: string };
 
-export class StaticFiles {
+export class StaticFilesHono {
   static handle(path: string, strategy: StaticFilesStrategy, options?: StaticFilesOptions) {
     // Stryker disable all
     const root = options?.root ?? "./";

package/src/subject-application-resolver.vo.ts

@@ -0,0 +1,34 @@
+import type { Hash } from "./hash.vo";
+import type { HashContentStrategy } from "./hash-content.strategy";
+import type { SubjectSegmentApplicationStrategy } from "./subject-segment-application.strategy";
+import type { SubjectSegmentType } from "./subject-segment-request.strategy";
+
+type Dependencies = { HashContent: HashContentStrategy };
+
+export const SubjectApplicationResolverError = {
+  NoSegments: "subject.application.no.segments",
+  TooManySegments: "subject.application.too.many.segments",
+};
+
+export class SubjectApplicationResolver {
+  private readonly SEPARATOR = "|";
+
+  constructor(
+    private readonly segments: ReadonlyArray<SubjectSegmentApplicationStrategy>,
+    private readonly deps: Dependencies,
+  ) {
+    if (this.segments.length === 0) throw new Error(SubjectApplicationResolverError.NoSegments);
+    if (this.segments.length > 10) throw new Error(SubjectApplicationResolverError.TooManySegments);
+  }
+
+  async resolve(): Promise<{ hex: Hash; raw: ReadonlyArray<SubjectSegmentType> }> {
+    const segments = this.segments.map((segment) =>
+      segment.create().replaceAll(this.SEPARATOR, encodeURIComponent(this.SEPARATOR)),
+    );
+    const subject = segments.join(this.SEPARATOR);
+
+    const hex = await this.deps.HashContent.hash(subject);
+
+    return { hex, raw: segments };
+  }
+}

package/src/subject-request-resolver.vo.ts

@@ -0,0 +1,34 @@
+import type { Hash } from "./hash.vo";
+import type { HashContentStrategy } from "./hash-content.strategy";
+import type { RequestContext } from "./request-context.port";
+import type { SubjectSegmentRequestStrategy, SubjectSegmentType } from "./subject-segment-request.strategy";
+
+type Dependencies = { HashContent: HashContentStrategy };
+
+export const SubjectRequestResolverError = {
+  NoSegments: "subject.request.no.segments",
+  TooManySegments: "subject.request.too.many.segments",
+};
+
+export class SubjectRequestResolver {
+  private readonly SEPARATOR = "|";
+
+  constructor(
+    private readonly segments: ReadonlyArray<SubjectSegmentRequestStrategy>,
+    private readonly deps: Dependencies,
+  ) {
+    if (this.segments.length === 0) throw new Error(SubjectRequestResolverError.NoSegments);
+    if (this.segments.length > 10) throw new Error(SubjectRequestResolverError.TooManySegments);
+  }
+
+  async resolve(context: RequestContext): Promise<{ hex: Hash; raw: ReadonlyArray<SubjectSegmentType> }> {
+    const segments = this.segments.map((segment) =>
+      segment.create(context).replaceAll(this.SEPARATOR, encodeURIComponent(this.SEPARATOR)),
+    );
+    const subject = segments.join(this.SEPARATOR);
+
+    const hex = await this.deps.HashContent.hash(subject);
+
+    return { hex, raw: segments };
+  }
+}

package/src/subject-segment-application.strategy.ts

@@ -0,0 +1,7 @@
+import type { SubjectSegmentType } from "./subject-segment-request.strategy";
+
+export const SubjectSegmentApplicationEmpty: SubjectSegmentType = "__absent__";
+
+export interface SubjectSegmentApplicationStrategy {
+  create(): SubjectSegmentType;
+}

package/src/subject-segment-build.strategy.ts

@@ -0,0 +1,15 @@
+import type * as tools from "@bgord/tools";
+import {
+  SubjectSegmentApplicationEmpty,
+  type SubjectSegmentApplicationStrategy,
+} from "./subject-segment-application.strategy";
+import type { SubjectSegmentType } from "./subject-segment-request.strategy";
+
+export class SubjectSegmentBuildStrategy implements SubjectSegmentApplicationStrategy {
+  constructor(private readonly build?: tools.PackageVersion) {}
+
+  create(): SubjectSegmentType {
+    if (!this.build) return SubjectSegmentApplicationEmpty;
+    return this.build.toString();
+  }
+}

package/src/subject-segment-cookie.strategy.ts

@@ -0,0 +1,14 @@
+import type { HasRequestCookie } from "./request-context.port";
+import type { SubjectSegmentType } from "./subject-segment-request.strategy";
+import {
+  SubjectSegmentRequestEmpty,
+  type SubjectSegmentRequestStrategy,
+} from "./subject-segment-request.strategy";
+
+export class SubjectSegmentCookieStrategy implements SubjectSegmentRequestStrategy {
+  constructor(private readonly name: string) {}
+
+  create(context: HasRequestCookie): SubjectSegmentType {
+    return context.request.cookie(this.name) ?? SubjectSegmentRequestEmpty;
+  }
+}