@bgord/bun 1.6.7 → 1.7.0

package/src/retry-backoff-linear.strategy.ts

@@ -0,0 +1,10 @@
+import * as tools from "@bgord/tools";
+import type { RetryBackoffStrategy } from "./retry-backoff.strategy";
+
+export class RetryBackoffLinearStrategy implements RetryBackoffStrategy {
+  constructor(private readonly delay: tools.Duration) {}
+
+  next(attempt: number) {
+    return this.delay.times(tools.MultiplicationFactor.parse(attempt));
+  }
+}

package/src/retry-backoff-noop.strategy.ts

@@ -0,0 +1,8 @@
+import * as tools from "@bgord/tools";
+import type { RetryBackoffStrategy } from "./retry-backoff.strategy";
+
+export class RetryBackoffNoopStrategy implements RetryBackoffStrategy {
+  next() {
+    return tools.Duration.Ms(0);
+  }
+}

package/src/retry-backoff.strategy.ts

@@ -0,0 +1,5 @@
+import type * as tools from "@bgord/tools";
+
+export interface RetryBackoffStrategy {
+  next(attempt: number): tools.Duration;
+}

package/src/retry.service.ts

@@ -0,0 +1,36 @@
+import type { RetryBackoffStrategy } from "./retry-backoff.strategy";
+import type { SleeperPort } from "./sleeper.port";
+
+type Dependencies = { Sleeper: SleeperPort };
+
+export type RetryConfigType = {
+  max: number;
+  backoff: RetryBackoffStrategy;
+  when?: (error: unknown) => boolean;
+};
+
+export const RetryError = { InvalidMax: "retry.invalid.max" };
+
+export class Retry {
+  constructor(private readonly deps: Dependencies) {}
+
+  async run<T>(action: () => Promise<T>, config: RetryConfigType): Promise<T> {
+    if (config.max < 1) throw new Error(RetryError.InvalidMax);
+
+    let lastError: unknown;
+
+    for (let attempt = 1; attempt <= config.max; attempt++) {
+      try {
+        return await action();
+      } catch (error) {
+        lastError = error;
+
+        if (attempt === config.max || (config.when && !config.when(error))) break;
+
+        await this.deps.Sleeper.wait(config.backoff.next(attempt));
+      }
+    }
+
+    throw lastError;
+  }
+}

package/src/sealer-aes-gcm.adapter.ts

@@ -0,0 +1,38 @@
+import { CryptoAesGcm } from "./crypto-aes-gcm.service";
+import type { CryptoKeyProviderPort } from "./crypto-key-provider.port";
+import { EncryptionIV } from "./encryption-iv.vo";
+import type { SealerPort } from "./sealer.port";
+
+type Dependencies = { CryptoKeyProvider: CryptoKeyProviderPort };
+
+export const SealerAesGcmAdapterError = { InvalidPayload: "sealer.aes.gcm.adapter.invalid.payload" };
+
+export class SealerAesGcmAdapter implements SealerPort {
+  private static readonly PREFIX = "sealed:gcm:";
+
+  constructor(private readonly deps: Dependencies) {}
+
+  async seal(value: unknown): Promise<string> {
+    const key = await this.deps.CryptoKeyProvider.get();
+
+    const iv = EncryptionIV.generate();
+    const plaintext = new TextEncoder().encode(JSON.stringify(value));
+
+    const payload = await CryptoAesGcm.encrypt(key, plaintext.buffer, iv);
+
+    return SealerAesGcmAdapter.PREFIX + Buffer.from(payload).toString("base64");
+  }
+
+  async unseal(value: string): Promise<unknown> {
+    if (!value.startsWith(SealerAesGcmAdapter.PREFIX)) {
+      throw new Error(SealerAesGcmAdapterError.InvalidPayload);
+    }
+
+    const key = await this.deps.CryptoKeyProvider.get();
+    const bytes = Buffer.from(value.slice(SealerAesGcmAdapter.PREFIX.length), "base64");
+
+    const decrypted = await CryptoAesGcm.decrypt(key, bytes);
+
+    return JSON.parse(new TextDecoder().decode(decrypted));
+  }
+}

package/src/sealer-noop.adapter.ts

@@ -0,0 +1,11 @@
+import type { SealerPort } from "./sealer.port";
+
+export class SealerNoopAdapter implements SealerPort {
+  async seal(value: unknown): Promise<string> {
+    return `sealed:${JSON.stringify(value)}`;
+  }
+
+  async unseal(value: string): Promise<unknown> {
+    return JSON.parse(value.replace("sealed:", ""));
+  }
+}

package/src/sealer.port.ts

@@ -0,0 +1,4 @@
+export interface SealerPort {
+  seal(value: unknown): Promise<string>;
+  unseal(value: string): Promise<unknown>;
+}

package/src/security-context.vo.ts

@@ -0,0 +1,11 @@
+import type { Client } from "./client.vo";
+import type { SecurityRuleNameType } from "./security-rule-name.vo";
+import type { UUIDType } from "./uuid.vo";
+
+export class SecurityContext {
+  constructor(
+    readonly rule: SecurityRuleNameType,
+    readonly client: Client,
+    readonly userId: UUIDType | undefined,
+  ) {}
+}

package/src/security-countermeasure-ban.strategy.ts

@@ -0,0 +1,62 @@
+import type { ClockPort } from "./clock.port";
+import { CorrelationStorage } from "./correlation-storage.service";
+import { createEventEnvelope } from "./event-envelope";
+import type { EventStoreLike } from "./event-store-like.types";
+import type { IdProviderPort } from "./id-provider.port";
+import type { LoggerPort } from "./logger.port";
+import {
+  SECURITY_VIOLATION_DETECTED_EVENT,
+  SecurityViolationDetectedEvent,
+  type SecurityViolationDetectedEventType,
+} from "./modules/system/events/SECURITY_VIOLATION_DETECTED_EVENT";
+import type { SecurityContext } from "./security-context.vo";
+import type { SecurityAction, SecurityCountermeasureStrategy } from "./security-countermeasure.strategy";
+import { SecurityCountermeasureName } from "./security-countermeasure-name.vo";
+
+type Dependencies = {
+  IdProvider: IdProviderPort;
+  Clock: ClockPort;
+  Logger: LoggerPort;
+  EventStore: EventStoreLike<SecurityViolationDetectedEventType>;
+};
+
+export const SecurityCountermeasureBanStrategyError = {
+  Executed: "security.countermeasure.ban.strategy.executed",
+};
+
+export class SecurityCountermeasureBanStrategy implements SecurityCountermeasureStrategy {
+  constructor(
+    private readonly deps: Dependencies,
+    private readonly config: { response: { status: number } } = { response: { status: 403 } },
+  ) {}
+
+  async execute(context: SecurityContext): Promise<SecurityAction> {
+    const action = {
+      kind: "deny",
+      reason: SecurityCountermeasureBanStrategyError.Executed,
+      ...this.config,
+    } as const;
+
+    this.deps.Logger.info({
+      message: "Security countermeasure ban",
+      component: "security",
+      operation: "security_countermeasure_ban",
+      correlationId: CorrelationStorage.get(),
+      metadata: context,
+    });
+
+    const event = SecurityViolationDetectedEvent.parse({
+      ...createEventEnvelope("security", this.deps),
+      name: SECURITY_VIOLATION_DETECTED_EVENT,
+      payload: { ...context, countermeasure: this.name, action: action.kind },
+    } satisfies SecurityViolationDetectedEventType);
+
+    await this.deps.EventStore.save([event]);
+
+    return action;
+  }
+
+  get name() {
+    return SecurityCountermeasureName.parse("ban");
+  }
+}

package/src/security-countermeasure-mirage.strategy.ts

@@ -0,0 +1,30 @@
+import { CorrelationStorage } from "./correlation-storage.service";
+import type { LoggerPort } from "./logger.port";
+import type { SecurityContext } from "./security-context.vo";
+import type { SecurityAction, SecurityCountermeasureStrategy } from "./security-countermeasure.strategy";
+import { SecurityCountermeasureName } from "./security-countermeasure-name.vo";
+
+type Dependencies = { Logger: LoggerPort };
+
+export class SecurityCountermeasureMirageStrategy implements SecurityCountermeasureStrategy {
+  constructor(
+    private readonly deps: Dependencies,
+    private readonly config: { response: { status: number } } = { response: { status: 200 } },
+  ) {}
+
+  async execute(context: SecurityContext): Promise<SecurityAction> {
+    this.deps.Logger.info({
+      message: "Security countermeasure mirage",
+      component: "security",
+      operation: "security_countermeasure_mirage",
+      correlationId: CorrelationStorage.get(),
+      metadata: context,
+    });
+
+    return { kind: "mirage", ...this.config };
+  }
+
+  get name() {
+    return SecurityCountermeasureName.parse("mirage");
+  }
+}

package/src/security-countermeasure-name.vo.ts

@@ -0,0 +1,20 @@
+import { z } from "zod/v4";
+
+export const SecurityCountermeasureNameError = {
+  Type: "security.countermeasure.name.type",
+  Empty: "security.countermeasure.name.empty",
+  TooLong: "security.countermeasure.name.too.long",
+  BadChars: "security.countermeasure.name.bad.chars",
+};
+
+// One to sixty four letters, digits, or underscores
+const CHARS_WHITELIST = /^[a-zA-Z0-9_]{1,64}$/;
+
+export const SecurityCountermeasureName = z
+  .string(SecurityCountermeasureNameError.Type)
+  .min(1, SecurityCountermeasureNameError.Empty)
+  .max(64, SecurityCountermeasureNameError.TooLong)
+  .regex(CHARS_WHITELIST, SecurityCountermeasureNameError.BadChars)
+  .brand("SecurityCountermeasureName");
+
+export type SecurityCountermeasureNameType = z.infer<typeof SecurityCountermeasureName>;

package/src/security-countermeasure-noop.strategy.ts

@@ -0,0 +1,12 @@
+import type { SecurityAction, SecurityCountermeasureStrategy } from "./security-countermeasure.strategy";
+import { SecurityCountermeasureName } from "./security-countermeasure-name.vo";
+
+export class SecurityCountermeasureNoopStrategy implements SecurityCountermeasureStrategy {
+  async execute(): Promise<SecurityAction> {
+    return { kind: "allow" };
+  }
+
+  get name() {
+    return SecurityCountermeasureName.parse("noop");
+  }
+}

package/src/security-countermeasure-report.strategy.ts

@@ -0,0 +1,27 @@
+import { CorrelationStorage } from "./correlation-storage.service";
+import type { LoggerPort } from "./logger.port";
+import type { SecurityContext } from "./security-context.vo";
+import type { SecurityAction, SecurityCountermeasureStrategy } from "./security-countermeasure.strategy";
+import { SecurityCountermeasureName } from "./security-countermeasure-name.vo";
+
+type Dependencies = { Logger: LoggerPort };
+
+export class SecurityCountermeasureReportStrategy implements SecurityCountermeasureStrategy {
+  constructor(private readonly deps: Dependencies) {}
+
+  async execute(context: SecurityContext): Promise<SecurityAction> {
+    this.deps.Logger.info({
+      message: "Security countermeasure report",
+      component: "security",
+      operation: "security_countermeasure_report",
+      correlationId: CorrelationStorage.get(),
+      metadata: context,
+    });
+
+    return { kind: "allow" };
+  }
+
+  get name() {
+    return SecurityCountermeasureName.parse("report");
+  }
+}

package/src/security-countermeasure-tarpit.strategy.ts

@@ -0,0 +1,31 @@
+import type * as tools from "@bgord/tools";
+import { CorrelationStorage } from "./correlation-storage.service";
+import type { LoggerPort } from "./logger.port";
+import type { SecurityContext } from "./security-context.vo";
+import type { SecurityAction, SecurityCountermeasureStrategy } from "./security-countermeasure.strategy";
+import { SecurityCountermeasureName } from "./security-countermeasure-name.vo";
+
+type Dependencies = { Logger: LoggerPort };
+
+export class SecurityCountermeasureTarpitStrategy implements SecurityCountermeasureStrategy {
+  constructor(
+    private readonly deps: Dependencies,
+    private readonly config: { duration: tools.Duration; after: SecurityAction },
+  ) {}
+
+  async execute(context: SecurityContext): Promise<SecurityAction> {
+    this.deps.Logger.info({
+      message: "Security countermeasure tarpit",
+      component: "security",
+      operation: "security_countermeasure_tarpit",
+      correlationId: CorrelationStorage.get(),
+      metadata: context,
+    });
+
+    return { kind: "delay", ...this.config };
+  }
+
+  get name() {
+    return SecurityCountermeasureName.parse("tarpit");
+  }
+}

package/src/security-countermeasure.strategy.ts

@@ -0,0 +1,15 @@
+import type * as tools from "@bgord/tools";
+import type { SecurityContext } from "./security-context.vo";
+import type { SecurityCountermeasureNameType } from "./security-countermeasure-name.vo";
+
+export type SecurityAction =
+  | { kind: "allow" }
+  | { kind: "deny"; reason: string; response: { status: number } }
+  | { kind: "delay"; duration: tools.Duration; after: SecurityAction }
+  | { kind: "mirage"; response: { status: number } };
+
+export interface SecurityCountermeasureStrategy {
+  execute(context: SecurityContext): Promise<SecurityAction>;
+
+  get name(): SecurityCountermeasureNameType;
+}

package/src/security-policy.vo.ts

@@ -0,0 +1,9 @@
+import type { SecurityCountermeasureStrategy } from "./security-countermeasure.strategy";
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+
+export class SecurityPolicy {
+  constructor(
+    readonly rule: SecurityRuleStrategy,
+    readonly countermeasure: SecurityCountermeasureStrategy,
+  ) {}
+}

package/src/security-rule-and.strategy.ts

@@ -0,0 +1,23 @@
+import type { Context } from "hono";
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+export const SecurityRuleAndStrategyError = {
+  MissingRules: "security.rule.and.adapter.error.missing.rules",
+  MaxRules: "security.rule.and.adapter.error.max.rules",
+};
+
+export class SecurityRuleAndStrategy implements SecurityRuleStrategy {
+  constructor(private readonly rules: SecurityRuleStrategy[]) {
+    if (rules.length === 0) throw new Error(SecurityRuleAndStrategyError.MissingRules);
+    if (rules.length > 5) throw new Error(SecurityRuleAndStrategyError.MaxRules);
+  }
+
+  async isViolated(c: Context) {
+    return this.rules.every((rule) => rule.isViolated(c));
+  }
+
+  get name() {
+    return SecurityRuleName.parse(`and_${this.rules.map((rule) => rule.name).join("_")}`);
+  }
+}

package/src/security-rule-bait-routes.strategy.ts

@@ -0,0 +1,15 @@
+import type { Context } from "hono";
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+export class SecurityRuleBaitRoutesStrategy implements SecurityRuleStrategy {
+  constructor(private readonly routes: string[]) {}
+
+  async isViolated(c: Context) {
+    return this.routes.includes(c.req.path);
+  }
+
+  get name() {
+    return SecurityRuleName.parse("bait_routes");
+  }
+}

package/src/security-rule-fail.strategy.ts

@@ -0,0 +1,12 @@
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+export class SecurityRuleFailStrategy implements SecurityRuleStrategy {
+  async isViolated() {
+    return true;
+  }
+
+  get name() {
+    return SecurityRuleName.parse("fail");
+  }
+}

package/src/security-rule-honey-pot-field.strategy.ts

@@ -0,0 +1,20 @@
+import type { Context } from "hono";
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+export class SecurityRuleHoneyPotFieldStrategy implements SecurityRuleStrategy {
+  constructor(private readonly field: string) {}
+
+  async isViolated(c: Context) {
+    const request = c.req.raw.clone();
+
+    const body = await request.json().catch(() => ({}));
+    const value = body[this.field];
+
+    return value !== undefined && value !== null && value !== "";
+  }
+
+  get name() {
+    return SecurityRuleName.parse("honey_pot_field");
+  }
+}

package/src/security-rule-name.vo.ts

@@ -0,0 +1,20 @@
+import { z } from "zod/v4";
+
+export const SecurityRuleNameError = {
+  Type: "security.rule.name.type",
+  Empty: "security.rule.name.empty",
+  TooLong: "security.rule.name.too.long",
+  BadChars: "security.rule.name.bad.chars",
+};
+
+// One to sixty four letters, digits, or underscores
+const CHARS_WHITELIST = /^[a-zA-Z0-9_]{1,512}$/;
+
+export const SecurityRuleName = z
+  .string(SecurityRuleNameError.Type)
+  .min(1, SecurityRuleNameError.Empty)
+  .max(512, SecurityRuleNameError.TooLong)
+  .regex(CHARS_WHITELIST, SecurityRuleNameError.BadChars)
+  .brand("SecurityRuleName");
+
+export type SecurityRuleNameType = z.infer<typeof SecurityRuleName>;

package/src/security-rule-or.strategy.ts

@@ -0,0 +1,23 @@
+import type { Context } from "hono";
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+export const SecurityRuleOrStrategyError = {
+  MissingRules: "security.rule.or.adapter.error.missing.rules",
+  MaxRules: "security.rule.or.adapter.error.max.rules",
+};
+
+export class SecurityRuleOrStrategy implements SecurityRuleStrategy {
+  constructor(private readonly rules: SecurityRuleStrategy[]) {
+    if (rules.length === 0) throw new Error(SecurityRuleOrStrategyError.MissingRules);
+    if (rules.length > 5) throw new Error(SecurityRuleOrStrategyError.MaxRules);
+  }
+
+  async isViolated(c: Context) {
+    return this.rules.some((rule) => rule.isViolated(c));
+  }
+
+  get name() {
+    return SecurityRuleName.parse(`or_${this.rules.map((rule) => rule.name).join("_")}`);
+  }
+}

package/src/security-rule-pass.strategy.ts

@@ -0,0 +1,12 @@
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+export class SecurityRulePassStrategy implements SecurityRuleStrategy {
+  async isViolated() {
+    return false;
+  }
+
+  get name() {
+    return SecurityRuleName.parse("pass");
+  }
+}

package/src/security-rule-user-agent.strategy.ts

@@ -0,0 +1,20 @@
+import type { Context } from "hono";
+import { ALL_BOTS } from "./bots.vo";
+import { ClientFromHono } from "./client-from-hono.adapter";
+import { ClientUserAgent } from "./client-user-agent.vo";
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+export class SecurityRuleUserAgentStrategy implements SecurityRuleStrategy {
+  constructor(private readonly blacklist: string[] = ALL_BOTS) {}
+
+  async isViolated(c: Context) {
+    const client = ClientFromHono.translate(c);
+
+    return this.blacklist.some((bot) => client.matchesUa(ClientUserAgent.parse(bot)));
+  }
+
+  get name() {
+    return SecurityRuleName.parse("user_agent");
+  }
+}

package/src/security-rule-violation-threshold.strategy.ts

@@ -0,0 +1,46 @@
+import type { Context } from "hono";
+import type { CacheRepositoryPort } from "./cache-repository.port";
+import { CacheSubjectResolver } from "./cache-subject-resolver.vo";
+import { CacheSubjectSegmentFixedStrategy } from "./cache-subject-segment-fixed.strategy";
+import { CacheSubjectSegmentIpStrategy } from "./cache-subject-segment-ip.strategy";
+import type { HashContentStrategy } from "./hash-content.strategy";
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+type Dependencies = { CacheRepository: CacheRepositoryPort; HashContent: HashContentStrategy };
+
+export class SecurityRuleViolationThresholdStrategy implements SecurityRuleStrategy {
+  constructor(
+    private readonly rule: SecurityRuleStrategy,
+    private readonly config: { threshold: number },
+    private readonly deps: Dependencies,
+  ) {}
+
+  // Best-effort increment, occasional lost increments are acceptable for concurrent requests.
+  async isViolated(c: Context) {
+    const resolver = new CacheSubjectResolver(
+      [new CacheSubjectSegmentFixedStrategy(this.name), new CacheSubjectSegmentIpStrategy()],
+      this.deps,
+    );
+    const subject = await resolver.resolve(c);
+
+    const violated = await this.rule.isViolated(c);
+
+    if (!violated) return false;
+
+    try {
+      const count = (await this.deps.CacheRepository.get<number>(subject.hex)) ?? 0;
+
+      await this.deps.CacheRepository.set<number>(subject.hex, count + 1);
+
+      if (count + 1 >= this.config.threshold) return true;
+      return false;
+    } catch {
+      return false;
+    }
+  }
+
+  get name() {
+    return SecurityRuleName.parse(`violation_threshold_${this.config.threshold}_${this.rule.name}`);
+  }
+}

package/src/security-rule.strategy.ts

@@ -0,0 +1,8 @@
+import type { Context } from "hono";
+import type { SecurityRuleNameType } from "./security-rule-name.vo";
+
+export interface SecurityRuleStrategy {
+  isViolated(c: Context): Promise<boolean>;
+
+  get name(): SecurityRuleNameType;
+}

package/src/setup.service.ts

@@ -10,12 +10,12 @@ import type { ClockPort } from "./clock.port";
 import { Context } from "./context.middleware";
 import { CorrelationStorage } from "./correlation-storage.service";
 import { ETagExtractor } from "./etag-extractor.middleware";
+import type { FileReaderJsonPort } from "./file-reader-json.port";
 import { HttpLogger, type HttpLoggerOptions } from "./http-logger.middleware";
 import type { I18nConfigType } from "./i18n.service";
 import type { IdProviderPort } from "./id-provider.port";
-import type { JsonFileReaderPort } from "./json-file-reader.port";
 import type { LoggerPort } from "./logger.port";
-import { ShieldUserAgentBlockerAdapter } from "./shield-user-agent-blocker.adapter";
+import { MaintenanceMode, type MaintenanceModeConfigType } from "./maintenance-mode.middleware";
 import { TimeZoneOffset } from "./time-zone-offset.middleware";
 import { WeakETagExtractor } from "./weak-etag-extractor.middleware";
 
@@ -25,6 +25,7 @@ type SetupOverridesType = {
   cors?: Parameters<typeof cors>[0];
   secureHeaders?: Parameters<typeof secureHeaders>[0];
   httpLogger?: HttpLoggerOptions;
+  maintenanceMode?: MaintenanceModeConfigType;
 };
 
 type Dependencies = {
@@ -32,7 +33,7 @@ type Dependencies = {
   IdProvider: IdProviderPort;
   I18n: I18nConfigType;
   Clock: ClockPort;
-  JsonFileReader: JsonFileReaderPort;
+  JsonFileReader: FileReaderJsonPort;
 };
 
 export class Setup {
@@ -41,9 +42,9 @@ export class Setup {
     const secureHeadersOptions = { crossOriginResourcePolicy: "cross-origin", ...overrides?.secureHeaders };
 
     return [
+      MaintenanceMode.build(overrides?.maintenanceMode),
       secureHeaders(secureHeadersOptions),
       bodyLimit({ maxSize: BODY_LIMIT_MAX_SIZE }),
-      new ShieldUserAgentBlockerAdapter().verify,
       ApiVersion.build({ Clock: deps.Clock, JsonFileReader: deps.JsonFileReader }),
       cors(corsOptions),
       languageDetector({

package/src/shield-api-key.strategy.ts

@@ -0,0 +1,20 @@
+import type * as tools from "@bgord/tools";
+import { createMiddleware } from "hono/factory";
+import { HTTPException } from "hono/http-exception";
+import type { ShieldStrategy } from "./shield.strategy";
+
+type ApiKeyShieldConfigType = { API_KEY: tools.ApiKeyType };
+
+export const AccessDeniedApiKeyError = new HTTPException(403, { message: "access_denied_api_key" });
+
+export class ShieldApiKeyStrategy implements ShieldStrategy {
+  static readonly HEADER_NAME = "bgord-api-key";
+
+  constructor(private readonly config: ApiKeyShieldConfigType) {}
+
+  verify = createMiddleware(async (c, next) => {
+    if (c.req.header(ShieldApiKeyStrategy.HEADER_NAME) === this.config.API_KEY) return next();
+
+    throw AccessDeniedApiKeyError;
+  });
+}