@bgord/bun 1.9.0 → 1.9.2

package/src/redactor-mask.strategy.ts

@@ -0,0 +1,38 @@
+import cloneDeepWith from "lodash/cloneDeepWith";
+import type { RedactorStrategy } from "./redactor.strategy";
+
+export class RedactorMaskStrategy implements RedactorStrategy {
+  static readonly DEFAULT_KEYS: readonly string[] = [
+    "authorization",
+    "cookie",
+    "set-cookie",
+    "x-api-key",
+    "apikey",
+    "token",
+    "accesstoken",
+    "refreshtoken",
+    "password",
+    "currentpassword",
+    "newpassword",
+    "passwordconfirmation",
+    "clientsecret",
+    "secret",
+    "otp",
+    "code",
+  ];
+
+  private readonly keys: Set<string>;
+
+  constructor(keys?: readonly string[]) {
+    this.keys = keys?.length
+      ? new Set(keys.map((key) => key.toLowerCase()))
+      : new Set(RedactorMaskStrategy.DEFAULT_KEYS);
+  }
+
+  redact<T>(input: T): T {
+    return cloneDeepWith(input, (_value, key) => {
+      if (typeof key === "string" && this.keys.has(key.toLowerCase())) return "***";
+      return undefined;
+    });
+  }
+}

package/src/redactor-noop.strategy.ts

@@ -0,0 +1,7 @@
+import type { RedactorStrategy } from "./redactor.strategy";
+
+export class RedactorNoopStrategy implements RedactorStrategy {
+  redact<T>(input: T): T {
+    return input;
+  }
+}

package/src/redactor.strategy.ts

@@ -0,0 +1,3 @@
+export interface RedactorStrategy {
+  redact<T>(value: T): T;
+}

package/src/remote-file-storage-disk.adapter.ts

@@ -0,0 +1,72 @@
+import fs from "node:fs/promises";
+import * as tools from "@bgord/tools";
+import type { FileCleanerPort } from "./file-cleaner.port";
+import type { FileRenamerPort } from "./file-renamer.port";
+import type { HashFilePort } from "./hash-file.port";
+import type {
+  RemoteFileStoragePort,
+  RemoteHeadResult,
+  RemotePutFromPathInput,
+  RemotePutFromPathResult,
+} from "./remote-file-storage.port";
+
+type RemoteFileStorageDiskConfig = { root: tools.DirectoryPathAbsoluteType };
+
+type Dependencies = { HashFile: HashFilePort; FileCleaner: FileCleanerPort; FileRenamer: FileRenamerPort };
+
+export class RemoteFileStorageDiskAdapter implements RemoteFileStoragePort {
+  constructor(
+    private readonly config: RemoteFileStorageDiskConfig,
+    private readonly deps: Dependencies,
+  ) {}
+
+  private resolveKeyToAbsoluteFilePath(key: tools.ObjectKeyType): tools.FilePathAbsolute {
+    const parts = key.split("/");
+    const filename = tools.Filename.fromString(parts.pop() as string);
+
+    const directory = tools.DirectoryPathAbsoluteSchema.parse(`${this.config.root}/${parts.join("/")}`);
+
+    return tools.FilePathAbsolute.fromPartsSafe(directory, filename);
+  }
+
+  async putFromPath(input: RemotePutFromPathInput): Promise<RemotePutFromPathResult> {
+    const final = this.resolveKeyToAbsoluteFilePath(input.key);
+    const temporary = final.withFilename(final.getFilename().withSuffix("-part"));
+
+    await fs.mkdir(final.getDirectory(), { recursive: true });
+
+    const source = Bun.file(input.path.get());
+    await Bun.write(temporary.get(), source);
+    await this.deps.FileRenamer.rename(temporary, final);
+
+    return this.deps.HashFile.hash(final);
+  }
+
+  async head(key: tools.ObjectKeyType): Promise<RemoteHeadResult> {
+    const path = this.resolveKeyToAbsoluteFilePath(key);
+
+    try {
+      return { exists: true, ...(await this.deps.HashFile.hash(path)) };
+    } catch {
+      return { exists: false };
+    }
+  }
+
+  async getStream(key: tools.ObjectKeyType): Promise<ReadableStream | null> {
+    const path = this.resolveKeyToAbsoluteFilePath(key);
+
+    try {
+      return Bun.file(path.get()).stream();
+    } catch {
+      return null;
+    }
+  }
+
+  async delete(key: tools.ObjectKeyType): Promise<void> {
+    await this.deps.FileCleaner.delete(this.resolveKeyToAbsoluteFilePath(key));
+  }
+
+  get root() {
+    return this.config.root;
+  }
+}

package/src/remote-file-storage-noop.adapter.ts

@@ -0,0 +1,70 @@
+import * as tools from "@bgord/tools";
+import type { ClockPort } from "./clock.port";
+import { Hash } from "./hash.vo";
+import type { LoggerPort } from "./logger.port";
+import type {
+  RemoteFileStoragePort,
+  RemoteHeadResult,
+  RemotePutFromPathInput,
+  RemotePutFromPathResult,
+} from "./remote-file-storage.port";
+
+type Dependencies = { Logger: LoggerPort; Clock: ClockPort };
+
+type RemoteFileStorageNoopConfig = { root: tools.DirectoryPathAbsoluteType };
+
+export class RemoteFileStorageNoopAdapter implements RemoteFileStoragePort {
+  private readonly base = { component: "infra", operation: "RemoteFileStorageNoopAdapter" };
+
+  constructor(
+    private readonly config: RemoteFileStorageNoopConfig,
+    private readonly deps: Dependencies,
+  ) {}
+
+  async putFromPath(input: RemotePutFromPathInput): Promise<RemotePutFromPathResult> {
+    this.deps.Logger.info({
+      message: "[NOOP] RemoteFileStorageNoopAdapter putFromPath",
+      metadata: { input },
+      ...this.base,
+    });
+
+    return {
+      etag: Hash.fromString("0000000000000000000000000000000000000000000000000000000000000000"),
+      size: tools.Size.fromBytes(10),
+      lastModified: this.deps.Clock.now(),
+      mime: tools.MIMES.text,
+    };
+  }
+
+  async head(key: tools.ObjectKeyType): Promise<RemoteHeadResult> {
+    this.deps.Logger.info({
+      message: "[NOOP] RemoteFileStorageNoopAdapter head",
+      metadata: { key },
+      ...this.base,
+    });
+
+    return { exists: false };
+  }
+
+  async getStream(key: tools.ObjectKeyType): Promise<ReadableStream | null> {
+    this.deps.Logger.info({
+      message: "[NOOP] RemoteFileStorageNoopAdapter getStream",
+      metadata: { key },
+      ...this.base,
+    });
+
+    return null;
+  }
+
+  async delete(key: tools.ObjectKeyType): Promise<void> {
+    this.deps.Logger.info({
+      message: "[NOOP] RemoteFileStorageNoopAdapter delete",
+      metadata: { key },
+      ...this.base,
+    });
+  }
+
+  get root() {
+    return this.config.root;
+  }
+}

package/src/remote-file-storage.port.ts

@@ -0,0 +1,17 @@
+import type * as tools from "@bgord/tools";
+import type { HashFileResult } from "./hash-file.port";
+
+export type RemotePutFromPathInput = {
+  key: tools.ObjectKeyType;
+  path: tools.FilePathRelative | tools.FilePathAbsolute;
+};
+export type RemotePutFromPathResult = HashFileResult;
+export type RemoteHeadResult = { exists: false } | ({ exists: true } & HashFileResult);
+
+export interface RemoteFileStoragePort {
+  putFromPath(input: RemotePutFromPathInput): Promise<RemotePutFromPathResult>;
+  head(key: tools.ObjectKeyType): Promise<RemoteHeadResult>;
+  getStream(key: tools.ObjectKeyType): Promise<ReadableStream | null>;
+  delete(key: tools.ObjectKeyType): Promise<void>;
+  get root(): tools.DirectoryPathAbsoluteType;
+}

package/src/retry-backoff-exponential.strategy.ts

@@ -0,0 +1,10 @@
+import * as tools from "@bgord/tools";
+import type { RetryBackoffStrategy } from "./retry-backoff.strategy";
+
+export class RetryBackoffExponentialStrategy implements RetryBackoffStrategy {
+  constructor(private readonly delay: tools.Duration) {}
+
+  next(attempt: tools.IntegerPositiveType) {
+    return this.delay.times(tools.MultiplicationFactor.parse(2 ** (attempt - 1)));
+  }
+}

package/src/retry-backoff-fibonacci.strategy.ts

@@ -0,0 +1,16 @@
+import * as tools from "@bgord/tools";
+import type { RetryBackoffStrategy } from "./retry-backoff.strategy";
+
+export class RetryBackoffFibonacciStrategy implements RetryBackoffStrategy {
+  constructor(private readonly delay: tools.Duration) {}
+
+  next(attempt: tools.IntegerPositiveType) {
+    return this.delay.times(tools.MultiplicationFactor.parse(this.fibonacci(attempt)));
+  }
+
+  private fibonacci(n: number): number {
+    if (n === 0) return 0;
+    if (n === 1) return 1;
+    return this.fibonacci(n - 1) + this.fibonacci(n - 2);
+  }
+}

package/src/retry-backoff-linear.strategy.ts

@@ -0,0 +1,10 @@
+import * as tools from "@bgord/tools";
+import type { RetryBackoffStrategy } from "./retry-backoff.strategy";
+
+export class RetryBackoffLinearStrategy implements RetryBackoffStrategy {
+  constructor(private readonly delay: tools.Duration) {}
+
+  next(attempt: tools.IntegerPositiveType) {
+    return this.delay.times(tools.MultiplicationFactor.parse(attempt));
+  }
+}

package/src/retry-backoff-noop.strategy.ts

@@ -0,0 +1,8 @@
+import * as tools from "@bgord/tools";
+import type { RetryBackoffStrategy } from "./retry-backoff.strategy";
+
+export class RetryBackoffNoopStrategy implements RetryBackoffStrategy {
+  next() {
+    return tools.Duration.Ms(0);
+  }
+}

package/src/retry-backoff.strategy.ts

@@ -0,0 +1,5 @@
+import type * as tools from "@bgord/tools";
+
+export interface RetryBackoffStrategy {
+  next(attempt: tools.IntegerPositiveType): tools.Duration;
+}

package/src/retry.service.ts

@@ -0,0 +1,37 @@
+import * as tools from "@bgord/tools";
+import type { RetryBackoffStrategy } from "./retry-backoff.strategy";
+import type { SleeperPort } from "./sleeper.port";
+
+type Dependencies = { Sleeper: SleeperPort };
+
+export type RetryConfigType = {
+  max: tools.IntegerPositiveType;
+  backoff: RetryBackoffStrategy;
+  when?: (error: unknown) => boolean;
+};
+
+export const RetryError = { InvalidMax: "retry.invalid.max" };
+
+export class Retry {
+  constructor(private readonly deps: Dependencies) {}
+
+  async run<T>(action: () => Promise<T>, config: RetryConfigType): Promise<T> {
+    if (config.max < 1) throw new Error(RetryError.InvalidMax);
+
+    let lastError: unknown;
+
+    for (let attempt = 1; attempt <= config.max; attempt++) {
+      try {
+        return await action();
+      } catch (error) {
+        lastError = error;
+
+        if (attempt === config.max || (config.when && !config.when(error))) break;
+
+        await this.deps.Sleeper.wait(config.backoff.next(tools.IntegerPositive.parse(attempt)));
+      }
+    }
+
+    throw lastError;
+  }
+}

package/src/safe-parse-body.service.ts

@@ -0,0 +1,12 @@
+import type hono from "hono";
+
+export async function safeParseBody(c: hono.Context): Promise<any> {
+  try {
+    const rawBody = await c.req.text();
+
+    if (!rawBody.trim()) return {};
+    return JSON.parse(rawBody);
+  } catch {
+    return {};
+  }
+}

package/src/sealer-aes-gcm.adapter.ts

@@ -0,0 +1,38 @@
+import { CryptoAesGcm } from "./crypto-aes-gcm.service";
+import type { CryptoKeyProviderPort } from "./crypto-key-provider.port";
+import { EncryptionIV } from "./encryption-iv.vo";
+import type { SealerPort } from "./sealer.port";
+
+type Dependencies = { CryptoKeyProvider: CryptoKeyProviderPort };
+
+export const SealerAesGcmAdapterError = { InvalidPayload: "sealer.aes.gcm.adapter.invalid.payload" };
+
+export class SealerAesGcmAdapter implements SealerPort {
+  private static readonly PREFIX = "sealed:gcm:";
+
+  constructor(private readonly deps: Dependencies) {}
+
+  async seal(value: unknown): Promise<string> {
+    const key = await this.deps.CryptoKeyProvider.get();
+
+    const iv = EncryptionIV.generate();
+    const plaintext = new TextEncoder().encode(JSON.stringify(value));
+
+    const payload = await CryptoAesGcm.encrypt(key, plaintext.buffer, iv);
+
+    return SealerAesGcmAdapter.PREFIX + Buffer.from(payload).toString("base64");
+  }
+
+  async unseal(value: string): Promise<unknown> {
+    if (!value.startsWith(SealerAesGcmAdapter.PREFIX)) {
+      throw new Error(SealerAesGcmAdapterError.InvalidPayload);
+    }
+
+    const key = await this.deps.CryptoKeyProvider.get();
+    const bytes = Buffer.from(value.slice(SealerAesGcmAdapter.PREFIX.length), "base64");
+
+    const decrypted = await CryptoAesGcm.decrypt(key, bytes);
+
+    return JSON.parse(new TextDecoder().decode(decrypted));
+  }
+}

package/src/sealer-noop.adapter.ts

@@ -0,0 +1,11 @@
+import type { SealerPort } from "./sealer.port";
+
+export class SealerNoopAdapter implements SealerPort {
+  async seal(value: unknown): Promise<string> {
+    return `sealed:${JSON.stringify(value)}`;
+  }
+
+  async unseal(value: string): Promise<unknown> {
+    return JSON.parse(value.replace("sealed:", ""));
+  }
+}

package/src/sealer.port.ts

@@ -0,0 +1,4 @@
+export interface SealerPort {
+  seal(value: unknown): Promise<string>;
+  unseal(value: string): Promise<unknown>;
+}

package/src/security-context.vo.ts

@@ -0,0 +1,13 @@
+import type { Client } from "./client.vo";
+import type { SecurityCountermeasureNameType } from "./security-countermeasure-name.vo";
+import type { SecurityRuleNameType } from "./security-rule-name.vo";
+import type { UUIDType } from "./uuid.vo";
+
+export class SecurityContext {
+  constructor(
+    readonly rule: SecurityRuleNameType,
+    readonly countermeasure: SecurityCountermeasureNameType,
+    readonly client: Client,
+    readonly userId: UUIDType | undefined,
+  ) {}
+}

package/src/security-countermeasure-ban.strategy.ts

@@ -0,0 +1,63 @@
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+import type { ClockPort } from "./clock.port";
+import { CorrelationStorage } from "./correlation-storage.service";
+import { createEventEnvelope } from "./event-envelope";
+import type { EventStoreLike } from "./event-store-like.types";
+import type { IdProviderPort } from "./id-provider.port";
+import type { LoggerPort } from "./logger.port";
+import {
+  SECURITY_VIOLATION_DETECTED_EVENT,
+  SecurityViolationDetectedEvent,
+  type SecurityViolationDetectedEventType,
+} from "./modules/system/events/SECURITY_VIOLATION_DETECTED_EVENT";
+import type { SecurityContext } from "./security-context.vo";
+import type { SecurityAction, SecurityCountermeasureStrategy } from "./security-countermeasure.strategy";
+import { SecurityCountermeasureName } from "./security-countermeasure-name.vo";
+
+type Dependencies = {
+  IdProvider: IdProviderPort;
+  Clock: ClockPort;
+  Logger: LoggerPort;
+  EventStore: EventStoreLike<SecurityViolationDetectedEventType>;
+};
+
+export const SecurityCountermeasureBanStrategyError = {
+  Executed: "security.countermeasure.ban.strategy.executed",
+};
+
+export class SecurityCountermeasureBanStrategy implements SecurityCountermeasureStrategy {
+  constructor(
+    private readonly deps: Dependencies,
+    private readonly config: { response: { status: ContentfulStatusCode } } = { response: { status: 403 } },
+  ) {}
+
+  async execute(context: SecurityContext): Promise<SecurityAction> {
+    const action = {
+      kind: "deny",
+      reason: SecurityCountermeasureBanStrategyError.Executed,
+      ...this.config,
+    } as const;
+
+    this.deps.Logger.info({
+      message: "Security countermeasure ban",
+      component: "security",
+      operation: "security_countermeasure_ban",
+      correlationId: CorrelationStorage.get(),
+      metadata: context,
+    });
+
+    const event = SecurityViolationDetectedEvent.parse({
+      ...createEventEnvelope("security", this.deps),
+      name: SECURITY_VIOLATION_DETECTED_EVENT,
+      payload: { ...context, countermeasure: this.name, action: action.kind },
+    } satisfies SecurityViolationDetectedEventType);
+
+    await this.deps.EventStore.save([event]);
+
+    return action;
+  }
+
+  get name() {
+    return SecurityCountermeasureName.parse("ban");
+  }
+}

package/src/security-countermeasure-mirage.strategy.ts

@@ -0,0 +1,31 @@
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+import { CorrelationStorage } from "./correlation-storage.service";
+import type { LoggerPort } from "./logger.port";
+import type { SecurityContext } from "./security-context.vo";
+import type { SecurityAction, SecurityCountermeasureStrategy } from "./security-countermeasure.strategy";
+import { SecurityCountermeasureName } from "./security-countermeasure-name.vo";
+
+type Dependencies = { Logger: LoggerPort };
+
+export class SecurityCountermeasureMirageStrategy implements SecurityCountermeasureStrategy {
+  constructor(
+    private readonly deps: Dependencies,
+    private readonly config: { response: { status: ContentfulStatusCode } } = { response: { status: 200 } },
+  ) {}
+
+  async execute(context: SecurityContext): Promise<SecurityAction> {
+    this.deps.Logger.info({
+      message: "Security countermeasure mirage",
+      component: "security",
+      operation: "security_countermeasure_mirage",
+      correlationId: CorrelationStorage.get(),
+      metadata: context,
+    });
+
+    return { kind: "mirage", ...this.config };
+  }
+
+  get name() {
+    return SecurityCountermeasureName.parse("mirage");
+  }
+}

package/src/security-countermeasure-name.vo.ts

@@ -0,0 +1,22 @@
+import * as z from "zod/v4";
+
+export const SecurityCountermeasureNameError = {
+  Type: "security.countermeasure.name.type",
+  Empty: "security.countermeasure.name.empty",
+  TooLong: "security.countermeasure.name.too.long",
+  BadChars: "security.countermeasure.name.bad.chars",
+};
+
+// One to sixty four letters, digits, or underscores
+const CHARS_WHITELIST = /^[a-zA-Z0-9_]{1,64}$/;
+
+// Stryker disable all
+export const SecurityCountermeasureName = z
+  // Stryker restore all
+  .string(SecurityCountermeasureNameError.Type)
+  .min(1, SecurityCountermeasureNameError.Empty)
+  .max(64, SecurityCountermeasureNameError.TooLong)
+  .regex(CHARS_WHITELIST, SecurityCountermeasureNameError.BadChars)
+  .brand("SecurityCountermeasureName");
+
+export type SecurityCountermeasureNameType = z.infer<typeof SecurityCountermeasureName>;

package/src/security-countermeasure-noop.strategy.ts

@@ -0,0 +1,12 @@
+import type { SecurityAction, SecurityCountermeasureStrategy } from "./security-countermeasure.strategy";
+import { SecurityCountermeasureName } from "./security-countermeasure-name.vo";
+
+export class SecurityCountermeasureNoopStrategy implements SecurityCountermeasureStrategy {
+  async execute(): Promise<SecurityAction> {
+    return { kind: "allow" };
+  }
+
+  get name() {
+    return SecurityCountermeasureName.parse("noop");
+  }
+}

package/src/security-countermeasure-report.strategy.ts

@@ -0,0 +1,27 @@
+import { CorrelationStorage } from "./correlation-storage.service";
+import type { LoggerPort } from "./logger.port";
+import type { SecurityContext } from "./security-context.vo";
+import type { SecurityAction, SecurityCountermeasureStrategy } from "./security-countermeasure.strategy";
+import { SecurityCountermeasureName } from "./security-countermeasure-name.vo";
+
+type Dependencies = { Logger: LoggerPort };
+
+export class SecurityCountermeasureReportStrategy implements SecurityCountermeasureStrategy {
+  constructor(private readonly deps: Dependencies) {}
+
+  async execute(context: SecurityContext): Promise<SecurityAction> {
+    this.deps.Logger.info({
+      message: "Security countermeasure report",
+      component: "security",
+      operation: "security_countermeasure_report",
+      correlationId: CorrelationStorage.get(),
+      metadata: context,
+    });
+
+    return { kind: "allow" };
+  }
+
+  get name() {
+    return SecurityCountermeasureName.parse("report");
+  }
+}

package/src/security-countermeasure-tarpit.strategy.ts

@@ -0,0 +1,31 @@
+import type * as tools from "@bgord/tools";
+import { CorrelationStorage } from "./correlation-storage.service";
+import type { LoggerPort } from "./logger.port";
+import type { SecurityContext } from "./security-context.vo";
+import type { SecurityAction, SecurityCountermeasureStrategy } from "./security-countermeasure.strategy";
+import { SecurityCountermeasureName } from "./security-countermeasure-name.vo";
+
+type Dependencies = { Logger: LoggerPort };
+
+export class SecurityCountermeasureTarpitStrategy implements SecurityCountermeasureStrategy {
+  constructor(
+    private readonly deps: Dependencies,
+    private readonly config: { duration: tools.Duration; after: SecurityAction },
+  ) {}
+
+  async execute(context: SecurityContext): Promise<SecurityAction> {
+    this.deps.Logger.info({
+      message: "Security countermeasure tarpit",
+      component: "security",
+      operation: "security_countermeasure_tarpit",
+      correlationId: CorrelationStorage.get(),
+      metadata: context,
+    });
+
+    return { kind: "delay", ...this.config };
+  }
+
+  get name() {
+    return SecurityCountermeasureName.parse("tarpit");
+  }
+}

package/src/security-countermeasure.strategy.ts

@@ -0,0 +1,16 @@
+import type * as tools from "@bgord/tools";
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+import type { SecurityContext } from "./security-context.vo";
+import type { SecurityCountermeasureNameType } from "./security-countermeasure-name.vo";
+
+export type SecurityAction =
+  | { kind: "allow" }
+  | { kind: "deny"; reason: string; response: { status: ContentfulStatusCode } }
+  | { kind: "delay"; duration: tools.Duration; after: SecurityAction }
+  | { kind: "mirage"; response: { status: ContentfulStatusCode } };
+
+export interface SecurityCountermeasureStrategy {
+  execute(context: SecurityContext): Promise<SecurityAction>;
+
+  get name(): SecurityCountermeasureNameType;
+}

package/src/security-policy.vo.ts

@@ -0,0 +1,9 @@
+import type { SecurityCountermeasureStrategy } from "./security-countermeasure.strategy";
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+
+export class SecurityPolicy {
+  constructor(
+    readonly rule: SecurityRuleStrategy,
+    readonly countermeasure: SecurityCountermeasureStrategy,
+  ) {}
+}

package/src/security-rule-and.strategy.ts

@@ -0,0 +1,25 @@
+import type { Context } from "hono";
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+export const SecurityRuleAndStrategyError = {
+  MissingRules: "security.rule.and.adapter.error.missing.rules",
+  MaxRules: "security.rule.and.adapter.error.max.rules",
+};
+
+export class SecurityRuleAndStrategy implements SecurityRuleStrategy {
+  constructor(private readonly rules: SecurityRuleStrategy[]) {
+    if (rules.length === 0) throw new Error(SecurityRuleAndStrategyError.MissingRules);
+    if (rules.length > 5) throw new Error(SecurityRuleAndStrategyError.MaxRules);
+  }
+
+  async isViolated(c: Context) {
+    const reports = await Promise.all(this.rules.map((rule) => rule.isViolated(c)));
+
+    return reports.every(Boolean);
+  }
+
+  get name() {
+    return SecurityRuleName.parse(`and_${this.rules.map((rule) => rule.name).join("_")}`);
+  }
+}

package/src/security-rule-bait-routes.strategy.ts

@@ -0,0 +1,15 @@
+import type { Context } from "hono";
+import type { SecurityRuleStrategy } from "./security-rule.strategy";
+import { SecurityRuleName } from "./security-rule-name.vo";
+
+export class SecurityRuleBaitRoutesStrategy implements SecurityRuleStrategy {
+  constructor(private readonly routes: string[]) {}
+
+  async isViolated(c: Context) {
+    return this.routes.includes(c.req.path);
+  }
+
+  get name() {
+    return SecurityRuleName.parse("bait_routes");
+  }
+}