- Security at 36Blocks -
-- We take security seriously. Every layer of 36Blocks is designed with your users' data and trust in mind. +
Security at 36Blocks
++ Understand the access boundaries and configuration that protect your connected applications.
-Last updated: January 2026
-
-
-
diff --git a/apps/36-blocks/src/app/website/website.routes.ts b/apps/36-blocks/src/app/website/website.routes.ts
index 983247d7..4f4c6e80 100644
--- a/apps/36-blocks/src/app/website/website.routes.ts
+++ b/apps/36-blocks/src/app/website/website.routes.ts
@@ -12,6 +12,10 @@ export const websiteRoutes: Route[] = [
canActivate: [LoggedInGuard],
loadComponent: () => import('./home/home.component').then((c) => c.HomeComponent),
},
+ {
+ path: 'docs',
+ loadComponent: () => import('./docs/docs.component').then((c) => c.DocsComponent),
+ },
{
path: 'pricing',
loadComponent: () => import('./pricing/pricing.component').then((c) => c.PricingComponent),
diff --git a/apps/36-blocks/src/server.ts b/apps/36-blocks/src/server.ts
index ab71732b..bed4df02 100644
--- a/apps/36-blocks/src/server.ts
+++ b/apps/36-blocks/src/server.ts
@@ -15,14 +15,14 @@ export function app(): express.Express {
const angularApp = new AngularNodeAppEngine();
server.get(
- '**',
+ '/{*path}',
express.static(browserDistFolder, {
maxAge: '1y',
index: false,
})
);
- server.get('**', (req, res, next) => {
+ server.get('/{*path}', (req, res, next) => {
angularApp
.handle(req, { server: res })
.then((response) => {
diff --git a/docs/widget-integration-guide.md b/docs/widget-integration-guide.md
index 0ab1bf06..852da1e9 100644
--- a/docs/widget-integration-guide.md
+++ b/docs/widget-integration-guide.md
@@ -1,5 +1,7 @@
# Proxy Auth Widget — Client Integration Guide
+> **Verification:** Examples describe existing widget contracts; provider login and application session flows still require environment testing. Browser callbacks alone do not authorize business resources.
+>
> **Created:** Mar 25, 2026
> **Scope:** `apps/36-blocks-widget` — `initVerification` usage examples for all widget types
> **Script output:** `dist/apps/36-blocks/assets/proxy-auth/proxy-auth.js`
@@ -52,11 +54,12 @@ Default widget type. Shows OTP, social login, and/or password login buttons base
type: 'authorization',
success: (data) => {
// get verified token in response
- console.log('success response', data);
+ // Privately hand off to your application's verified session flow.
+ // Never log callback data: it may contain credentials.
},
failure: (error) => {
// handle error
- console.log('failure reason', error);
+ // Show a safe failure message; do not log credential-bearing payloads.
},
};
@@ -83,11 +86,12 @@ Displays the authenticated user's profile. Requires an `authToken` obtained from
authToken: 'ENCRYPTED_AUTH_TOKEN',
success: (data) => {
// get verified token in response
- console.log('success response', data);
+ // Privately hand off to your application's verified session flow.
+ // Never log callback data: it may contain credentials.
},
failure: (error) => {
// handle error
- console.log('failure reason', error);
+ // Show a safe failure message; do not log credential-bearing payloads.
},
};
@@ -115,11 +119,12 @@ Shows a role & user management panel. Requires an `authToken`. Use `isRolePermis
isRolePermission: true,
success: (data) => {
// get verified token in response
- console.log('success response', data);
+ // Privately hand off to your application's verified session flow.
+ // Never log callback data: it may contain credentials.
},
failure: (error) => {
// handle error
- console.log('failure reason', error);
+ // Show a safe failure message; do not log credential-bearing payloads.
},
};
@@ -147,11 +152,12 @@ Renders the organization details view. Use `showCompanyDetails` to include the c
showCompanyDetails: true,
success: (data) => {
// get verified token in response
- console.log('success response', data);
+ // Privately hand off to your application's verified session flow.
+ // Never log callback data: it may contain credentials.
},
failure: (error) => {
// handle error
- console.log('failure reason', error);
+ // Show a safe failure message; do not log credential-bearing payloads.
},
};
@@ -178,11 +184,12 @@ Shows subscription plans. Set `isLogin: true` to display a login flow alongside
isLogin: true,
success: (data) => {
// get verified token in response
- console.log('success response', data);
+ // Privately hand off to your application's verified session flow.
+ // Never log callback data: it may contain credentials.
},
failure: (error) => {
// handle error
- console.log('failure reason', error);
+ // Show a safe failure message; do not log credential-bearing payloads.
},
};
@@ -213,11 +220,12 @@ Uses `version: 'v2'` UI, icon-only social buttons, custom input field position,
target: '_blank',
success: (data) => {
// get verified token in response
- console.log('success response', data);
+ // Privately hand off to your application's verified session flow.
+ // Never log callback data: it may contain credentials.
},
failure: (error) => {
// handle error
- console.log('failure reason', error);
+ // Show a safe failure message; do not log credential-bearing payloads.
},
};
diff --git a/libs/services/proxy/root/src/lib/services-proxy-root.module.ts b/libs/services/proxy/root/src/lib/services-proxy-root.module.ts
index 5ead552f..e1730370 100644
--- a/libs/services/proxy/root/src/lib/services-proxy-root.module.ts
+++ b/libs/services/proxy/root/src/lib/services-proxy-root.module.ts
@@ -36,7 +36,7 @@ export class RootService {
public generateToken(params: { [key: string]: any } = {}): Observable> {
return this.http.get>(RootUrls.generateToken(this.baseUrl), params);
}
- public getProjects(): Observable> {
- return this.http.get>(RootUrls.getProject(this.baseUrl));
+ public getProjects(): Observable, void>> {
+ return this.http.get, void>>(RootUrls.getProject(this.baseUrl));
}
}
diff --git a/package.json b/package.json
index a820ad81..703bcbb4 100755
--- a/package.json
+++ b/package.json
@@ -47,7 +47,8 @@
"workspace-generator": "nx workspace-generator",
"update-public-suffix": "node ./libs/ui/handle-domain/src/lib/updater.js",
"format:code": "npx prettier --write --ignore-unknown .",
- "prepare": "husky install"
+ "prepare": "husky install",
+ "test:v0": "node --test tools/tests/*.test.cjs"
},
"private": true,
"dependencies": {
diff --git a/tools/set-env.js b/tools/set-env.js
index b635de00..622416ec 100644
--- a/tools/set-env.js
+++ b/tools/set-env.js
@@ -18,7 +18,7 @@ const path = require('path');
// Object.assign ensures .env values override any stale/dev env vars pre-set by Amplify.
try {
const dotenvResult = require('dotenv').config({
- path: path.resolve(__dirname, '../.env')
+ path: path.resolve(__dirname, '../.env'),
});
if (dotenvResult.parsed) {
Object.assign(process.env, dotenvResult.parsed);
@@ -45,20 +45,16 @@ if (DEBUG) {
function get(key, fallback = undefined) {
const value = env[key] !== undefined ? env[key] : fallback;
-
+
// Debug logging to track credential source
if (DEBUG) {
if (value !== undefined) {
- // Show first 8 chars for verification without exposing full secrets
- const preview = typeof value === 'string' && value.length > 8
- ? `${value.substring(0, 8)}...`
- : '***SET***';
- console.log(`[set-env DEBUG] ${key} = ${preview}`);
+ console.log(`[set-env DEBUG] ${key} = SET`);
} else {
console.log(`[set-env DEBUG] ${key} = MISSING`);
}
}
-
+
if (value === undefined) {
if (isCI) missingKeys.push(key);
else console.warn(`[set-env] WARNING: env var "${key}" is not set`);
@@ -117,4 +113,4 @@ const onlyAuth = args.includes('--auth');
if (!onlyAuth) writeProxyEnv();
if (!onlyProxy) writeProxyAuthEnv();
-assertNoMissingKeys();
\ No newline at end of file
+assertNoMissingKeys();
diff --git a/tools/tests/activity.test.cjs b/tools/tests/activity.test.cjs
new file mode 100644
index 00000000..8c0e87af
--- /dev/null
+++ b/tools/tests/activity.test.cjs
@@ -0,0 +1,222 @@
+// Run: node --test tools/tests/activity.test.cjs
+// Exercises actual component/service TypeScript with RxJS; Angular DI and signals
+// are hosted locally. Browser rendering and backend authorization are separate checks.
+const assert = require('node:assert/strict');
+const { readFileSync } = require('node:fs');
+const path = require('node:path');
+const { test } = require('node:test');
+const vm = require('node:vm');
+const ts = require('typescript');
+const { Subject, of, throwError } = require('rxjs');
+
+function load(relative, dependencies = {}) {
+ const source = readFileSync(path.resolve(__dirname, '../..', relative), 'utf8');
+ const compiled = ts.transpileModule(source, {
+ compilerOptions: {
+ target: ts.ScriptTarget.ES2022,
+ module: ts.ModuleKind.CommonJS,
+ experimentalDecorators: true,
+ },
+ }).outputText;
+ const module = { exports: {} };
+ vm.runInNewContext(compiled, {
+ module,
+ exports: module.exports,
+ URL,
+ require: (name) => {
+ if (Object.hasOwn(dependencies, name)) return dependencies[name];
+ if (name === 'rxjs') return require(name);
+ if (name.startsWith('@angular/')) return {};
+ throw new Error(`Unexpected runtime dependency: ${name}`);
+ },
+ });
+ return module.exports;
+}
+const modelPath = 'apps/36-blocks/src/app/panel/activity/activity.models.ts';
+const models = load(modelPath);
+const componentPath = 'apps/36-blocks/src/app/panel/activity/activity.component.ts';
+function createComponent(service) {
+ const signal = (initial) => {
+ let value = initial;
+ const get = () => value;
+ get.set = (next) => {
+ value = next;
+ };
+ return get;
+ };
+ const { ActivityComponent } = load(componentPath, {
+ '@angular/core': {
+ Component: () => (target) => target,
+ ChangeDetectionStrategy: {},
+ inject: () => service,
+ signal,
+ },
+ './activity.models': models,
+ './activity.service': { ActivityService: class {} },
+ });
+ return new ActivityComponent();
+}
+const empty = { hasError: false, data: { data: [], totalEntityCount: 0, totalPageCount: 0 } };
+
+test('activity distinguishes denied, failed and empty responses and recovers on retry', () => {
+ let response = throwError(() => ({ errorCode: 403 }));
+ const component = createComponent({ getOperations: () => response });
+ component.ngOnInit();
+ assert.match(component.error(), /view_operations/);
+ assert.equal(component.loading(), false);
+ response = of({ hasError: true, data: empty.data });
+ component.load(1);
+ assert.match(component.error(), /could not be loaded/);
+ response = of(empty);
+ component.load(1);
+ assert.equal(component.error(), null);
+ assert.equal(component.rows().length, 0);
+});
+
+test('new requests clear stale rows and cancel older work', () => {
+ const first = new Subject();
+ const second = new Subject();
+ let count = 0;
+ const component = createComponent({ getOperations: () => (++count === 1 ? first : second) });
+ component.ngOnInit();
+ first.next({ data: { data: [{ id: 1 }], totalEntityCount: 1, totalPageCount: 1 } });
+ component.load(2);
+ assert.equal(first.observers.length, 0);
+ assert.equal(component.rows().length, 0);
+ assert.equal(component.loading(), true);
+ second.next(empty);
+ assert.equal(component.loading(), false);
+ component.ngOnDestroy();
+ assert.equal(second.observers.length, 0);
+});
+
+test('pagination uses applied filters rather than unsaved form edits; clear resets page and filters', () => {
+ const requests = [];
+ const component = createComponent({
+ getOperations: (params) => {
+ requests.push(params);
+ return of(empty);
+ },
+ });
+ component.filters.operation = ' Login as ';
+ component.filters.target_user_id = '17';
+ component.applyFilters();
+ component.filters.operation = 'Unsaved';
+ component.load(2);
+ assert.equal(requests[1].operation, 'Login as');
+ assert.equal(requests[1].target_user_id, '17');
+ assert.equal(requests[1].pageNo, 2);
+ assert.equal(Object.hasOwn(requests[1], 'outcome'), false);
+ component.clearFilters();
+ assert.equal(requests[2].pageNo, 1);
+ assert.equal(Object.hasOwn(requests[2], 'operation'), false);
+});
+
+test('reversed dates prevent a request', () => {
+ const component = createComponent({
+ getOperations: () => {
+ throw new Error('must not send');
+ },
+ });
+ component.filters.startDate = '2026-10-28';
+ component.filters.endDate = '2026-10-27';
+ component.applyFilters();
+ assert.match(component.error(), /end date/);
+});
+
+test('Login as requires valid target, reason and explicit confirmation before sending credentials request', () => {
+ const calls = [];
+ const component = createComponent({
+ loginAs: (request) => {
+ calls.push(request);
+ return of({ data: { redirect_url: 'https://app.example.test/?token=example' } });
+ },
+ getOperations: () => of(empty),
+ });
+ component.loginTarget = '17';
+ component.loginReason = ' Support ticket 123 ';
+ component.loginAs();
+ assert.equal(calls.length, 0);
+ assert.match(component.loginError(), /confirm/);
+ component.loginConfirmed = true;
+ component.loginAs();
+ assert.equal(calls[0].user_id, 17);
+ assert.equal(calls[0].reason, 'Support ticket 123');
+ assert.equal(Object.hasOwn(calls[0], 'company_id'), false);
+ assert.equal(component.loginConfirmed, false);
+ assert.equal(component.loginRedirect(), 'https://app.example.test/?token=example');
+});
+
+test('Login as never presents a returned raw token or unsafe redirect', () => {
+ const component = createComponent({
+ loginAs: () =>
+ of({ data: { redirect_url: 'javascript:alert(1)', proxy_auth_token: 'secret', refresh_token: 'secret' } }),
+ getOperations: () => of(empty),
+ });
+ component.loginTarget = '17';
+ component.loginReason = 'Support';
+ component.loginConfirmed = true;
+ component.loginAs();
+ assert.equal(component.loginRedirect(), null);
+ assert.match(component.loginMessage(), /no safe application redirect/);
+ assert.equal(component.loginMessage().includes('secret'), false);
+});
+
+test('Login as permission failures remain actionable and do not display backend errors', () => {
+ const component = createComponent({
+ loginAs: () => throwError(() => ({ errorCode: 403, errors: 'secret' })),
+ getOperations: () => of(empty),
+ });
+ component.loginTarget = '17';
+ component.loginReason = 'Support';
+ component.loginConfirmed = true;
+ component.loginAs();
+ assert.match(component.loginError(), /Owner, Admin/);
+ assert.equal(component.loginError().includes('secret'), false);
+ assert.equal(component.loggingIn(), false);
+});
+
+test('credential redirects allow HTTPS and loopback HTTP only, without embedded userinfo', () => {
+ for (const value of [
+ 'javascript:alert(1)',
+ '//app.test/path',
+ 'data:text/plain,a',
+ 'http://app.test/',
+ 'https://user:pass@app.test/',
+ null,
+ ]) {
+ assert.equal(models.safeLoginRedirect(value), null);
+ }
+ assert.equal(models.safeLoginRedirect('https://app.test/path#fragment'), 'https://app.test/path#fragment');
+ assert.equal(models.safeLoginRedirect('http://localhost:4200/path'), 'http://localhost:4200/path');
+});
+
+test('service uses authenticated wrapper and POST JSON for impersonation reason', () => {
+ const calls = [];
+ const http = { get: (...args) => calls.push(['get', ...args]), post: (...args) => calls.push(['post', ...args]) };
+ class Wrapper {}
+ const { ActivityService } = load('apps/36-blocks/src/app/panel/activity/activity.service.ts', {
+ '@angular/core': { Injectable: () => (target) => target, Inject: () => () => {}, inject: () => http },
+ '@proxy/models/root-models': { ProxyBaseUrls: { BaseURL: 'BASE_URL' } },
+ '@proxy/service': { createUrl: (base, endpoint) => `${base}/${endpoint}` },
+ '@proxy/services/httpWrapper': { HttpWrapperService: Wrapper },
+ });
+ const service = new ActivityService('https://api.example.test/api');
+ service.getOperations({ pageNo: 2 });
+ service.loginAs({ user_id: 17, reason: 'Support' });
+ assert.equal(calls[0][1], 'https://api.example.test/api/operations');
+ assert.equal(calls[1][0], 'post');
+ assert.equal(calls[1][1], 'https://api.example.test/api/loginAs');
+ assert.equal(calls[1][2].reason, 'Support');
+});
+
+test('editing the impersonation target clears the previous credential link and confirmation', () => {
+ const component = createComponent({});
+ component.loginRedirect.set('https://app.test/?token=example');
+ component.loginMessage.set('Created');
+ component.loginConfirmed = true;
+ component.clearLoginResult();
+ assert.equal(component.loginRedirect(), null);
+ assert.equal(component.loginMessage(), null);
+ assert.equal(component.loginConfirmed, false);
+});
diff --git a/tools/tests/environment-logging.test.cjs b/tools/tests/environment-logging.test.cjs
new file mode 100644
index 00000000..3c92559d
--- /dev/null
+++ b/tools/tests/environment-logging.test.cjs
@@ -0,0 +1,35 @@
+const assert = require('node:assert/strict');
+const { mkdtempSync, mkdirSync, copyFileSync, rmSync } = require('node:fs');
+const { tmpdir } = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { test } = require('node:test');
+
+test('environment generation reports presence without leaking credential prefixes', () => {
+ const root = mkdtempSync(path.join(tmpdir(), '36blocks-env-'));
+ try {
+ mkdirSync(path.join(root, 'tools'));
+ mkdirSync(path.join(root, 'apps/36-blocks-widget/src/environments'), { recursive: true });
+ copyFileSync(path.resolve(__dirname, '../set-env.js'), path.join(root, 'tools/set-env.js'));
+ const secret = 'SYNTHETIC-TEST-SECRET-not-a-real-credential';
+ const result = spawnSync(process.execPath, [path.join(root, 'tools/set-env.js'), '--auth'], {
+ encoding: 'utf8',
+ env: {
+ DEBUG_SET_ENV: 'true',
+ AUTH_UI_ENCODE_KEY: secret,
+ AUTH_UI_IV_KEY: secret,
+ AUTH_API_ENCODE_KEY: secret,
+ AUTH_API_IV_KEY: secret,
+ HCAPTCHA_SITE_KEY: secret,
+ SEND_OTP_AUTH_KEY: secret,
+ },
+ });
+ assert.equal(result.status, 0);
+ const output = result.stdout + result.stderr;
+ assert.ok(output.includes('AUTH_UI_ENCODE_KEY = SET'));
+ assert.ok(!output.includes(secret));
+ assert.ok(!output.includes(secret.substring(0, 8)));
+ } finally {
+ rmSync(root, { recursive: true, force: true });
+ }
+});
diff --git a/tools/tests/panel-investigation.test.cjs b/tools/tests/panel-investigation.test.cjs
new file mode 100644
index 00000000..dbbea465
--- /dev/null
+++ b/tools/tests/panel-investigation.test.cjs
@@ -0,0 +1,299 @@
+// Run: node --test tools/tests/panel-investigation.test.cjs
+// Execute actual TypeScript classes with RxJS. Only framework DI/state hosting is
+// stubbed, so these checks do not replace a browser or Angular template build.
+const assert = require('node:assert/strict');
+const { readFileSync } = require('node:fs');
+const path = require('node:path');
+const { test } = require('node:test');
+const vm = require('node:vm');
+const ts = require('typescript');
+const { BehaviorSubject, Subject, of, throwError, firstValueFrom, map, tap } = require('rxjs');
+
+class StateHost {
+ constructor(state) {
+ this.state$ = new BehaviorSubject(state);
+ }
+ select(selector) {
+ return this.state$.pipe(map(selector));
+ }
+ patchState(patch) {
+ const state = this.state$.value;
+ this.state$.next({ ...state, ...(typeof patch === 'function' ? patch(state) : patch) });
+ }
+ updater(update) {
+ return () => this.state$.next(update(this.state$.value));
+ }
+ effect(project) {
+ const requests = new Subject();
+ project(requests).subscribe();
+ return (request) => requests.next(request);
+ }
+}
+
+function loadClass(relativePath, dependencies) {
+ const source = readFileSync(path.resolve(__dirname, '../..', relativePath), 'utf8');
+ const compiled = ts.transpileModule(source, {
+ compilerOptions: {
+ target: ts.ScriptTarget.ES2022,
+ module: ts.ModuleKind.CommonJS,
+ experimentalDecorators: true,
+ useDefineForClassFields: false,
+ },
+ }).outputText;
+ const module = { exports: {} };
+ const importModule = (name) => {
+ if (Object.hasOwn(dependencies, name)) return dependencies[name];
+ if (name === 'rxjs' || name === 'rxjs/operators') return require(name);
+ throw new Error(`Unexpected runtime dependency: ${name}`);
+ };
+ vm.runInNewContext(compiled, { module, exports: module.exports, require: importModule });
+ return module.exports;
+}
+
+const angular = { Injectable: () => (target) => target };
+const { LogsComponentStore } = loadClass('apps/36-blocks/src/app/panel/logs/log/logs.store.ts', {
+ '@angular/core': angular,
+ '@ngrx/component-store': { ComponentStore: StateHost },
+ '@ngrx/operators': { tapResponse: (next, error) => tap({ next, error }) },
+ '@proxy/models/root-models': { errorResolver: () => ['Request failed'] },
+});
+const { ProjectGuard } = loadClass('apps/36-blocks/src/app/panel/guard/project.guard.ts', {
+ '@angular/core': angular,
+ '@ngrx/store': { select: (selector) => map(selector) },
+ '../../core/ngrx': { selectProjectAccessState: (state) => state },
+ '../../core/ngrx/actions': { rootActions: { getAllProject: () => ({ type: 'load projects' }) } },
+});
+
+function createLogsStore(service) {
+ return new LogsComponentStore(service, { error() {} });
+}
+
+test('a failed logs response remains distinguishable from an empty successful result and can recover', () => {
+ let response = { hasError: true, errors: ['Unavailable'], data: { data: [{ id: 'stale' }] } };
+ const store = createLogsStore({ getProxyLogs: () => of(response) });
+ store.getLogs({});
+ assert.equal(store.state$.value.logs, null);
+ assert.match(store.state$.value.logsError, /could not be loaded/);
+ assert.equal(store.state$.value.logsInProcess, false);
+ response = { hasError: false, data: { data: [] } };
+ store.getLogs({});
+ assert.equal(store.state$.value.logsError, null);
+ assert.equal(store.state$.value.logs.data.length, 0);
+});
+
+test('transport failures clear loading and a later retry still runs', () => {
+ let failed = true;
+ const store = createLogsStore({
+ getProxyLogs: () => (failed ? throwError(() => ({ errors: ['Offline'] })) : of({ data: { data: [] } })),
+ });
+ store.getLogs({});
+ assert.equal(store.state$.value.logsInProcess, false);
+ assert.match(store.state$.value.logsError, /could not be loaded/);
+ failed = false;
+ store.getLogs({});
+ assert.equal(store.state$.value.logsError, null);
+});
+
+test('a new list request clears stale rows while it is pending', () => {
+ const pending = new Subject();
+ const store = createLogsStore({ getProxyLogs: () => pending });
+ store.patchState({ logs: { data: [{ id: 1 }] } });
+ store.getLogs({});
+ assert.equal(store.state$.value.logs, null);
+ assert.equal(store.state$.value.logsInProcess, true);
+ pending.next({ data: { data: [] } });
+ assert.equal(store.state$.value.logsInProcess, false);
+});
+
+test('failed detail envelopes never become a fabricated successful detail object', () => {
+ const store = createLogsStore({ getProxyLogsById: () => of({ hasError: true, data: { headers: 'private' } }) });
+ store.getLogsById('request-id');
+ assert.equal(store.state$.value.reqLogs, null);
+ assert.match(store.state$.value.reqLogsError, /could not be loaded/);
+ store.resetReqLog();
+ assert.equal(store.state$.value.reqLogsError, null);
+});
+
+test('detail retry clears errors and decodes nested JSON without altering literal markup', () => {
+ let failed = true;
+ const store = createLogsStore({
+ getProxyLogsById: () =>
+ failed
+ ? throwError(() => ({ errors: ['Offline'] }))
+ : of({
+ data: {
+ headers: JSON.stringify(JSON.stringify({ label: 'literal' })),
+ request_body: 'plain text',
+ },
+ }),
+ });
+ store.getLogsById('request-id');
+ assert.equal(store.state$.value.reqLogsInProcess, false);
+ assert.match(store.state$.value.reqLogsError, /could not be loaded/);
+ failed = false;
+ store.getLogsById('request-id');
+ assert.equal(store.state$.value.reqLogsError, null);
+ assert.equal(store.state$.value.reqLogs.headers.label, 'literal');
+ assert.equal(store.state$.value.reqLogs.request_body, 'plain text');
+});
+
+function createGuard(projects) {
+ const dispatched = [];
+ const router = { createUrlTree: (segments) => ({ redirect: segments.join('/') }) };
+ const state = new BehaviorSubject({ projects, loading: false, failed: false });
+ const store = {
+ select: (selector) => state.pipe(map(selector)),
+ dispatch: (action) => {
+ dispatched.push(action);
+ state.next({ ...state.value, loading: true, failed: false });
+ },
+ };
+ return { guard: new ProjectGuard(router, store), state, dispatched };
+}
+
+test('users with no projects receive a completed redirect result', async () => {
+ const { guard } = createGuard({ data: [] });
+ const result = await firstValueFrom(guard.canActivate());
+ assert.equal(result.redirect, '/project');
+});
+
+test('users with projects enter the panel', async () => {
+ const { guard, dispatched } = createGuard({ data: [{ id: 1 }] });
+ assert.equal(await firstValueFrom(guard.canActivate()), true);
+ assert.equal(dispatched.length, 0);
+});
+
+test('unloaded project state triggers fetch and waits for its result', async () => {
+ const { guard, state, dispatched } = createGuard(null);
+ const result = firstValueFrom(guard.canActivate());
+ assert.equal(dispatched.length, 1);
+ state.next({ projects: { data: [] }, loading: false, failed: false });
+ assert.equal((await result).redirect, '/project');
+});
+
+test('project request failure completes navigation with a recovery route, not project creation', async () => {
+ const { guard, state } = createGuard(null);
+ const result = firstValueFrom(guard.canActivate());
+ state.next({ projects: null, loading: false, failed: true });
+ assert.equal((await result).redirect, '/project-load-error');
+});
+
+test('retry after a failed project request waits for fresh results and can enter panel', async () => {
+ const { guard, state, dispatched } = createGuard(null);
+ state.next({ projects: null, loading: false, failed: true });
+ const result = firstValueFrom(guard.canActivate());
+ assert.equal(dispatched.length, 1);
+ assert.equal(state.value.failed, false);
+ state.next({ projects: { data: [{ id: 1 }] }, loading: false, failed: false });
+ assert.equal(await result, true);
+});
+
+test('already pending project request is not duplicated and failure redirects', async () => {
+ const { guard, state, dispatched } = createGuard(null);
+ state.next({ projects: null, loading: true, failed: false });
+ const result = firstValueFrom(guard.canActivate());
+ assert.equal(dispatched.length, 0);
+ state.next({ projects: null, loading: false, failed: true });
+ assert.equal((await result).redirect, '/project-load-error');
+});
+
+const rootActionCreators = new Proxy({}, { get: (_, type) => Object.assign(() => ({ type }), { type }) });
+const { rootReducer, initialState } = loadClass('apps/36-blocks/src/app/core/ngrx/store/reducer/root.reducer.ts', {
+ '@ngrx/store': {
+ on: (action, update) => ({ type: action.type, update }),
+ createReducer:
+ (initial, ...handlers) =>
+ (state = initial, action) => {
+ const handler = handlers.find((entry) => entry.type === action.type);
+ return handler ? handler.update(state, action) : state;
+ },
+ },
+ '../../actions': { rootActions: rootActionCreators },
+});
+
+test('project reducer records failure separately from empty data and resets it on retry/success', () => {
+ let state = rootReducer(initialState, { type: 'getAllProjectsError' });
+ assert.equal(state.projectLoadFailed, true);
+ assert.equal(state.allProjects, null);
+ assert.equal(state.projectInProcess, false);
+ state = rootReducer(state, { type: 'getAllProject' });
+ assert.equal(state.projectLoadFailed, false);
+ assert.equal(state.projectInProcess, true);
+ state = rootReducer(state, { type: 'getAllProjectSuccess', response: { data: [] } });
+ assert.equal(state.projectLoadFailed, false);
+ assert.equal(state.projectInProcess, false);
+ assert.equal(state.allProjects.data.length, 0);
+});
+
+const { RootEffects } = loadClass('apps/36-blocks/src/app/core/ngrx/effects/root/root.effect.ts', {
+ '@angular/core': angular,
+ '@ngrx/effects': {
+ createEffect: (factory) => factory(),
+ ofType: (creator) => require('rxjs').filter((action) => action.type === creator.type),
+ },
+ '../../actions/root.action': rootActionCreators,
+ '@proxy/models/root-models': { errorResolver: () => ['Request failed'] },
+});
+
+test('project effect emits recoverable failure for transport errors, error envelopes, and malformed data', () => {
+ const actions = new Subject();
+ let response = throwError(() => ({ errors: ['Offline'] }));
+ const effects = new RootEffects(actions, { error() {} }, { getProjects: () => response });
+ const results = [];
+ effects.getAllProject$.subscribe((action) => results.push(action));
+ actions.next({ type: 'getAllProject' });
+ response = of({ hasError: true });
+ actions.next({ type: 'getAllProject' });
+ response = of({ hasError: false, data: null });
+ actions.next({ type: 'getAllProject' });
+ response = of({ hasError: false, data: { data: [] } });
+ actions.next({ type: 'getAllProject' });
+ assert.deepEqual(
+ results.map((action) => action.type),
+ ['getAllProjectsError', 'getAllProjectsError', 'getAllProjectsError', 'getAllProjectSuccess']
+ );
+});
+
+test('malformed successful log list envelopes produce recoverable errors while valid empty results succeed', () => {
+ for (const malformed of [
+ null,
+ {},
+ { hasError: false, data: null },
+ { hasError: false, data: {} },
+ { hasError: false, data: { data: {} } },
+ ]) {
+ let response = malformed;
+ const store = createLogsStore({ getProxyLogs: () => of(response) });
+ store.getLogs({});
+ assert.equal(store.state$.value.logs, null);
+ assert.equal(store.state$.value.logsInProcess, false);
+ assert.match(store.state$.value.logsError, /could not be loaded/);
+ response = { hasError: false, data: { data: [] } };
+ store.getLogs({});
+ assert.equal(store.state$.value.logsError, null);
+ assert.equal(store.state$.value.logs.data.length, 0);
+ assert.equal(store.state$.value.logsInProcess, false);
+ }
+});
+
+test('missing or malformed successful log details produce recoverable errors and retry accepts a valid object', () => {
+ for (const malformed of [
+ null,
+ {},
+ { hasError: false, data: null },
+ { hasError: false, data: [] },
+ { hasError: false, data: 'invalid' },
+ ]) {
+ let response = malformed;
+ const store = createLogsStore({ getProxyLogsById: () => of(response) });
+ store.getLogsById('request-id');
+ assert.equal(store.state$.value.reqLogs, null);
+ assert.equal(store.state$.value.reqLogsInProcess, false);
+ assert.match(store.state$.value.reqLogsError, /could not be loaded/);
+ response = { hasError: false, data: { id: 1, headers: null, request_body: null, response: null } };
+ store.getLogsById('request-id');
+ assert.equal(store.state$.value.reqLogsError, null);
+ assert.equal(store.state$.value.reqLogs.id, 1);
+ assert.equal(store.state$.value.reqLogsInProcess, false);
+ }
+});
diff --git a/tools/tests/ssr-bundle.test.cjs b/tools/tests/ssr-bundle.test.cjs
new file mode 100644
index 00000000..52a19d24
--- /dev/null
+++ b/tools/tests/ssr-bundle.test.cjs
@@ -0,0 +1,41 @@
+// Requires npm run build:web first. Unlike ssr-routing.test.cjs, this starts the
+// generated application with the actual Angular engine and generated manifests.
+const assert = require('node:assert/strict');
+const { once } = require('node:events');
+const { existsSync } = require('node:fs');
+const path = require('node:path');
+const { test } = require('node:test');
+const { pathToFileURL } = require('node:url');
+
+const bundle = path.resolve(__dirname, '../../dist/apps/36-blocks/server/server.mjs');
+
+test(
+ 'built SSR entry starts and serves prerendered home plus client-rendered public routes',
+ {
+ skip: !existsSync(bundle) && 'Run npm run build:web before the built SSR smoke check',
+ timeout: 20000,
+ },
+ async () => {
+ const { app } = await import(pathToFileURL(bundle).href);
+ const server = app().listen(0, '127.0.0.1');
+ try {
+ await once(server, 'listening');
+ const baseUrl = `http://127.0.0.1:${server.address().port}`;
+ const home = await fetch(baseUrl, { signal: AbortSignal.timeout(5000) });
+ assert.equal(home.status, 200);
+ const homeHtml = await home.text();
+ assert.match(homeHtml, / server.close(resolve));
+ }
+ }
+);
diff --git a/tools/tests/ssr-routing.test.cjs b/tools/tests/ssr-routing.test.cjs
new file mode 100644
index 00000000..abeb43b8
--- /dev/null
+++ b/tools/tests/ssr-routing.test.cjs
@@ -0,0 +1,117 @@
+// Run: node --test tools/tests/ssr-routing.test.cjs
+// Loads the actual server entry with real Express; only Angular's rendering
+// adapter is substituted so registration, static middleware and HTTP routing run.
+const assert = require('node:assert/strict');
+const { once } = require('node:events');
+const { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { test } = require('node:test');
+const { pathToFileURL } = require('node:url');
+const vm = require('node:vm');
+const ts = require('typescript');
+
+async function withServer(render, run) {
+ const fixtureRoot = mkdtempSync(path.join(os.tmpdir(), '36blocks-ssr-'));
+ const browserFolder = path.join(fixtureRoot, 'browser');
+ mkdirSync(browserFolder);
+ writeFileSync(path.join(browserFolder, 'widget.js'), 'window.widgetReady = true;');
+ const sourcePath = path.resolve(__dirname, '../../apps/36-blocks/src/server.ts');
+ // CommonJS VM execution needs the ESM entry URL supplied explicitly. Route
+ // declarations and middleware are executed directly from the source file.
+ const source = readFileSync(sourcePath, 'utf8').replaceAll(
+ 'import.meta.url',
+ JSON.stringify(pathToFileURL(path.join(fixtureRoot, 'server', 'server.mjs')).href)
+ );
+ const compiled = ts.transpileModule(source, {
+ compilerOptions: { target: ts.ScriptTarget.ES2022, module: ts.ModuleKind.CommonJS, esModuleInterop: true },
+ }).outputText;
+ const module = { exports: {} };
+ let server;
+ try {
+ vm.runInNewContext(compiled, {
+ module,
+ exports: module.exports,
+ process,
+ console,
+ require: (name) =>
+ name === '@angular/ssr/node'
+ ? {
+ AngularNodeAppEngine: class {
+ handle(req) {
+ return Promise.resolve().then(() => render(req));
+ }
+ },
+ createNodeRequestHandler: (app) => app,
+ isMainModule: () => false,
+ writeResponseToNodeResponse: (response, res) => {
+ res.status(response.status).send(response.body);
+ },
+ }
+ : require(name),
+ });
+ const app = module.exports.app();
+ app.set('env', 'test');
+ server = app.listen(0, '127.0.0.1');
+ await once(server, 'listening');
+ await run(`http://127.0.0.1:${server.address().port}`);
+ } finally {
+ if (server) await new Promise((resolve) => server.close(resolve));
+ rmSync(fixtureRoot, { recursive: true, force: true });
+ }
+}
+
+test('SSR server starts under Express 5 and renders root and nested browser routes', async () => {
+ await withServer(
+ (req) => ({ status: 200, body: `Rendered ${req.path}` }),
+ async (baseUrl) => {
+ for (const route of ['/', '/about', '/app/activity', '/deep/nested/path?filter=test']) {
+ const response = await fetch(`${baseUrl}${route}`);
+ assert.equal(response.status, 200);
+ assert.equal(await response.text(), `Rendered ${route.split('?')[0]}`);
+ }
+ }
+ );
+});
+
+test('static assets are served before SSR with caching and HEAD support', async () => {
+ let renders = 0;
+ await withServer(
+ () => {
+ renders++;
+ return { status: 200, body: 'SSR fallback' };
+ },
+ async (baseUrl) => {
+ const response = await fetch(`${baseUrl}/widget.js`);
+ assert.equal(response.status, 200);
+ assert.equal(await response.text(), 'window.widgetReady = true;');
+ assert.match(response.headers.get('cache-control'), /max-age=31536000/);
+ const head = await fetch(`${baseUrl}/widget.js`, { method: 'HEAD' });
+ assert.equal(head.status, 200);
+ assert.equal(await head.text(), '');
+ assert.equal(renders, 0);
+ }
+ );
+});
+
+test('unhandled SSR requests fall through to 404', async () => {
+ await withServer(
+ () => null,
+ async (baseUrl) => {
+ const response = await fetch(`${baseUrl}/unhandled`);
+ assert.equal(response.status, 404);
+ }
+ );
+});
+
+test('rendering failures reach Express error handling rather than leaving requests pending', async () => {
+ await withServer(
+ () => {
+ throw new Error('SSR test render failure');
+ },
+ async (baseUrl) => {
+ const response = await fetch(`${baseUrl}/broken`);
+ assert.equal(response.status, 500);
+ }
+ );
+});
diff --git a/tools/tests/widget-example.test.cjs b/tools/tests/widget-example.test.cjs
new file mode 100644
index 00000000..35a82978
--- /dev/null
+++ b/tools/tests/widget-example.test.cjs
@@ -0,0 +1,54 @@
+// Checks the actual public example without making provider or network requests.
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+const { test } = require('node:test');
+const ts = require('typescript');
+
+const source = fs.readFileSync(
+ path.resolve(__dirname, '../../apps/36-blocks/src/app/website/docs/widget-example.ts'),
+ 'utf8'
+);
+const exportsObject = {};
+vm.runInNewContext(ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS } }).outputText, {
+ exports: exportsObject,
+});
+const example = exportsObject.WIDGET_EXAMPLE;
+
+function executeExample() {
+ const status = { textContent: '' };
+ let config;
+ const context = vm.createContext({
+ document: { getElementById: (id) => (id === 'auth-status' ? status : null) },
+ window: {
+ initVerification: (configuration) => {
+ config = configuration;
+ },
+ },
+ });
+ const inlineScript = example.match(/
-
-
+
-
- Infrastructure & Hosting
-- 36Blocks runs on enterprise-grade cloud infrastructure with automatic failover, redundancy, and - geographic distribution. All services are containerised and isolated to prevent cross-tenant - data leakage. -
-
+
+
-
-
-
+
-
-
-
+
-
-
-
+
-
-
-
+
diff --git a/apps/36-blocks/src/app/website/security/security.component.ts b/apps/36-blocks/src/app/website/security/security.component.ts
index 61aa948e..92383c7e 100644
--- a/apps/36-blocks/src/app/website/security/security.component.ts
+++ b/apps/36-blocks/src/app/website/security/security.component.ts
@@ -17,13 +17,13 @@ export class SecurityComponent implements OnInit {
this.metaService.updateTag({
name: 'description',
content:
- 'Learn how 36Blocks keeps your users safe with enterprise-grade encryption, hCaptcha bot protection, rate limiting, RBAC audit logs, and responsible disclosure.',
+ 'Understand authentication configuration, application access boundaries, and investigation coverage in 36Blocks.',
});
this.metaService.updateTag({ name: 'robots', content: 'index, follow' });
this.metaService.updateTag({ property: 'og:title', content: 'Security — 36Blocks' });
this.metaService.updateTag({
property: 'og:description',
- content: 'Enterprise-grade security built into every layer of 36Blocks.',
+ content: 'Authentication configuration and application security boundaries.',
});
this.metaService.updateTag({ property: 'og:type', content: 'website' });
}
diff --git a/apps/36-blocks/src/app/website/terms/terms.component.html b/apps/36-blocks/src/app/website/terms/terms.component.html
index dead6ff8..546ae106 100644
--- a/apps/36-blocks/src/app/website/terms/terms.component.html
+++ b/apps/36-blocks/src/app/website/terms/terms.component.html
@@ -38,9 +38,9 @@ Authentication configuration
++ Blocks support configurable login methods, provider settings, session expiry, and hCaptcha integration. + Availability and enforcement depend on the selected block and deployment. Configure the providers and + verify failure, expiry, and recovery behavior for your application before launch. +
-
-
+
-
- Data Encryption
-- All data is encrypted both in transit and at rest. We use TLS 1.2+ for all network communication - and AES-256 for data stored on disk. Passwords are hashed using bcrypt and are never stored in - plaintext. -
--
- @for (
- item of [
- 'TLS 1.2+ for all API and dashboard traffic',
- 'AES-256 encryption at rest',
- 'bcrypt password hashing',
- 'Encrypted database backups',
- ];
- track item
- ) {
-
- - - {{ item }} - - } -
Identity and application access
++ Authentication identifies a user. It does not grant access to every application or organization. Roles + and permissions help model membership, while each connected product remains responsible for resource + ownership and business authorization on its backend. +
++ Do not rely on a browser callback or hidden UI control to protect a resource. Your application must + verify authentication results, expiry, membership, and permissions before granting access. +
-
-
+
-
- Authentication Security
-- 36Blocks implements industry best practices for authentication flows including OTP expiry, rate - limiting, brute-force protection, and bot prevention via hCaptcha. -
--
- @for (
- item of [
- 'hCaptcha bot protection on all public endpoints',
- 'OTP codes expire within 10 minutes',
- 'Rate limiting on login and OTP requests',
- 'Session tokens with configurable expiry',
- 'Secure, HttpOnly cookies where applicable',
- ];
- track item
- ) {
-
- - - {{ item }} - - } -
Investigation and activity history
++ Request logs help investigate API failures. Sensitive-operation activity history records the operations + that have been instrumented, including Login as attempts. Coverage and availability depend on the + deployed version and permissions. +
++ Confirm retention, operator access, and the required investigation coverage with the team. Use activity + records within their documented coverage. +
-
-
+
-
- - Access Control & Audit Logs -
-- Role-Based Access Control (RBAC) is built into the core of 36Blocks. Every action is logged with - a full audit trail so you can see who did what, when. Logs are retained per your plan and are - tamper-evident. -
-Deployment responsibilities
++ Transport protection, database encryption, backups, recovery, and availability depend on the hosting + environment. Confirm these controls and any service commitments for your deployment. Ask the team for + environment-specific availability and recovery commitments. +
-
-
+
-
- Responsible Disclosure
-- If you discover a security vulnerability, please contact us at - security@36blocks.com. We will respond within 48 hours and work with you to resolve the issue responsibly. -
-Report a security concern
++ Contact the team through the contact page. + Include the affected flow and safe reproduction steps. Do not include passwords, session tokens, or + personal data in your initial message. +
1. Acceptance of Terms
- By accessing or using the 36Blocks platform, APIs, SDKs, or any related services (collectively, the - "Service"), you agree to be bound by these Terms of Service ("Terms"). If you do not agree, do not use - the Service. + By accessing or using the 36Blocks platform, APIs, browser widget, or any related services + (collectively, the "Service"), you agree to be bound by these Terms of Service ("Terms"). If you do not + agree, do not use the Service.