@posiwise/common-services 0.1.75 → 0.1.77

package/fesm2022/posiwise-common-services.mjs

@@ -1,22 +1,22 @@
 import * as i0 from '@angular/core';
 import { Injectable, Inject, isDevMode, inject, NgModule, ViewEncapsulation } from '@angular/core';
-import * as i1 from '@angular/router';
+import * as i3 from '@angular/router';
 import { NavigationEnd } from '@angular/router';
-import * as i1$1 from '@posiwise/app-config-service';
+import * as i1 from '@posiwise/app-config-service';
 import { AppConfigService } from '@posiwise/app-config-service';
 import { DOCUMENT, CommonModule } from '@angular/common';
-import * as i1$3 from '@angular/common/http';
+import * as i1$2 from '@angular/common/http';
 import { HttpErrorResponse, HttpHeaders } from '@angular/common/http';
-import { throwError, of, tap, BehaviorSubject, timer } from 'rxjs';
+import { throwError, of, BehaviorSubject, tap, timer } from 'rxjs';
 import { catchError, switchMap, map, mergeMap, tap as tap$1, distinctUntilChanged } from 'rxjs/operators';
 import { HelperService } from '@posiwise/helper-service';
-import * as i1$2 from 'ngx-toastr';
+import * as i1$1 from 'ngx-toastr';
 import { getUser, UserActionTypes, SetUser, appReducers } from '@posiwise/app-store';
-import * as i1$4 from '@ngrx/effects';
+import * as i1$3 from '@ngrx/effects';
 import { Actions, createEffect, ofType, EffectsModule } from '@ngrx/effects';
 import * as i2 from '@ngrx/store';
 import { StoreModule } from '@ngrx/store';
-import { INTEGRATIONS_API_PREFIX, MAIN_API_PREFIX, USER_PATH, USER_IMPERSONATED_TOKEN, USER_IMPERSONATED_PHONEGAP_TOKEN, TOKEN_KEY, TOKEN_HEADER_KEY, NEWSLETTER_CONFIRMATION_PATH, NEWSLETTER_UNSUBSCRIBE_PATH, CAPTCHA_VALIDATION_PATH, SOCIAL_LOGIN_PATH, PERMISSION_NAMES, ADMIN_SUB_MENU_WHITELIST, AB_TEST_ACTIONS, GEO_PATH, PROJECT_PATH, PRODUCT_PATH, CONTACT_US_PATH, INCIDENTS_PATH, INCIDENTS_PATH_ADMIN, NEWSLETTERS_PATH, NEWSLETTER_SUBSCRIPTION_PATH, ADMIN_FAQS_PATH, FAQS_PATH, ORGANIZATIONS_PATH, GLOBAL_SUBSCRIPTION_CONFIGS_PATH, GLOBAL_CONFIGS_PATH, USER_LOGIN_NOTIFICATION, FEEDBACK_QUESTIONS_PATH, USER_FEEDBACKS_PATH, CUSTOMER_SUPPORT_PATH, ADMIN_TAG_PATH, ADMIN_TAG_CATEGORIES_PATH, ADMIN_PATH, QUALIFICATIONS_PATH, SOCKET_TYPE, BRAIN_API_PREFIX } from '@posiwise/common-utilities';
+import { INTEGRATIONS_API_PREFIX, MAIN_API_PREFIX, USER_PATH, TOKEN_HEADER_KEY, NEWSLETTER_CONFIRMATION_PATH, NEWSLETTER_UNSUBSCRIBE_PATH, CAPTCHA_VALIDATION_PATH, SOCIAL_LOGIN_PATH, TOKEN_KEY, PERMISSION_NAMES, ADMIN_SUB_MENU_WHITELIST, AB_TEST_ACTIONS, GEO_PATH, PROJECT_PATH, PRODUCT_PATH, CONTACT_US_PATH, INCIDENTS_PATH, INCIDENTS_PATH_ADMIN, NEWSLETTERS_PATH, NEWSLETTER_SUBSCRIPTION_PATH, ADMIN_FAQS_PATH, FAQS_PATH, ORGANIZATIONS_PATH, GLOBAL_SUBSCRIPTION_CONFIGS_PATH, GLOBAL_CONFIGS_PATH, USER_LOGIN_NOTIFICATION, FEEDBACK_QUESTIONS_PATH, USER_FEEDBACKS_PATH, CUSTOMER_SUPPORT_PATH, ADMIN_TAG_PATH, ADMIN_TAG_CATEGORIES_PATH, ADMIN_PATH, QUALIFICATIONS_PATH, SOCKET_TYPE, BRAIN_API_PREFIX } from '@posiwise/common-utilities';
 import swal from 'sweetalert2';
 import cloneDeep from 'lodash/cloneDeep';
 import pickBy from 'lodash/pickBy';
@@ -212,12 +212,12 @@ class GoogleAnalyticsService {
             this.subscription.unsubscribe();
         }
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: GoogleAnalyticsService, deps: [{ token: i1.Router }, { token: ScriptLoaderService }, { token: i1$1.AppConfigService }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: GoogleAnalyticsService, deps: [{ token: i3.Router }, { token: ScriptLoaderService }, { token: i1.AppConfigService }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: GoogleAnalyticsService }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: GoogleAnalyticsService, decorators: [{
             type: Injectable
-        }], ctorParameters: () => [{ type: i1.Router }, { type: ScriptLoaderService }, { type: i1$1.AppConfigService }] });
+        }], ctorParameters: () => [{ type: i3.Router }, { type: ScriptLoaderService }, { type: i1.AppConfigService }] });
 
 class CustomToastService {
     constructor(toastr) {
@@ -289,7 +289,7 @@ class CustomToastService {
                 this.error(message);
         }
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: CustomToastService, deps: [{ token: i1$2.ToastrService }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: CustomToastService, deps: [{ token: i1$1.ToastrService }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: CustomToastService, providedIn: 'root' }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: CustomToastService, decorators: [{
@@ -297,7 +297,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImpo
             args: [{
                     providedIn: 'root'
                 }]
-        }], ctorParameters: () => [{ type: i1$2.ToastrService }] });
+        }], ctorParameters: () => [{ type: i1$1.ToastrService }] });
 
 /* eslint-disable @typescript-eslint/no-explicit-any */
 class BaseHttpService {
@@ -383,12 +383,12 @@ class BaseHttpService {
             this.toast.showToast(error);
         }
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: BaseHttpService, deps: [{ token: i1$3.HttpClient }, { token: i0.Injector }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: BaseHttpService, deps: [{ token: i1$2.HttpClient }, { token: i0.Injector }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: BaseHttpService }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: BaseHttpService, decorators: [{
             type: Injectable
-        }], ctorParameters: () => [{ type: i1$3.HttpClient }, { type: i0.Injector }] });
+        }], ctorParameters: () => [{ type: i1$2.HttpClient }, { type: i0.Injector }] });
 
 class IntegrationsApiHttpService extends BaseHttpService {
     constructor(http, injector) {
@@ -401,7 +401,7 @@ class IntegrationsApiHttpService extends BaseHttpService {
                 : config?.['links']?.integrations_api;
         });
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: IntegrationsApiHttpService, deps: [{ token: i1$3.HttpClient }, { token: i0.Injector }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: IntegrationsApiHttpService, deps: [{ token: i1$2.HttpClient }, { token: i0.Injector }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: IntegrationsApiHttpService, providedIn: 'root' }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: IntegrationsApiHttpService, decorators: [{
@@ -409,7 +409,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImpo
             args: [{
                     providedIn: 'root'
                 }]
-        }], ctorParameters: () => [{ type: i1$3.HttpClient }, { type: i0.Injector }] });
+        }], ctorParameters: () => [{ type: i1$2.HttpClient }, { type: i0.Injector }] });
 
 class LocalStorage {
     getItem$(key) {
@@ -449,7 +449,7 @@ class MainApiHttpService extends BaseHttpService {
             this.baseUrl = isDevMode() ? MAIN_API_PREFIX : config?.['links']?.main_api;
         });
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: MainApiHttpService, deps: [{ token: i1$3.HttpClient }, { token: i0.Injector }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: MainApiHttpService, deps: [{ token: i1$2.HttpClient }, { token: i0.Injector }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: MainApiHttpService, providedIn: 'root' }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: MainApiHttpService, decorators: [{
@@ -457,7 +457,267 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImpo
             args: [{
                     providedIn: 'root'
                 }]
-        }], ctorParameters: () => [{ type: i1$3.HttpClient }, { type: i0.Injector }] });
+        }], ctorParameters: () => [{ type: i1$2.HttpClient }, { type: i0.Injector }] });
+
+/**
+ * Secure Token Storage Service
+ *
+ * This service provides secure token storage using memory + secure cookies.
+ * NO localStorage usage - tokens are stored only in memory and secure cookies.
+ *
+ * Security Features:
+ * - Memory storage (primary) - not persistent across refreshes
+ * - Secure cookies (backup) - with SameSite=Strict protection
+ * - No localStorage - prevents XSS token theft
+ * - Secure flag for HTTPS
+ * - CSRF protection via SameSite cookies
+ */
+class SecureTokenStorageService {
+    constructor(document) {
+        this.document = document;
+        this.TOKEN_COOKIE_NAME = 'auth_token';
+        this.IMPERSONATED_TOKEN_COOKIE_NAME = 'user_impersonated_token';
+        this.PHONEGAP_TOKEN_COOKIE_NAME = 'user_impersonated_phonegap_token';
+        // In-memory fallback for development or when cookies are not available
+        this.memoryStorage = new Map();
+        this.tokenSubject = new BehaviorSubject(null);
+        this.impersonatedTokenSubject = new BehaviorSubject(null);
+        this.phonegapTokenSubject = new BehaviorSubject(null);
+        this.initializeTokens();
+    }
+    /**
+     * Store authentication token securely
+     */
+    storeToken(token) {
+        try {
+            // Store ONLY in memory and secure cookie - NO localStorage
+            this.memoryStorage.set(this.TOKEN_COOKIE_NAME, token);
+            this.setSecureCookie(this.TOKEN_COOKIE_NAME, token);
+            this.tokenSubject.next(token);
+            return of(true);
+        }
+        catch (error) {
+            console.warn('Failed to store token, using memory fallback:', error);
+            this.memoryStorage.set(this.TOKEN_COOKIE_NAME, token);
+            this.tokenSubject.next(token);
+            return of(true);
+        }
+    }
+    /**
+     * Store impersonated user token
+     */
+    storeImpersonatedToken(token) {
+        try {
+            // Store ONLY in memory and secure cookie - NO localStorage
+            this.memoryStorage.set(this.IMPERSONATED_TOKEN_COOKIE_NAME, token);
+            this.setSecureCookie(this.IMPERSONATED_TOKEN_COOKIE_NAME, token);
+            this.impersonatedTokenSubject.next(token);
+            return of(true);
+        }
+        catch (error) {
+            console.warn('Failed to store impersonated token, using memory fallback:', error);
+            this.memoryStorage.set(this.IMPERSONATED_TOKEN_COOKIE_NAME, token);
+            this.impersonatedTokenSubject.next(token);
+            return of(true);
+        }
+    }
+    /**
+     * Store phonegap impersonated token
+     */
+    storePhonegapToken(token) {
+        try {
+            // Store ONLY in memory and secure cookie - NO localStorage
+            this.memoryStorage.set(this.PHONEGAP_TOKEN_COOKIE_NAME, token);
+            this.setSecureCookie(this.PHONEGAP_TOKEN_COOKIE_NAME, token);
+            this.phonegapTokenSubject.next(token);
+            return of(true);
+        }
+        catch (error) {
+            console.warn('Failed to store phonegap token, using memory fallback:', error);
+            this.memoryStorage.set(this.PHONEGAP_TOKEN_COOKIE_NAME, token);
+            this.phonegapTokenSubject.next(token);
+            return of(true);
+        }
+    }
+    /**
+     * Get authentication token
+     */
+    getToken() {
+        // Try memory storage first (primary storage)
+        const memoryToken = this.memoryStorage.get(this.TOKEN_COOKIE_NAME);
+        if (memoryToken) {
+            return memoryToken;
+        }
+        // Try cookie as backup
+        const cookieToken = this.getCookieValue(this.TOKEN_COOKIE_NAME);
+        if (cookieToken) {
+            // Restore to memory storage
+            this.memoryStorage.set(this.TOKEN_COOKIE_NAME, cookieToken);
+            return cookieToken;
+        }
+        return null;
+    }
+    /**
+     * Get impersonated token
+     */
+    getImpersonatedToken() {
+        const memoryToken = this.memoryStorage.get(this.IMPERSONATED_TOKEN_COOKIE_NAME);
+        if (memoryToken) {
+            return memoryToken;
+        }
+        const cookieToken = this.getCookieValue(this.IMPERSONATED_TOKEN_COOKIE_NAME);
+        if (cookieToken) {
+            this.memoryStorage.set(this.IMPERSONATED_TOKEN_COOKIE_NAME, cookieToken);
+            return cookieToken;
+        }
+        return null;
+    }
+    /**
+     * Get phonegap token
+     */
+    getPhonegapToken() {
+        const memoryToken = this.memoryStorage.get(this.PHONEGAP_TOKEN_COOKIE_NAME);
+        if (memoryToken) {
+            return memoryToken;
+        }
+        const cookieToken = this.getCookieValue(this.PHONEGAP_TOKEN_COOKIE_NAME);
+        if (cookieToken) {
+            this.memoryStorage.set(this.PHONEGAP_TOKEN_COOKIE_NAME, cookieToken);
+            return cookieToken;
+        }
+        return null;
+    }
+    /**
+     * Get token as Observable
+     */
+    getToken$() {
+        return this.tokenSubject.asObservable();
+    }
+    /**
+     * Get impersonated token as Observable
+     */
+    getImpersonatedToken$() {
+        return this.impersonatedTokenSubject.asObservable();
+    }
+    /**
+     * Get phonegap token as Observable
+     */
+    getPhonegapToken$() {
+        return this.phonegapTokenSubject.asObservable();
+    }
+    /**
+     * Remove all tokens
+     */
+    clearTokens() {
+        try {
+            // Clear cookies
+            this.deleteCookie(this.TOKEN_COOKIE_NAME);
+            this.deleteCookie(this.IMPERSONATED_TOKEN_COOKIE_NAME);
+            this.deleteCookie(this.PHONEGAP_TOKEN_COOKIE_NAME);
+        }
+        catch (error) {
+            console.warn('Failed to clear cookies:', error);
+        }
+        // Clear memory storage
+        this.memoryStorage.delete(this.TOKEN_COOKIE_NAME);
+        this.memoryStorage.delete(this.IMPERSONATED_TOKEN_COOKIE_NAME);
+        this.memoryStorage.delete(this.PHONEGAP_TOKEN_COOKIE_NAME);
+        // Update subjects
+        this.tokenSubject.next(null);
+        this.impersonatedTokenSubject.next(null);
+        this.phonegapTokenSubject.next(null);
+        return of(true);
+    }
+    /**
+     * Remove specific token
+     */
+    removeToken() {
+        try {
+            this.deleteCookie(this.TOKEN_COOKIE_NAME);
+        }
+        catch (error) {
+            console.warn('Failed to remove token:', error);
+        }
+        this.memoryStorage.delete(this.TOKEN_COOKIE_NAME);
+        this.tokenSubject.next(null);
+        return of(true);
+    }
+    /**
+     * Remove impersonated tokens
+     */
+    removeImpersonatedTokens() {
+        try {
+            this.deleteCookie(this.IMPERSONATED_TOKEN_COOKIE_NAME);
+            this.deleteCookie(this.PHONEGAP_TOKEN_COOKIE_NAME);
+        }
+        catch (error) {
+            console.warn('Failed to remove impersonated tokens:', error);
+        }
+        this.memoryStorage.delete(this.IMPERSONATED_TOKEN_COOKIE_NAME);
+        this.memoryStorage.delete(this.PHONEGAP_TOKEN_COOKIE_NAME);
+        this.impersonatedTokenSubject.next(null);
+        this.phonegapTokenSubject.next(null);
+        return of(true);
+    }
+    /**
+     * Set secure cookie
+     * Note: HttpOnly cannot be set from client-side JavaScript
+     * For maximum security, backend should set httpOnly cookies
+     */
+    setSecureCookie(name, value) {
+        const isSecure = this.document.location.protocol === 'https:';
+        // Set cookie with maximum security possible from client-side
+        const cookieString = `${name}=${value}; Path=/; ${isSecure ? 'Secure; ' : ''}SameSite=Strict; Max-Age=86400`;
+        this.document.cookie = cookieString;
+        // Log warning about security limitations
+        console.warn('⚠️ SECURITY WARNING: Cookie is not httpOnly. For maximum security, backend should set httpOnly cookies.');
+    }
+    /**
+     * Get cookie value
+     */
+    getCookieValue(name) {
+        const value = `; ${this.document.cookie}`;
+        const parts = value.split(`; ${name}=`);
+        if (parts.length === 2) {
+            return parts.pop()?.split(';').shift() || null;
+        }
+        return null;
+    }
+    /**
+     * Delete cookie
+     */
+    deleteCookie(name) {
+        this.document.cookie = `${name}=; Path=/; expires=Thu, 01 Jan 1970 00:00:01 GMT;`;
+    }
+    /**
+     * Initialize tokens from storage on service startup
+     */
+    initializeTokens() {
+        const token = this.getToken();
+        const impersonatedToken = this.getImpersonatedToken();
+        const phonegapToken = this.getPhonegapToken();
+        if (token) {
+            this.tokenSubject.next(token);
+        }
+        if (impersonatedToken) {
+            this.impersonatedTokenSubject.next(impersonatedToken);
+        }
+        if (phonegapToken) {
+            this.phonegapTokenSubject.next(phonegapToken);
+        }
+    }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: SecureTokenStorageService, deps: [{ token: DOCUMENT }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: SecureTokenStorageService, providedIn: 'root' }); }
+}
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: SecureTokenStorageService, decorators: [{
+            type: Injectable,
+            args: [{
+                    providedIn: 'root'
+                }]
+        }], ctorParameters: () => [{ type: Document, decorators: [{
+                    type: Inject,
+                    args: [DOCUMENT]
+                }] }] });
 
 class UserService {
     constructor(api, store, router) {
@@ -549,7 +809,7 @@ class UserService {
     postTipsDisregarded(data) {
         return this.api.post('/users/user_tips', data);
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: UserService, deps: [{ token: MainApiHttpService }, { token: i2.Store }, { token: i1.Router }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: UserService, deps: [{ token: MainApiHttpService }, { token: i2.Store }, { token: i3.Router }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: UserService, providedIn: 'root' }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: UserService, decorators: [{
@@ -557,11 +817,12 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImpo
             args: [{
                     providedIn: 'root'
                 }]
-        }], ctorParameters: () => [{ type: MainApiHttpService }, { type: i2.Store }, { type: i1.Router }] });
+        }], ctorParameters: () => [{ type: MainApiHttpService }, { type: i2.Store }, { type: i3.Router }] });
 
 class AuthService {
-    constructor(localStorage, router, http, userService, toastr, appConfigService, integrationsApi, document) {
+    constructor(localStorage, secureTokenStorage, router, http, userService, toastr, appConfigService, integrationsApi, document) {
         this.localStorage = localStorage;
+        this.secureTokenStorage = secureTokenStorage;
         this.router = router;
         this.http = http;
         this.userService = userService;
@@ -578,20 +839,20 @@ class AuthService {
         this.setHeaderKey();
     }
     getToken() {
-        if (this.localStorage.getItem(USER_IMPERSONATED_TOKEN)) {
+        if (this.secureTokenStorage.getImpersonatedToken()) {
             this.isUserPersonated = true;
-            return this.localStorage.getItem(USER_IMPERSONATED_TOKEN);
+            return this.secureTokenStorage.getImpersonatedToken();
         }
-        if (this.localStorage.getItem(USER_IMPERSONATED_PHONEGAP_TOKEN)) {
+        if (this.secureTokenStorage.getPhonegapToken()) {
             this.isUserPersonated = true;
-            return this.localStorage.getItem(USER_IMPERSONATED_PHONEGAP_TOKEN);
+            return this.secureTokenStorage.getPhonegapToken();
         }
         this.isUserPersonated = false;
-        return this.localStorage.getItem(TOKEN_KEY);
+        return this.secureTokenStorage.getToken();
     }
     getImpersonatedToken() {
-        return (this.localStorage.getItem(USER_IMPERSONATED_TOKEN) ||
-            this.localStorage.getItem(USER_IMPERSONATED_PHONEGAP_TOKEN));
+        return (this.secureTokenStorage.getImpersonatedToken() ||
+            this.secureTokenStorage.getPhonegapToken());
     }
     setHeaderKey() {
         // Mobile: app
@@ -680,7 +941,7 @@ class AuthService {
         return this.http.post('session', formData);
     }
     storeToken(token) {
-        return this.localStorage.setItem$(TOKEN_KEY, token);
+        return this.secureTokenStorage.storeToken(token);
     }
     storePlatform(plat) {
         return this.localStorage.setItem$('platform', plat);
@@ -694,10 +955,18 @@ class AuthService {
                 phonegap: true
             };
         }
+        // Clear all tokens securely
+        this.secureTokenStorage.clearTokens().subscribe();
         return this.http.delete('session', options);
     }
+    /**
+     * Clear all authentication tokens
+     */
+    clearTokens() {
+        return this.secureTokenStorage.clearTokens();
+    }
     getToken$() {
-        return this.localStorage.getItem$(TOKEN_KEY);
+        return this.secureTokenStorage.getToken$();
     }
     getNewsletterSubscription(token) {
         return this.http.get(`${NEWSLETTER_CONFIRMATION_PATH}?token=${token}`);
@@ -778,10 +1047,10 @@ class AuthService {
         }
         return this.http.post('/session/impersonate_user', data).pipe(map(x => {
             if (x?.auth_token) {
-                this.localStorage.setItem$(USER_IMPERSONATED_TOKEN, x.auth_token);
+                this.secureTokenStorage.storeImpersonatedToken(x.auth_token);
             }
             if (x?.phonegap_token) {
-                this.localStorage.setItem$(USER_IMPERSONATED_PHONEGAP_TOKEN, x.phonegap_token);
+                this.secureTokenStorage.storePhonegapToken(x.phonegap_token);
             }
             return x;
         }));
@@ -832,12 +1101,12 @@ class AuthService {
             }
         });
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: AuthService, deps: [{ token: LocalStorage }, { token: i1.Router }, { token: MainApiHttpService }, { token: UserService }, { token: CustomToastService }, { token: i1$1.AppConfigService }, { token: IntegrationsApiHttpService }, { token: DOCUMENT }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: AuthService, deps: [{ token: LocalStorage }, { token: SecureTokenStorageService }, { token: i3.Router }, { token: MainApiHttpService }, { token: UserService }, { token: CustomToastService }, { token: i1.AppConfigService }, { token: IntegrationsApiHttpService }, { token: DOCUMENT }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: AuthService }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: AuthService, decorators: [{
             type: Injectable
-        }], ctorParameters: () => [{ type: LocalStorage }, { type: i1.Router }, { type: MainApiHttpService }, { type: UserService }, { type: CustomToastService }, { type: i1$1.AppConfigService }, { type: IntegrationsApiHttpService }, { type: Document, decorators: [{
+        }], ctorParameters: () => [{ type: LocalStorage }, { type: SecureTokenStorageService }, { type: i3.Router }, { type: MainApiHttpService }, { type: UserService }, { type: CustomToastService }, { type: i1.AppConfigService }, { type: IntegrationsApiHttpService }, { type: Document, decorators: [{
                     type: Inject,
                     args: [DOCUMENT]
                 }] }] });
@@ -864,7 +1133,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImpo
 
 class CommonServicesModule {
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: CommonServicesModule, deps: [], target: i0.ɵɵFactoryTarget.NgModule }); }
-    static { this.ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "17.3.11", ngImport: i0, type: CommonServicesModule, imports: [CommonModule, i1$4.EffectsRootModule, i2.StoreRootModule] }); }
+    static { this.ɵmod = i0.ɵɵngDeclareNgModule({ minVersion: "14.0.0", version: "17.3.11", ngImport: i0, type: CommonServicesModule, imports: [CommonModule, i1$3.EffectsRootModule, i2.StoreRootModule] }); }
     static { this.ɵinj = i0.ɵɵngDeclareInjector({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: CommonServicesModule, providers: [AuthService], imports: [CommonModule, EffectsModule.forRoot([UserEffects]), StoreModule.forRoot(appReducers)] }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: CommonServicesModule, decorators: [{
@@ -1002,8 +1271,8 @@ class PermissionService {
         }
         expr = this.handleNonBooleanPermissions(permission, expr, productKey, permission_key, productSlug);
         // Now expr is made of true/false values with &&, ||, ()
-        // eslint-disable-next-line no-eval
-        return eval(expr); // NOSONAR
+        // Safe evaluation of boolean expressions without using eval()
+        return this.evaluateBooleanExpression(expr);
     }
     handleNonBooleanPermissions(permission, expr, productKey, permission_key, productSlug) {
         if (typeof permission !== 'boolean') {
@@ -1110,6 +1379,161 @@ class PermissionService {
     getCurrentProduct() {
         return JSON.parse(localStorage.getItem('product'));
     }
+    /**
+     * Safely evaluates boolean expressions without using eval()
+     * Supports: true, false, &&, ||, (, )
+     * @param expr - Boolean expression string like "true && false || (true && false)"
+     * @returns boolean result
+     */
+    evaluateBooleanExpression(expr) {
+        if (!expr || typeof expr !== 'string') {
+            return false;
+        }
+        try {
+            // Clean up the expression - remove extra spaces and normalize
+            const cleanExpr = expr.trim().replace(/\s+/g, ' ');
+            // Simple tokenizer for boolean expressions
+            const tokens = this.tokenizeBooleanExpression(cleanExpr);
+            // Parse and evaluate the expression
+            return this.parseBooleanExpression(tokens);
+        }
+        catch (error) {
+            console.warn('Error evaluating boolean expression:', expr, error);
+            return false;
+        }
+    }
+    /**
+     * Tokenizes a boolean expression string
+     */
+    tokenizeBooleanExpression(expr) {
+        const tokens = [];
+        let i = 0;
+        while (i < expr.length) {
+            const char = expr[i];
+            if (this.isWhitespace(char)) {
+                i++;
+            }
+            else if (this.isParenthesis(char)) {
+                tokens.push(char);
+                i++;
+            }
+            else if (this.isDoubleOperator(expr, i, '&')) {
+                tokens.push('&&');
+                i += 2;
+            }
+            else if (this.isDoubleOperator(expr, i, '|')) {
+                tokens.push('||');
+                i += 2;
+            }
+            else {
+                const token = this.collectToken(expr, i);
+                if (token.value) {
+                    tokens.push(token.value);
+                }
+                i = token.nextIndex;
+            }
+        }
+        return tokens;
+    }
+    isWhitespace(char) {
+        return char === ' ';
+    }
+    isParenthesis(char) {
+        return char === '(' || char === ')';
+    }
+    isDoubleOperator(expr, index, operator) {
+        return expr[index] === operator && expr[index + 1] === operator;
+    }
+    collectToken(expr, startIndex) {
+        let current = '';
+        let i = startIndex;
+        while (i < expr.length && ![' ', '(', ')', '&', '|'].includes(expr[i])) {
+            current += expr[i];
+            i++;
+        }
+        return { value: current, nextIndex: i };
+    }
+    /**
+     * Parses and evaluates boolean expression tokens
+     */
+    parseBooleanExpression(tokens) {
+        // Handle simple cases first
+        if (tokens.length === 1) {
+            return tokens[0] === 'true';
+        }
+        // Convert to postfix notation and evaluate
+        const postfix = this.infixToPostfix(tokens);
+        return this.evaluatePostfix(postfix);
+    }
+    /**
+     * Converts infix notation to postfix (Reverse Polish Notation)
+     */
+    infixToPostfix(tokens) {
+        const output = [];
+        const operators = [];
+        const precedence = { '||': 1, '&&': 2 };
+        for (const token of tokens) {
+            if (token === 'true' || token === 'false') {
+                output.push(token);
+            }
+            else if (token === '(') {
+                operators.push(token);
+            }
+            else if (token === ')') {
+                while (operators.length > 0 && operators[operators.length - 1] !== '(') {
+                    const op = operators.pop();
+                    if (op)
+                        output.push(op);
+                }
+                operators.pop(); // Remove '('
+            }
+            else if (token === '&&' || token === '||') {
+                while (operators.length > 0 &&
+                    operators[operators.length - 1] !== '(' &&
+                    precedence[operators[operators.length - 1]] >= precedence[token]) {
+                    const op = operators.pop();
+                    if (op)
+                        output.push(op);
+                }
+                operators.push(token);
+            }
+        }
+        while (operators.length > 0) {
+            const op = operators.pop();
+            if (op)
+                output.push(op);
+        }
+        return output;
+    }
+    /**
+     * Evaluates postfix boolean expression
+     */
+    evaluatePostfix(postfix) {
+        const stack = [];
+        for (const token of postfix) {
+            if (token === 'true') {
+                stack.push(true);
+            }
+            else if (token === 'false') {
+                stack.push(false);
+            }
+            else if (token === '&&') {
+                const b = stack.pop();
+                const a = stack.pop();
+                if (a !== undefined && b !== undefined) {
+                    stack.push(a && b);
+                }
+            }
+            else if (token === '||') {
+                const b = stack.pop();
+                const a = stack.pop();
+                if (a !== undefined && b !== undefined) {
+                    stack.push(a || b);
+                }
+            }
+        }
+        return stack[0] || false;
+    }
     static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: PermissionService, deps: [{ token: MainApiHttpService }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: PermissionService, providedIn: 'root' }); }
 }
@@ -1229,7 +1653,7 @@ class AbTestService {
         console.log(typeof service);
         return service ? this.injector.get(service) : this.injector.get(MainApiHttpService); // fallback to Core Microservice
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: AbTestService, deps: [{ token: i0.Injector }, { token: i1$3.HttpClient }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: AbTestService, deps: [{ token: i0.Injector }, { token: i1$2.HttpClient }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: AbTestService, providedIn: 'root' }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: AbTestService, decorators: [{
@@ -1237,7 +1661,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImpo
             args: [{
                     providedIn: 'root'
                 }]
-        }], ctorParameters: () => [{ type: i0.Injector }, { type: i1$3.HttpClient }] });
+        }], ctorParameters: () => [{ type: i0.Injector }, { type: i1$2.HttpClient }] });
 
 class GeoService {
     constructor(api, cookieService) {
@@ -1403,6 +1827,9 @@ class SubscriptionService {
     updateSubscriptionAPIKey(id) {
         return this.api.put(`/subscriptions/${id}/update_api_key`);
     }
+    refreshApiTokens(id) {
+        return this.api.get(`/subscriptions/${id}/refresh_api_tokens`);
+    }
     addFullLogo(id, data) {
         return this.api.upload(`/subscriptions/${id}`, data, 'full_logo');
     }
@@ -1651,7 +2078,7 @@ class AhoyService {
             this.toast.showToast(error);
         }
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: AhoyService, deps: [{ token: i1$3.HttpClient }, { token: i0.Injector }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: AhoyService, deps: [{ token: i1$2.HttpClient }, { token: i0.Injector }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: AhoyService, providedIn: 'root' }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: AhoyService, decorators: [{
@@ -1659,7 +2086,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImpo
             args: [{
                     providedIn: 'root'
                 }]
-        }], ctorParameters: () => [{ type: i1$3.HttpClient }, { type: i0.Injector }] });
+        }], ctorParameters: () => [{ type: i1$2.HttpClient }, { type: i0.Injector }] });
 
 class CommonService {
     constructor(api) {
@@ -2257,7 +2684,7 @@ class WebsocketService {
             this.webSocket$ = this.webSocketSubject.asObservable().pipe(distinctUntilChanged());
         });
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: WebsocketService, deps: [{ token: i1$1.AppConfigService }, { token: AuthService }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: WebsocketService, deps: [{ token: i1.AppConfigService }, { token: AuthService }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: WebsocketService, providedIn: 'root' }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: WebsocketService, decorators: [{
@@ -2265,7 +2692,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImpo
             args: [{
                     providedIn: 'root'
                 }]
-        }], ctorParameters: () => [{ type: i1$1.AppConfigService }, { type: AuthService }] });
+        }], ctorParameters: () => [{ type: i1.AppConfigService }, { type: AuthService }] });
 
 class NotificationService {
     constructor(api, toastrService, socketService) {
@@ -2492,7 +2919,7 @@ class SentryErrorHandler {
                         });
                     }
                     // Check if it's a non-error exception
-                    const isNonErrorException = event?.exception?.values?.[0]?.value?.startsWith('Non-Error exception captured') ||
+                    const isNonErrorException = event?.exception?.values?.[0]?.value?.startsWith('Non-Error exception captured') ??
                         hint?.originalException?.message?.startsWith('Non-Error exception captured');
                     if (isNonErrorException) {
                         // We want to ignore those kinds of errors
@@ -2749,7 +3176,7 @@ class SentryErrorHandler {
             console.error(error, e);
         }
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: SentryErrorHandler, deps: [{ token: i1$1.AppConfigService }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: SentryErrorHandler, deps: [{ token: i1.AppConfigService }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: SentryErrorHandler, providedIn: 'root' }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: SentryErrorHandler, decorators: [{
@@ -2757,7 +3184,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImpo
             args: [{
                     providedIn: 'root'
                 }]
-        }], ctorParameters: () => [{ type: i1$1.AppConfigService }] });
+        }], ctorParameters: () => [{ type: i1.AppConfigService }] });
 
 class LogoCacheService {
     constructor() {
@@ -2873,7 +3300,7 @@ class BrainApiHttpService extends BaseHttpService {
             this.baseUrl = isDevMode() ? BRAIN_API_PREFIX : config?.['links']['brain_api'] ?? '';
         });
     }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: BrainApiHttpService, deps: [{ token: i1$3.HttpClient }, { token: i0.Injector }], target: i0.ɵɵFactoryTarget.Injectable }); }
+    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: BrainApiHttpService, deps: [{ token: i1$2.HttpClient }, { token: i0.Injector }], target: i0.ɵɵFactoryTarget.Injectable }); }
     static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: BrainApiHttpService, providedIn: 'root' }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: BrainApiHttpService, decorators: [{
@@ -2881,7 +3308,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImpo
             args: [{
                     providedIn: 'root'
                 }]
-        }], ctorParameters: () => [{ type: i1$3.HttpClient }, { type: i0.Injector }] });
+        }], ctorParameters: () => [{ type: i1$2.HttpClient }, { type: i0.Injector }] });
 
 class BrainApiService {
     constructor(api) {
@@ -2900,39 +3327,6 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImpo
                 }]
         }], ctorParameters: () => [{ type: BrainApiHttpService }] });
 
-class JQueryService {
-    constructor() {
-        this.loadPromise = null;
-    }
-    ensure() {
-        if (!this.loadPromise) {
-            this.loadPromise = import('jquery')
-                .then((mod) => {
-                const $ = (mod.default ?? mod);
-                // Only assign if not already set
-                if (!window.$) {
-                    window.$ = $;
-                }
-                if (!window.jQuery) {
-                    window.jQuery = $;
-                }
-                return $;
-            })
-                .catch(err => {
-                console.error('Failed to load jQuery:', err);
-                throw err;
-            });
-        }
-        return this.loadPromise;
-    }
-    static { this.ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: JQueryService, deps: [], target: i0.ɵɵFactoryTarget.Injectable }); }
-    static { this.ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: JQueryService, providedIn: 'root' }); }
-}
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImport: i0, type: JQueryService, decorators: [{
-            type: Injectable,
-            args: [{ providedIn: 'root' }]
-        }] });
-
 /*
  * Public API Surface of pw-services
  */
@@ -2941,5 +3335,5 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "17.3.11", ngImpo
  * Generated bundle index. Do not edit.
  */
 
-export { AbTestService, AhoyService, AuthService, BaseHttpService, BrainApiHttpService, BrainApiService, CommonService, CommonServicesModule, CustomPreloadingStrategy, CustomToastService, DashboardService, DataService, FormHelperService, GeoService, GoogleAnalyticsService, GroupService, HopscotchService, IntegrationsApiHttpService, JQueryService, LinkService, LocalStorage, LogoCacheService, MailBoxService, MainApiHttpService, NgbDateCustomParserFormatter, NotificationService, NumberPickerService, PermissionService, PrimeNgHelper, ProductService, ProfileService, QualificationService, ScriptLoaderService, SentryErrorHandler, SubscriptionService, TagService, TipsService, UserEffects, UserService, ValidationService, WebsocketService, WindowService };
+export { AbTestService, AhoyService, AuthService, BaseHttpService, BrainApiHttpService, BrainApiService, CommonService, CommonServicesModule, CustomPreloadingStrategy, CustomToastService, DashboardService, DataService, FormHelperService, GeoService, GoogleAnalyticsService, GroupService, HopscotchService, IntegrationsApiHttpService, LinkService, LocalStorage, LogoCacheService, MailBoxService, MainApiHttpService, NgbDateCustomParserFormatter, NotificationService, NumberPickerService, PermissionService, PrimeNgHelper, ProductService, ProfileService, QualificationService, ScriptLoaderService, SecureTokenStorageService, SentryErrorHandler, SubscriptionService, TagService, TipsService, UserEffects, UserService, ValidationService, WebsocketService, WindowService };
 //# sourceMappingURL=posiwise-common-services.mjs.map