grm-shared-library 1.1.39 → 1.1.41

package/dist/cjs/index.js

@@ -39,7 +39,7 @@ __exportStar(require("./constants/http-headers"), exports);
 __exportStar(require("./kafka/index"), exports);
 // Utilities
 __exportStar(require("./decorators/case-decorators"), exports);
-__exportStar(require("./utilities/user-context-header.service"), exports);
+__exportStar(require("./modules/common/services/user-context-header.service"), exports);
 // Exceptions
 __exportStar(require("./exceptions/index"), exports);
 //# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,UAAU;AACV,uDAAqC;AACrC,+DAA6C;AAC7C,yDAAuC;AACvC,6DAA2C;AAC3C,uDAAqC;AACrC,uDAAqC;AACrC,iEAA+C;AAC/C,wDAAsC;AACtC,gEAA8C;AAC9C,2DAAyC;AACzC,2DAAyC;AACzC,sDAAoC;AAEpC,aAAa;AACb,8DAA4C;AAC5C,mEAAiD;AACjD,8DAA4C;AAC5C,2DAAyC;AACzC,0DAAwC;AAExC,YAAY;AACZ,2DAAyC;AAEzC,QAAQ;AACR,gDAA8B;AAE9B,YAAY;AACZ,+DAA6C;AAC7C,0EAAwD;AAExD,aAAa;AACb,qDAAmC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,UAAU;AACV,uDAAqC;AACrC,+DAA6C;AAC7C,yDAAuC;AACvC,6DAA2C;AAC3C,uDAAqC;AACrC,uDAAqC;AACrC,iEAA+C;AAC/C,wDAAsC;AACtC,gEAA8C;AAC9C,2DAAyC;AACzC,2DAAyC;AACzC,sDAAoC;AAEpC,aAAa;AACb,8DAA4C;AAC5C,mEAAiD;AACjD,8DAA4C;AAC5C,2DAAyC;AACzC,0DAAwC;AAExC,YAAY;AACZ,2DAAyC;AAEzC,QAAQ;AACR,gDAA8B;AAE9B,YAAY;AACZ,+DAA6C;AAC7C,wFAAsE;AAEtE,aAAa;AACb,qDAAmC"}

package/dist/cjs/modules/common/index.js

@@ -20,5 +20,7 @@ __exportStar(require("./dtos/contact-person.dto"), exports);
 __exportStar(require("./interfaces/map-location"), exports);
 __exportStar(require("./interfaces/map-address"), exports);
 __exportStar(require("./interfaces/contact-person"), exports);
+__exportStar(require("./interfaces/access-validation.interface"), exports);
 __exportStar(require("./constants/service.const"), exports);
+__exportStar(require("./services"), exports);
 //# sourceMappingURL=index.js.map

package/dist/cjs/modules/common/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/modules/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAwC;AACxC,yDAAuC;AACvC,4DAA0C;AAC1C,4DAA0C;AAC1C,2DAAyC;AACzC,8DAA4C;AAC5C,4DAA0C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/modules/common/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,0DAAwC;AACxC,yDAAuC;AACvC,4DAA0C;AAC1C,4DAA0C;AAC1C,2DAAyC;AACzC,8DAA4C;AAC5C,2EAAyD;AACzD,4DAA0C;AAC1C,6CAA2B"}

package/dist/cjs/modules/common/interfaces/access-validation.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=access-validation.interface.js.map

package/dist/cjs/modules/common/interfaces/access-validation.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-validation.interface.js","sourceRoot":"","sources":["../../../../../src/modules/common/interfaces/access-validation.interface.ts"],"names":[],"mappings":""}

package/dist/cjs/modules/common/services/access-validation.service.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessValidationService = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * Service for validating access control across microservices
+ * Provides centralized validation logic to ensure consistency
+ */
+class AccessValidationService {
+    /**
+     * Validates if a user has access to perform list operations
+     * @param accessScope - The access scope for the user
+     * @param pluralEntityName - The name of the entities being accessed (for error messages)
+     */
+    validateListAccess(accessScope, pluralEntityName = 'entities') {
+        if (accessScope.isSuperAdmin) {
+            return;
+        }
+        if (accessScope.organizationFilter || accessScope.controlCentreFilter) {
+            return;
+        }
+        throw new common_1.ForbiddenException(`Access denied: Insufficient permissions to access ${pluralEntityName}`);
+    }
+    /**
+     * Validates if a user has access to a specific entity
+     * @param accessScope - The access scope for the user
+     * @param entity - The entity to check access for
+     * @param entityName - The name of the entity (for error messages)
+     */
+    validateEntityAccess(accessScope, entity, entityName = 'Entity') {
+        if (accessScope.isSuperAdmin) {
+            return;
+        }
+        if (accessScope.organizationFilter && entity.organizationId === accessScope.organizationFilter) {
+            return;
+        }
+        if (accessScope.controlCentreFilter && entity.controlCentreId === accessScope.controlCentreFilter) {
+            return;
+        }
+        throw new common_1.ForbiddenException(`Access denied: Insufficient permissions to access this ${entityName.toLowerCase()}`);
+    }
+    /**
+     * Validates if a user can create an entity with the specified organization/control centre
+     * @param accessScope - The access scope for the user
+     * @param createDto - The DTO containing organizationId/controlCentreId
+     * @param entityName - The name of the entity (for error messages)
+     */
+    validateCreateAccess(accessScope, createDto, entityName = 'entity') {
+        if (accessScope.isSuperAdmin) {
+            return;
+        }
+        // Check organization level access
+        if (createDto.organizationId) {
+            if (accessScope.organizationFilter && createDto.organizationId !== accessScope.organizationFilter) {
+                throw new common_1.ForbiddenException(`Cannot create ${entityName} for this organization`);
+            }
+        }
+        // Check control centre level access
+        if (createDto.controlCentreId) {
+            if (accessScope.controlCentreFilter && createDto.controlCentreId !== accessScope.controlCentreFilter) {
+                throw new common_1.ForbiddenException(`Cannot create ${entityName} for this control centre`);
+            }
+        }
+        // Ensure user has at least organization or control centre level access
+        if (!accessScope.organizationFilter && !accessScope.controlCentreFilter) {
+            throw new common_1.ForbiddenException(`Insufficient permissions to create ${entityName}`);
+        }
+    }
+    /**
+     * Validates if a user has access to update entities
+     * @param accessScope - The access scope for the user
+     * @param entityName - The name of the entity (for error messages)
+     */
+    validateUpdateAccess(accessScope, entityName = 'entity') {
+        if (accessScope.isSuperAdmin) {
+            return;
+        }
+        // Ensure user has at least organization or control centre level access
+        if (!accessScope.organizationFilter && !accessScope.controlCentreFilter) {
+            throw new common_1.ForbiddenException(`Insufficient permissions to update ${entityName}`);
+        }
+    }
+    /**
+     * Validates if a user has access to delete entities
+     * @param accessScope - The access scope for the user
+     * @param entityName - The name of the entity (for error messages)
+     */
+    validateDeleteAccess(accessScope, entityName = 'entity') {
+        if (accessScope.isSuperAdmin) {
+            return;
+        }
+        // Ensure user has at least organization or control centre level access
+        if (!accessScope.organizationFilter && !accessScope.controlCentreFilter) {
+            throw new common_1.ForbiddenException(`Insufficient permissions to delete ${entityName}`);
+        }
+    }
+    /**
+     * Validates if a user can update an entity with the specified organization/control centre changes
+     * @param accessScope - The access scope for the user
+     * @param existingEntity - The existing entity
+     * @param updateDto - The DTO containing updated organizationId/controlCentreId
+     * @param entityName - The name of the entity (for error messages)
+     */
+    validateUpdateEntityAccess(accessScope, existingEntity, updateDto, entityName = 'entity') {
+        // First validate access to the existing entity
+        this.validateEntityAccess(accessScope, existingEntity, entityName);
+        // Then validate update permissions
+        this.validateUpdateAccess(accessScope, entityName);
+        // If organization is being changed, validate access to new organization
+        if (updateDto.organizationId && updateDto.organizationId !== existingEntity.organizationId) {
+            if (accessScope.organizationFilter && updateDto.organizationId !== accessScope.organizationFilter) {
+                throw new common_1.ForbiddenException(`Cannot move ${entityName} to this organization`);
+            }
+        }
+        // If control centre is being changed, validate access to new control centre
+        if (updateDto.controlCentreId && updateDto.controlCentreId !== existingEntity.controlCentreId) {
+            if (accessScope.controlCentreFilter && updateDto.controlCentreId !== accessScope.controlCentreFilter) {
+                throw new common_1.ForbiddenException(`Cannot move ${entityName} to this control centre`);
+            }
+        }
+    }
+}
+exports.AccessValidationService = AccessValidationService;
+//# sourceMappingURL=access-validation.service.js.map

package/dist/cjs/modules/common/services/access-validation.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-validation.service.js","sourceRoot":"","sources":["../../../../../src/modules/common/services/access-validation.service.ts"],"names":[],"mappings":";;;AAAA,2CAAoD;AAIpD;;;GAGG;AACH,MAAa,uBAAuB;IAEhC;;;;OAIG;IACH,kBAAkB,CAAC,WAAwB,EAAE,mBAA2B,UAAU;QAC9E,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,kBAAkB,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACpE,OAAO;QACX,CAAC;QAED,MAAM,IAAI,2BAAkB,CAAC,qDAAqD,gBAAgB,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAChB,WAAwB,EACxB,MAAS,EACT,aAAqB,QAAQ;QAE7B,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,kBAAkB,IAAI,MAAM,CAAC,cAAc,KAAK,WAAW,CAAC,kBAAkB,EAAE,CAAC;YAC7F,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,mBAAmB,IAAI,MAAM,CAAC,eAAe,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;YAChG,OAAO;QACX,CAAC;QAED,MAAM,IAAI,2BAAkB,CAAC,0DAA0D,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACvH,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAChB,WAAwB,EACxB,SAAY,EACZ,aAAqB,QAAQ;QAE7B,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,kCAAkC;QAClC,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;YAC3B,IAAI,WAAW,CAAC,kBAAkB,IAAI,SAAS,CAAC,cAAc,KAAK,WAAW,CAAC,kBAAkB,EAAE,CAAC;gBAChG,MAAM,IAAI,2BAAkB,CAAC,iBAAiB,UAAU,wBAAwB,CAAC,CAAC;YACtF,CAAC;QACL,CAAC;QAED,oCAAoC;QACpC,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,WAAW,CAAC,mBAAmB,IAAI,SAAS,CAAC,eAAe,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBACnG,MAAM,IAAI,2BAAkB,CAAC,iBAAiB,UAAU,0BAA0B,CAAC,CAAC;YACxF,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,IAAI,CAAC,WAAW,CAAC,kBAAkB,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACtE,MAAM,IAAI,2BAAkB,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,oBAAoB,CAAC,WAAwB,EAAE,aAAqB,QAAQ;QACxE,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,uEAAuE;QACvE,IAAI,CAAC,WAAW,CAAC,kBAAkB,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACtE,MAAM,IAAI,2BAAkB,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,oBAAoB,CAAC,WAAwB,EAAE,aAAqB,QAAQ;QACxE,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,uEAAuE;QACvE,IAAI,CAAC,WAAW,CAAC,kBAAkB,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACtE,MAAM,IAAI,2BAAkB,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,0BAA0B,CACtB,WAAwB,EACxB,cAAiB,EACjB,SAAY,EACZ,aAAqB,QAAQ;QAE7B,+CAA+C;QAC/C,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;QAEnE,mCAAmC;QACnC,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAEnD,wEAAwE;QACxE,IAAI,SAAS,CAAC,cAAc,IAAI,SAAS,CAAC,cAAc,KAAK,cAAc,CAAC,cAAc,EAAE,CAAC;YACzF,IAAI,WAAW,CAAC,kBAAkB,IAAI,SAAS,CAAC,cAAc,KAAK,WAAW,CAAC,kBAAkB,EAAE,CAAC;gBAChG,MAAM,IAAI,2BAAkB,CAAC,eAAe,UAAU,uBAAuB,CAAC,CAAC;YACnF,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,IAAI,SAAS,CAAC,eAAe,IAAI,SAAS,CAAC,eAAe,KAAK,cAAc,CAAC,eAAe,EAAE,CAAC;YAC5F,IAAI,WAAW,CAAC,mBAAmB,IAAI,SAAS,CAAC,eAAe,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBACnG,MAAM,IAAI,2BAAkB,CAAC,eAAe,UAAU,yBAAyB,CAAC,CAAC;YACrF,CAAC;QACL,CAAC;IACL,CAAC;CACJ;AAjJD,0DAiJC"}

package/dist/cjs/modules/common/services/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./access-validation.service"), exports);
+__exportStar(require("./user-context-header.service"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/modules/common/services/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/modules/common/services/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8DAA4C;AAC5C,gEAA8C"}

package/dist/cjs/modules/common/services/user-context-header.service.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserContextHeaderService = void 0;
+const http_headers_1 = require("../../../constants/http-headers");
+/**
+ * Utility service for handling user context via HTTP headers
+ * This provides a consistent way to pass user context between API Gateway and microservices
+ */
+class UserContextHeaderService {
+    /**
+     * Convert UserContext to HTTP headers for microservice communication
+     */
+    static buildHeaders(userContext) {
+        const headers = {};
+        headers[http_headers_1.HTTP_HEADERS.USER_ID] = userContext.userId.toString();
+        headers[http_headers_1.HTTP_HEADERS.USER_ROLES] = JSON.stringify(userContext.roles);
+        headers[http_headers_1.HTTP_HEADERS.ACCESS_SCOPE] = JSON.stringify(userContext.accessScope);
+        if (userContext.organizationId) {
+            headers[http_headers_1.HTTP_HEADERS.ORGANIZATION_ID] = userContext.organizationId.toString();
+        }
+        if (userContext.controlCentreId) {
+            headers[http_headers_1.HTTP_HEADERS.CONTROL_CENTRE_ID] = userContext.controlCentreId.toString();
+        }
+        // Also provide full context as single header for convenience
+        headers[http_headers_1.HTTP_HEADERS.USER_CONTEXT] = JSON.stringify(userContext);
+        return headers;
+    }
+    /**
+     * Extract UserContext from HTTP headers in microservices
+     */
+    static extractFromHeaders(headers) {
+        try {
+            // First try to get full context from single header
+            const fullContextHeader = this.getHeaderValue(headers, http_headers_1.HTTP_HEADERS.USER_CONTEXT);
+            if (fullContextHeader) {
+                return JSON.parse(fullContextHeader);
+            }
+            // Fallback: reconstruct from individual headers
+            const userIdHeader = this.getHeaderValue(headers, http_headers_1.HTTP_HEADERS.USER_ID);
+            const rolesHeader = this.getHeaderValue(headers, http_headers_1.HTTP_HEADERS.USER_ROLES);
+            const accessScopeHeader = this.getHeaderValue(headers, http_headers_1.HTTP_HEADERS.ACCESS_SCOPE);
+            if (!userIdHeader || !rolesHeader || !accessScopeHeader) {
+                return null;
+            }
+            const userId = parseInt(userIdHeader);
+            const roles = JSON.parse(rolesHeader);
+            const accessScope = JSON.parse(accessScopeHeader);
+            const organizationIdHeader = this.getHeaderValue(headers, http_headers_1.HTTP_HEADERS.ORGANIZATION_ID);
+            const controlCentreIdHeader = this.getHeaderValue(headers, http_headers_1.HTTP_HEADERS.CONTROL_CENTRE_ID);
+            return {
+                userId,
+                roles,
+                accessScope,
+                organizationId: organizationIdHeader ? parseInt(organizationIdHeader) : undefined,
+                controlCentreId: controlCentreIdHeader ? parseInt(controlCentreIdHeader) : undefined
+            };
+        }
+        catch (error) {
+            console.error('Error extracting user context from headers:', error);
+            return null;
+        }
+    }
+    /**
+     * Helper to get header value (handles string | string[] types)
+     */
+    static getHeaderValue(headers, key) {
+        const value = headers[key.toLowerCase()] || headers[key];
+        if (!value)
+            return null;
+        return Array.isArray(value) ? value[0] : value;
+    }
+}
+exports.UserContextHeaderService = UserContextHeaderService;
+//# sourceMappingURL=user-context-header.service.js.map

package/dist/cjs/modules/common/services/user-context-header.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-context-header.service.js","sourceRoot":"","sources":["../../../../../src/modules/common/services/user-context-header.service.ts"],"names":[],"mappings":";;;AAEA,kEAA+D;AAE/D;;;GAGG;AACH,MAAa,wBAAwB;IAEjC;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,WAAwB;QACxC,MAAM,OAAO,GAA2B,EAAE,CAAC;QAE3C,OAAO,CAAC,2BAAY,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9D,OAAO,CAAC,2BAAY,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,CAAC,2BAAY,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAE7E,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;YAC7B,OAAO,CAAC,2BAAY,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;QAClF,CAAC;QAED,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;YAC9B,OAAO,CAAC,2BAAY,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;QACrF,CAAC;QAED,6DAA6D;QAC7D,OAAO,CAAC,2BAAY,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAEjE,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAA0C;QAChE,IAAI,CAAC;YACD,mDAAmD;YACnD,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,2BAAY,CAAC,YAAY,CAAC,CAAC;YAClF,IAAI,iBAAiB,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAgB,CAAC;YACxD,CAAC;YAED,gDAAgD;YAChD,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,2BAAY,CAAC,OAAO,CAAC,CAAC;YACxE,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,2BAAY,CAAC,UAAU,CAAC,CAAC;YAC1E,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,2BAAY,CAAC,YAAY,CAAC,CAAC;YAElF,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACtD,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAa,CAAC;YAClD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAgB,CAAC;YAEjE,MAAM,oBAAoB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,2BAAY,CAAC,eAAe,CAAC,CAAC;YACxF,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,2BAAY,CAAC,iBAAiB,CAAC,CAAC;YAE3F,OAAO;gBACH,MAAM;gBACN,KAAK;gBACL,WAAW;gBACX,cAAc,EAAE,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjF,eAAe,EAAE,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS;aACvF,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,cAAc,CAAC,OAA0C,EAAE,GAAW;QACjF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC;CACJ;AA1ED,4DA0EC"}

package/dist/cjs/utilities/user-context-header.service.js

@@ -1,74 +1,2 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.UserContextHeaderService = void 0;
-const http_headers_1 = require("../constants/http-headers");
-/**
- * Utility service for handling user context via HTTP headers
- * This provides a consistent way to pass user context between API Gateway and microservices
- */
-class UserContextHeaderService {
-    /**
-     * Convert UserContext to HTTP headers for microservice communication
-     */
-    static buildHeaders(userContext) {
-        const headers = {};
-        headers[http_headers_1.HTTP_HEADERS.USER_ID] = userContext.userId.toString();
-        headers[http_headers_1.HTTP_HEADERS.USER_ROLES] = JSON.stringify(userContext.roles);
-        headers[http_headers_1.HTTP_HEADERS.ACCESS_SCOPE] = JSON.stringify(userContext.accessScope);
-        if (userContext.organizationId) {
-            headers[http_headers_1.HTTP_HEADERS.ORGANIZATION_ID] = userContext.organizationId.toString();
-        }
-        if (userContext.controlCentreId) {
-            headers[http_headers_1.HTTP_HEADERS.CONTROL_CENTRE_ID] = userContext.controlCentreId.toString();
-        }
-        // Also provide full context as single header for convenience
-        headers[http_headers_1.HTTP_HEADERS.USER_CONTEXT] = JSON.stringify(userContext);
-        return headers;
-    }
-    /**
-     * Extract UserContext from HTTP headers in microservices
-     */
-    static extractFromHeaders(headers) {
-        try {
-            // First try to get full context from single header
-            const fullContextHeader = this.getHeaderValue(headers, http_headers_1.HTTP_HEADERS.USER_CONTEXT);
-            if (fullContextHeader) {
-                return JSON.parse(fullContextHeader);
-            }
-            // Fallback: reconstruct from individual headers
-            const userIdHeader = this.getHeaderValue(headers, http_headers_1.HTTP_HEADERS.USER_ID);
-            const rolesHeader = this.getHeaderValue(headers, http_headers_1.HTTP_HEADERS.USER_ROLES);
-            const accessScopeHeader = this.getHeaderValue(headers, http_headers_1.HTTP_HEADERS.ACCESS_SCOPE);
-            if (!userIdHeader || !rolesHeader || !accessScopeHeader) {
-                return null;
-            }
-            const userId = parseInt(userIdHeader);
-            const roles = JSON.parse(rolesHeader);
-            const accessScope = JSON.parse(accessScopeHeader);
-            const organizationIdHeader = this.getHeaderValue(headers, http_headers_1.HTTP_HEADERS.ORGANIZATION_ID);
-            const controlCentreIdHeader = this.getHeaderValue(headers, http_headers_1.HTTP_HEADERS.CONTROL_CENTRE_ID);
-            return {
-                userId,
-                roles,
-                accessScope,
-                organizationId: organizationIdHeader ? parseInt(organizationIdHeader) : undefined,
-                controlCentreId: controlCentreIdHeader ? parseInt(controlCentreIdHeader) : undefined
-            };
-        }
-        catch (error) {
-            console.error('Error extracting user context from headers:', error);
-            return null;
-        }
-    }
-    /**
-     * Helper to get header value (handles string | string[] types)
-     */
-    static getHeaderValue(headers, key) {
-        const value = headers[key.toLowerCase()] || headers[key];
-        if (!value)
-            return null;
-        return Array.isArray(value) ? value[0] : value;
-    }
-}
-exports.UserContextHeaderService = UserContextHeaderService;
 //# sourceMappingURL=user-context-header.service.js.map

package/dist/cjs/utilities/user-context-header.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-context-header.service.js","sourceRoot":"","sources":["../../../src/utilities/user-context-header.service.ts"],"names":[],"mappings":";;;AAEA,4DAAyD;AAEzD;;;GAGG;AACH,MAAa,wBAAwB;IAEjC;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,WAAwB;QACxC,MAAM,OAAO,GAA2B,EAAE,CAAC;QAE3C,OAAO,CAAC,2BAAY,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9D,OAAO,CAAC,2BAAY,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,CAAC,2BAAY,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAE7E,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;YAC7B,OAAO,CAAC,2BAAY,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;QAClF,CAAC;QAED,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;YAC9B,OAAO,CAAC,2BAAY,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;QACrF,CAAC;QAED,6DAA6D;QAC7D,OAAO,CAAC,2BAAY,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAEjE,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAA0C;QAChE,IAAI,CAAC;YACD,mDAAmD;YACnD,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,2BAAY,CAAC,YAAY,CAAC,CAAC;YAClF,IAAI,iBAAiB,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAgB,CAAC;YACxD,CAAC;YAED,gDAAgD;YAChD,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,2BAAY,CAAC,OAAO,CAAC,CAAC;YACxE,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,2BAAY,CAAC,UAAU,CAAC,CAAC;YAC1E,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,2BAAY,CAAC,YAAY,CAAC,CAAC;YAElF,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACtD,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAa,CAAC;YAClD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAgB,CAAC;YAEjE,MAAM,oBAAoB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,2BAAY,CAAC,eAAe,CAAC,CAAC;YACxF,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,2BAAY,CAAC,iBAAiB,CAAC,CAAC;YAE3F,OAAO;gBACH,MAAM;gBACN,KAAK;gBACL,WAAW;gBACX,cAAc,EAAE,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjF,eAAe,EAAE,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS;aACvF,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,cAAc,CAAC,OAA0C,EAAE,GAAW;QACjF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC;CACJ;AA1ED,4DA0EC"}
+{"version":3,"file":"user-context-header.service.js","sourceRoot":"","sources":["../../../src/utilities/user-context-header.service.ts"],"names":[],"mappings":""}

package/dist/esm/index.js

@@ -23,7 +23,7 @@ export * from './constants/http-headers';
 export * from './kafka/index';
 // Utilities
 export * from './decorators/case-decorators';
-export * from './utilities/user-context-header.service';
+export * from './modules/common/services/user-context-header.service';
 // Exceptions
 export * from './exceptions/index';
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,UAAU;AACV,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AAEpC,aAAa;AACb,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AAExC,YAAY;AACZ,cAAc,0BAA0B,CAAC;AAEzC,QAAQ;AACR,cAAc,eAAe,CAAC;AAE9B,YAAY;AACZ,cAAc,8BAA8B,CAAC;AAC7C,cAAc,yCAAyC,CAAC;AAExD,aAAa;AACb,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,UAAU;AACV,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uBAAuB,CAAC;AACtC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AAEpC,aAAa;AACb,cAAc,6BAA6B,CAAC;AAC5C,cAAc,kCAAkC,CAAC;AACjD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AAExC,YAAY;AACZ,cAAc,0BAA0B,CAAC;AAEzC,QAAQ;AACR,cAAc,eAAe,CAAC;AAE9B,YAAY;AACZ,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uDAAuD,CAAC;AAEtE,aAAa;AACb,cAAc,oBAAoB,CAAC"}

package/dist/esm/modules/common/index.js

@@ -4,5 +4,7 @@ export * from './dtos/contact-person.dto';
 export * from './interfaces/map-location';
 export * from './interfaces/map-address';
 export * from './interfaces/contact-person';
+export * from './interfaces/access-validation.interface';
 export * from './constants/service.const';
+export * from './services';
 //# sourceMappingURL=index.js.map

package/dist/esm/modules/common/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/modules/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/modules/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0CAA0C,CAAC;AACzD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,YAAY,CAAC"}

package/dist/esm/modules/common/interfaces/access-validation.interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=access-validation.interface.js.map

package/dist/esm/modules/common/interfaces/access-validation.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-validation.interface.js","sourceRoot":"","sources":["../../../../../src/modules/common/interfaces/access-validation.interface.ts"],"names":[],"mappings":""}

package/dist/esm/modules/common/services/access-validation.service.js

@@ -0,0 +1,120 @@
+import { ForbiddenException } from '@nestjs/common';
+/**
+ * Service for validating access control across microservices
+ * Provides centralized validation logic to ensure consistency
+ */
+export class AccessValidationService {
+    /**
+     * Validates if a user has access to perform list operations
+     * @param accessScope - The access scope for the user
+     * @param pluralEntityName - The name of the entities being accessed (for error messages)
+     */
+    validateListAccess(accessScope, pluralEntityName = 'entities') {
+        if (accessScope.isSuperAdmin) {
+            return;
+        }
+        if (accessScope.organizationFilter || accessScope.controlCentreFilter) {
+            return;
+        }
+        throw new ForbiddenException(`Access denied: Insufficient permissions to access ${pluralEntityName}`);
+    }
+    /**
+     * Validates if a user has access to a specific entity
+     * @param accessScope - The access scope for the user
+     * @param entity - The entity to check access for
+     * @param entityName - The name of the entity (for error messages)
+     */
+    validateEntityAccess(accessScope, entity, entityName = 'Entity') {
+        if (accessScope.isSuperAdmin) {
+            return;
+        }
+        if (accessScope.organizationFilter && entity.organizationId === accessScope.organizationFilter) {
+            return;
+        }
+        if (accessScope.controlCentreFilter && entity.controlCentreId === accessScope.controlCentreFilter) {
+            return;
+        }
+        throw new ForbiddenException(`Access denied: Insufficient permissions to access this ${entityName.toLowerCase()}`);
+    }
+    /**
+     * Validates if a user can create an entity with the specified organization/control centre
+     * @param accessScope - The access scope for the user
+     * @param createDto - The DTO containing organizationId/controlCentreId
+     * @param entityName - The name of the entity (for error messages)
+     */
+    validateCreateAccess(accessScope, createDto, entityName = 'entity') {
+        if (accessScope.isSuperAdmin) {
+            return;
+        }
+        // Check organization level access
+        if (createDto.organizationId) {
+            if (accessScope.organizationFilter && createDto.organizationId !== accessScope.organizationFilter) {
+                throw new ForbiddenException(`Cannot create ${entityName} for this organization`);
+            }
+        }
+        // Check control centre level access
+        if (createDto.controlCentreId) {
+            if (accessScope.controlCentreFilter && createDto.controlCentreId !== accessScope.controlCentreFilter) {
+                throw new ForbiddenException(`Cannot create ${entityName} for this control centre`);
+            }
+        }
+        // Ensure user has at least organization or control centre level access
+        if (!accessScope.organizationFilter && !accessScope.controlCentreFilter) {
+            throw new ForbiddenException(`Insufficient permissions to create ${entityName}`);
+        }
+    }
+    /**
+     * Validates if a user has access to update entities
+     * @param accessScope - The access scope for the user
+     * @param entityName - The name of the entity (for error messages)
+     */
+    validateUpdateAccess(accessScope, entityName = 'entity') {
+        if (accessScope.isSuperAdmin) {
+            return;
+        }
+        // Ensure user has at least organization or control centre level access
+        if (!accessScope.organizationFilter && !accessScope.controlCentreFilter) {
+            throw new ForbiddenException(`Insufficient permissions to update ${entityName}`);
+        }
+    }
+    /**
+     * Validates if a user has access to delete entities
+     * @param accessScope - The access scope for the user
+     * @param entityName - The name of the entity (for error messages)
+     */
+    validateDeleteAccess(accessScope, entityName = 'entity') {
+        if (accessScope.isSuperAdmin) {
+            return;
+        }
+        // Ensure user has at least organization or control centre level access
+        if (!accessScope.organizationFilter && !accessScope.controlCentreFilter) {
+            throw new ForbiddenException(`Insufficient permissions to delete ${entityName}`);
+        }
+    }
+    /**
+     * Validates if a user can update an entity with the specified organization/control centre changes
+     * @param accessScope - The access scope for the user
+     * @param existingEntity - The existing entity
+     * @param updateDto - The DTO containing updated organizationId/controlCentreId
+     * @param entityName - The name of the entity (for error messages)
+     */
+    validateUpdateEntityAccess(accessScope, existingEntity, updateDto, entityName = 'entity') {
+        // First validate access to the existing entity
+        this.validateEntityAccess(accessScope, existingEntity, entityName);
+        // Then validate update permissions
+        this.validateUpdateAccess(accessScope, entityName);
+        // If organization is being changed, validate access to new organization
+        if (updateDto.organizationId && updateDto.organizationId !== existingEntity.organizationId) {
+            if (accessScope.organizationFilter && updateDto.organizationId !== accessScope.organizationFilter) {
+                throw new ForbiddenException(`Cannot move ${entityName} to this organization`);
+            }
+        }
+        // If control centre is being changed, validate access to new control centre
+        if (updateDto.controlCentreId && updateDto.controlCentreId !== existingEntity.controlCentreId) {
+            if (accessScope.controlCentreFilter && updateDto.controlCentreId !== accessScope.controlCentreFilter) {
+                throw new ForbiddenException(`Cannot move ${entityName} to this control centre`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=access-validation.service.js.map

package/dist/esm/modules/common/services/access-validation.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-validation.service.js","sourceRoot":"","sources":["../../../../../src/modules/common/services/access-validation.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAIpD;;;GAGG;AACH,MAAM,OAAO,uBAAuB;IAEhC;;;;OAIG;IACH,kBAAkB,CAAC,WAAwB,EAAE,mBAA2B,UAAU;QAC9E,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,kBAAkB,IAAI,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACpE,OAAO;QACX,CAAC;QAED,MAAM,IAAI,kBAAkB,CAAC,qDAAqD,gBAAgB,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAChB,WAAwB,EACxB,MAAS,EACT,aAAqB,QAAQ;QAE7B,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,kBAAkB,IAAI,MAAM,CAAC,cAAc,KAAK,WAAW,CAAC,kBAAkB,EAAE,CAAC;YAC7F,OAAO;QACX,CAAC;QAED,IAAI,WAAW,CAAC,mBAAmB,IAAI,MAAM,CAAC,eAAe,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;YAChG,OAAO;QACX,CAAC;QAED,MAAM,IAAI,kBAAkB,CAAC,0DAA0D,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACvH,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAChB,WAAwB,EACxB,SAAY,EACZ,aAAqB,QAAQ;QAE7B,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,kCAAkC;QAClC,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;YAC3B,IAAI,WAAW,CAAC,kBAAkB,IAAI,SAAS,CAAC,cAAc,KAAK,WAAW,CAAC,kBAAkB,EAAE,CAAC;gBAChG,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,UAAU,wBAAwB,CAAC,CAAC;YACtF,CAAC;QACL,CAAC;QAED,oCAAoC;QACpC,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,WAAW,CAAC,mBAAmB,IAAI,SAAS,CAAC,eAAe,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBACnG,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,UAAU,0BAA0B,CAAC,CAAC;YACxF,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,IAAI,CAAC,WAAW,CAAC,kBAAkB,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACtE,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,oBAAoB,CAAC,WAAwB,EAAE,aAAqB,QAAQ;QACxE,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,uEAAuE;QACvE,IAAI,CAAC,WAAW,CAAC,kBAAkB,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACtE,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,oBAAoB,CAAC,WAAwB,EAAE,aAAqB,QAAQ;QACxE,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC3B,OAAO;QACX,CAAC;QAED,uEAAuE;QACvE,IAAI,CAAC,WAAW,CAAC,kBAAkB,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACtE,MAAM,IAAI,kBAAkB,CAAC,sCAAsC,UAAU,EAAE,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,0BAA0B,CACtB,WAAwB,EACxB,cAAiB,EACjB,SAAY,EACZ,aAAqB,QAAQ;QAE7B,+CAA+C;QAC/C,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;QAEnE,mCAAmC;QACnC,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAEnD,wEAAwE;QACxE,IAAI,SAAS,CAAC,cAAc,IAAI,SAAS,CAAC,cAAc,KAAK,cAAc,CAAC,cAAc,EAAE,CAAC;YACzF,IAAI,WAAW,CAAC,kBAAkB,IAAI,SAAS,CAAC,cAAc,KAAK,WAAW,CAAC,kBAAkB,EAAE,CAAC;gBAChG,MAAM,IAAI,kBAAkB,CAAC,eAAe,UAAU,uBAAuB,CAAC,CAAC;YACnF,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,IAAI,SAAS,CAAC,eAAe,IAAI,SAAS,CAAC,eAAe,KAAK,cAAc,CAAC,eAAe,EAAE,CAAC;YAC5F,IAAI,WAAW,CAAC,mBAAmB,IAAI,SAAS,CAAC,eAAe,KAAK,WAAW,CAAC,mBAAmB,EAAE,CAAC;gBACnG,MAAM,IAAI,kBAAkB,CAAC,eAAe,UAAU,yBAAyB,CAAC,CAAC;YACrF,CAAC;QACL,CAAC;IACL,CAAC;CACJ"}

package/dist/esm/modules/common/services/index.js

@@ -0,0 +1,3 @@
+export * from './access-validation.service';
+export * from './user-context-header.service';
+//# sourceMappingURL=index.js.map

package/dist/esm/modules/common/services/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/modules/common/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC"}

package/dist/esm/modules/common/services/user-context-header.service.js

@@ -0,0 +1,70 @@
+import { HTTP_HEADERS } from '../../../constants/http-headers';
+/**
+ * Utility service for handling user context via HTTP headers
+ * This provides a consistent way to pass user context between API Gateway and microservices
+ */
+export class UserContextHeaderService {
+    /**
+     * Convert UserContext to HTTP headers for microservice communication
+     */
+    static buildHeaders(userContext) {
+        const headers = {};
+        headers[HTTP_HEADERS.USER_ID] = userContext.userId.toString();
+        headers[HTTP_HEADERS.USER_ROLES] = JSON.stringify(userContext.roles);
+        headers[HTTP_HEADERS.ACCESS_SCOPE] = JSON.stringify(userContext.accessScope);
+        if (userContext.organizationId) {
+            headers[HTTP_HEADERS.ORGANIZATION_ID] = userContext.organizationId.toString();
+        }
+        if (userContext.controlCentreId) {
+            headers[HTTP_HEADERS.CONTROL_CENTRE_ID] = userContext.controlCentreId.toString();
+        }
+        // Also provide full context as single header for convenience
+        headers[HTTP_HEADERS.USER_CONTEXT] = JSON.stringify(userContext);
+        return headers;
+    }
+    /**
+     * Extract UserContext from HTTP headers in microservices
+     */
+    static extractFromHeaders(headers) {
+        try {
+            // First try to get full context from single header
+            const fullContextHeader = this.getHeaderValue(headers, HTTP_HEADERS.USER_CONTEXT);
+            if (fullContextHeader) {
+                return JSON.parse(fullContextHeader);
+            }
+            // Fallback: reconstruct from individual headers
+            const userIdHeader = this.getHeaderValue(headers, HTTP_HEADERS.USER_ID);
+            const rolesHeader = this.getHeaderValue(headers, HTTP_HEADERS.USER_ROLES);
+            const accessScopeHeader = this.getHeaderValue(headers, HTTP_HEADERS.ACCESS_SCOPE);
+            if (!userIdHeader || !rolesHeader || !accessScopeHeader) {
+                return null;
+            }
+            const userId = parseInt(userIdHeader);
+            const roles = JSON.parse(rolesHeader);
+            const accessScope = JSON.parse(accessScopeHeader);
+            const organizationIdHeader = this.getHeaderValue(headers, HTTP_HEADERS.ORGANIZATION_ID);
+            const controlCentreIdHeader = this.getHeaderValue(headers, HTTP_HEADERS.CONTROL_CENTRE_ID);
+            return {
+                userId,
+                roles,
+                accessScope,
+                organizationId: organizationIdHeader ? parseInt(organizationIdHeader) : undefined,
+                controlCentreId: controlCentreIdHeader ? parseInt(controlCentreIdHeader) : undefined
+            };
+        }
+        catch (error) {
+            console.error('Error extracting user context from headers:', error);
+            return null;
+        }
+    }
+    /**
+     * Helper to get header value (handles string | string[] types)
+     */
+    static getHeaderValue(headers, key) {
+        const value = headers[key.toLowerCase()] || headers[key];
+        if (!value)
+            return null;
+        return Array.isArray(value) ? value[0] : value;
+    }
+}
+//# sourceMappingURL=user-context-header.service.js.map

package/dist/esm/modules/common/services/user-context-header.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-context-header.service.js","sourceRoot":"","sources":["../../../../../src/modules/common/services/user-context-header.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/D;;;GAGG;AACH,MAAM,OAAO,wBAAwB;IAEjC;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,WAAwB;QACxC,MAAM,OAAO,GAA2B,EAAE,CAAC;QAE3C,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9D,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAE7E,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;YAC7B,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;QAClF,CAAC;QAED,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;YAC9B,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;QACrF,CAAC;QAED,6DAA6D;QAC7D,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAEjE,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAA0C;QAChE,IAAI,CAAC;YACD,mDAAmD;YACnD,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;YAClF,IAAI,iBAAiB,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAgB,CAAC;YACxD,CAAC;YAED,gDAAgD;YAChD,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;YACxE,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YAC1E,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;YAElF,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACtD,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAa,CAAC;YAClD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAgB,CAAC;YAEjE,MAAM,oBAAoB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;YACxF,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,iBAAiB,CAAC,CAAC;YAE3F,OAAO;gBACH,MAAM;gBACN,KAAK;gBACL,WAAW;gBACX,cAAc,EAAE,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjF,eAAe,EAAE,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS;aACvF,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,cAAc,CAAC,OAA0C,EAAE,GAAW;QACjF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC;CACJ"}

package/dist/esm/utilities/user-context-header.service.js

@@ -1,70 +1,2 @@
-import { HTTP_HEADERS } from '../constants/http-headers';
-/**
- * Utility service for handling user context via HTTP headers
- * This provides a consistent way to pass user context between API Gateway and microservices
- */
-export class UserContextHeaderService {
-    /**
-     * Convert UserContext to HTTP headers for microservice communication
-     */
-    static buildHeaders(userContext) {
-        const headers = {};
-        headers[HTTP_HEADERS.USER_ID] = userContext.userId.toString();
-        headers[HTTP_HEADERS.USER_ROLES] = JSON.stringify(userContext.roles);
-        headers[HTTP_HEADERS.ACCESS_SCOPE] = JSON.stringify(userContext.accessScope);
-        if (userContext.organizationId) {
-            headers[HTTP_HEADERS.ORGANIZATION_ID] = userContext.organizationId.toString();
-        }
-        if (userContext.controlCentreId) {
-            headers[HTTP_HEADERS.CONTROL_CENTRE_ID] = userContext.controlCentreId.toString();
-        }
-        // Also provide full context as single header for convenience
-        headers[HTTP_HEADERS.USER_CONTEXT] = JSON.stringify(userContext);
-        return headers;
-    }
-    /**
-     * Extract UserContext from HTTP headers in microservices
-     */
-    static extractFromHeaders(headers) {
-        try {
-            // First try to get full context from single header
-            const fullContextHeader = this.getHeaderValue(headers, HTTP_HEADERS.USER_CONTEXT);
-            if (fullContextHeader) {
-                return JSON.parse(fullContextHeader);
-            }
-            // Fallback: reconstruct from individual headers
-            const userIdHeader = this.getHeaderValue(headers, HTTP_HEADERS.USER_ID);
-            const rolesHeader = this.getHeaderValue(headers, HTTP_HEADERS.USER_ROLES);
-            const accessScopeHeader = this.getHeaderValue(headers, HTTP_HEADERS.ACCESS_SCOPE);
-            if (!userIdHeader || !rolesHeader || !accessScopeHeader) {
-                return null;
-            }
-            const userId = parseInt(userIdHeader);
-            const roles = JSON.parse(rolesHeader);
-            const accessScope = JSON.parse(accessScopeHeader);
-            const organizationIdHeader = this.getHeaderValue(headers, HTTP_HEADERS.ORGANIZATION_ID);
-            const controlCentreIdHeader = this.getHeaderValue(headers, HTTP_HEADERS.CONTROL_CENTRE_ID);
-            return {
-                userId,
-                roles,
-                accessScope,
-                organizationId: organizationIdHeader ? parseInt(organizationIdHeader) : undefined,
-                controlCentreId: controlCentreIdHeader ? parseInt(controlCentreIdHeader) : undefined
-            };
-        }
-        catch (error) {
-            console.error('Error extracting user context from headers:', error);
-            return null;
-        }
-    }
-    /**
-     * Helper to get header value (handles string | string[] types)
-     */
-    static getHeaderValue(headers, key) {
-        const value = headers[key.toLowerCase()] || headers[key];
-        if (!value)
-            return null;
-        return Array.isArray(value) ? value[0] : value;
-    }
-}
+"use strict";
 //# sourceMappingURL=user-context-header.service.js.map

package/dist/esm/utilities/user-context-header.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-context-header.service.js","sourceRoot":"","sources":["../../../src/utilities/user-context-header.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD;;;GAGG;AACH,MAAM,OAAO,wBAAwB;IAEjC;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,WAAwB;QACxC,MAAM,OAAO,GAA2B,EAAE,CAAC;QAE3C,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC9D,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAE7E,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;YAC7B,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;QAClF,CAAC;QAED,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;YAC9B,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,GAAG,WAAW,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC;QACrF,CAAC;QAED,6DAA6D;QAC7D,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAEjE,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,OAA0C;QAChE,IAAI,CAAC;YACD,mDAAmD;YACnD,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;YAClF,IAAI,iBAAiB,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAgB,CAAC;YACxD,CAAC;YAED,gDAAgD;YAChD,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;YACxE,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YAC1E,MAAM,iBAAiB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;YAElF,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACtD,OAAO,IAAI,CAAC;YAChB,CAAC;YAED,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAa,CAAC;YAClD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAgB,CAAC;YAEjE,MAAM,oBAAoB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;YACxF,MAAM,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,YAAY,CAAC,iBAAiB,CAAC,CAAC;YAE3F,OAAO;gBACH,MAAM;gBACN,KAAK;gBACL,WAAW;gBACX,cAAc,EAAE,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS;gBACjF,eAAe,EAAE,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS;aACvF,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,cAAc,CAAC,OAA0C,EAAE,GAAW;QACjF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC;CACJ"}
+{"version":3,"file":"user-context-header.service.js","sourceRoot":"","sources":["../../../src/utilities/user-context-header.service.ts"],"names":[],"mappings":""}

package/dist/types/index.d.ts

@@ -18,5 +18,5 @@ export * from './interfaces/pagination';
 export * from './constants/http-headers';
 export * from './kafka/index';
 export * from './decorators/case-decorators';
-export * from './utilities/user-context-header.service';
+export * from './modules/common/services/user-context-header.service';
 export * from './exceptions/index';

package/dist/types/modules/common/index.d.ts

@@ -4,4 +4,6 @@ export * from './dtos/contact-person.dto';
 export * from './interfaces/map-location';
 export * from './interfaces/map-address';
 export * from './interfaces/contact-person';
+export * from './interfaces/access-validation.interface';
 export * from './constants/service.const';
+export * from './services';

package/dist/types/modules/common/interfaces/access-validation.interface.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Interface for entities that can be checked for access control
+ */
+export interface EntityAccessCheck {
+    organizationId?: number;
+    controlCentreId?: number;
+}
+/**
+ * Interface for create DTOs that need access validation
+ */
+export interface CreateEntityAccessCheck {
+    organizationId?: number;
+    controlCentreId?: number;
+}
+/**
+ * Interface for update DTOs that need access validation
+ */
+export interface UpdateEntityAccessCheck {
+    organizationId?: number;
+    controlCentreId?: number;
+}

package/dist/types/modules/common/services/access-validation.service.d.ts

@@ -0,0 +1,48 @@
+import { AccessScope } from '../../user/interfaces/access-scope';
+import { EntityAccessCheck, CreateEntityAccessCheck, UpdateEntityAccessCheck } from '../interfaces/access-validation.interface';
+/**
+ * Service for validating access control across microservices
+ * Provides centralized validation logic to ensure consistency
+ */
+export declare class AccessValidationService {
+    /**
+     * Validates if a user has access to perform list operations
+     * @param accessScope - The access scope for the user
+     * @param pluralEntityName - The name of the entities being accessed (for error messages)
+     */
+    validateListAccess(accessScope: AccessScope, pluralEntityName?: string): void;
+    /**
+     * Validates if a user has access to a specific entity
+     * @param accessScope - The access scope for the user
+     * @param entity - The entity to check access for
+     * @param entityName - The name of the entity (for error messages)
+     */
+    validateEntityAccess<T extends EntityAccessCheck>(accessScope: AccessScope, entity: T, entityName?: string): void;
+    /**
+     * Validates if a user can create an entity with the specified organization/control centre
+     * @param accessScope - The access scope for the user
+     * @param createDto - The DTO containing organizationId/controlCentreId
+     * @param entityName - The name of the entity (for error messages)
+     */
+    validateCreateAccess<T extends CreateEntityAccessCheck>(accessScope: AccessScope, createDto: T, entityName?: string): void;
+    /**
+     * Validates if a user has access to update entities
+     * @param accessScope - The access scope for the user
+     * @param entityName - The name of the entity (for error messages)
+     */
+    validateUpdateAccess(accessScope: AccessScope, entityName?: string): void;
+    /**
+     * Validates if a user has access to delete entities
+     * @param accessScope - The access scope for the user
+     * @param entityName - The name of the entity (for error messages)
+     */
+    validateDeleteAccess(accessScope: AccessScope, entityName?: string): void;
+    /**
+     * Validates if a user can update an entity with the specified organization/control centre changes
+     * @param accessScope - The access scope for the user
+     * @param existingEntity - The existing entity
+     * @param updateDto - The DTO containing updated organizationId/controlCentreId
+     * @param entityName - The name of the entity (for error messages)
+     */
+    validateUpdateEntityAccess<T extends EntityAccessCheck, U extends UpdateEntityAccessCheck>(accessScope: AccessScope, existingEntity: T, updateDto: U, entityName?: string): void;
+}

package/dist/types/modules/common/services/index.d.ts

@@ -0,0 +1,2 @@
+export * from './access-validation.service';
+export * from './user-context-header.service';

package/dist/types/modules/common/services/user-context-header.service.d.ts

@@ -0,0 +1,19 @@
+import { UserContext } from '../../user/interfaces/user-context';
+/**
+ * Utility service for handling user context via HTTP headers
+ * This provides a consistent way to pass user context between API Gateway and microservices
+ */
+export declare class UserContextHeaderService {
+    /**
+     * Convert UserContext to HTTP headers for microservice communication
+     */
+    static buildHeaders(userContext: UserContext): Record<string, string>;
+    /**
+     * Extract UserContext from HTTP headers in microservices
+     */
+    static extractFromHeaders(headers: Record<string, string | string[]>): UserContext | null;
+    /**
+     * Helper to get header value (handles string | string[] types)
+     */
+    private static getHeaderValue;
+}

package/dist/types/utilities/user-context-header.service.d.ts

@@ -1,19 +0,0 @@
-import { UserContext } from '../modules/user/interfaces/user-context';
-/**
- * Utility service for handling user context via HTTP headers
- * This provides a consistent way to pass user context between API Gateway and microservices
- */
-export declare class UserContextHeaderService {
-    /**
-     * Convert UserContext to HTTP headers for microservice communication
-     */
-    static buildHeaders(userContext: UserContext): Record<string, string>;
-    /**
-     * Extract UserContext from HTTP headers in microservices
-     */
-    static extractFromHeaders(headers: Record<string, string | string[]>): UserContext | null;
-    /**
-     * Helper to get header value (handles string | string[] types)
-     */
-    private static getHeaderValue;
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grm-shared-library",
-  "version": "1.1.39",
+  "version": "1.1.41",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
   "types": "dist/types/index.d.ts",