feat: prevent from change company

src/controllers/03-customer-controller.ts

@@ -361,6 +361,26 @@ export class CustomerController extends Controller {
       await permissionCheck(req.user, branch);
     }
 
+    if (!!body.registeredBranchId && !branch) {
+      throw new HttpError(
+        HttpStatus.BAD_REQUEST,
+        "Branch cannot be found.",
+        "relationBranchNotFound",
+      );
+    }
+
+    let companyBefore = (customer.registeredBranch.headOffice || customer.registeredBranch).code;
+    let companyAfter =
+      !!body.registeredBranchId && branch ? (branch.headOffice || branch).code : false;
+
+    if (companyBefore && companyAfter && companyBefore !== companyAfter) {
+      throw new HttpError(
+        HttpStatus.BAD_REQUEST,
+        "Cannot move between different headoffice",
+        "crossCompanyNotPermit",
+      );
+    }
+
     const record = await prisma.$transaction(async (tx) => {
       return await tx.customer.update({
         include: {