feat: customer permission

src/controllers/03-customer-controller.ts

@@ -78,10 +78,36 @@ function imageLocation(id: string) {
 export class CustomerController extends Controller {
   @Get("type-stats")
   @Security("keycloak")
-  async stat() {
+  async stat(@Request() req: RequestWithUser) {
     const list = await prisma.customer.groupBy({
       by: "customerType",
       _count: true,
+      where: {
+        registeredBranch: isSystem(req.user)
+          ? undefined
+          : {
+              OR: [
+                {
+                  user: { some: { userId: req.user.sub } },
+                },
+                {
+                  branch: globalAllow(req.user)
+                    ? { some: { user: { some: { userId: req.user.sub } } } }
+                    : undefined,
+                },
+                {
+                  headOffice: globalAllow(req.user)
+                    ? { branch: { some: { user: { some: { userId: req.user.sub } } } } }
+                    : undefined,
+                },
+                {
+                  headOffice: globalAllow(req.user)
+                    ? { user: { some: { userId: req.user.sub } } }
+                    : undefined,
+                },
+              ],
+            },
+      },
     });
 
     return list.reduce<Record<CustomerType, number>>(
@@ -126,12 +152,24 @@ export class CustomerController extends Controller {
           ? undefined
           : {
               OR: [
-                { user: { some: { userId: req.user.sub } } },
+                {
+                  user: { some: { userId: req.user.sub } },
+                },
                 {
                   branch: globalAllow(req.user)
                     ? { some: { user: { some: { userId: req.user.sub } } } }
                     : undefined,
                 },
+                {
+                  headOffice: globalAllow(req.user)
+                    ? { branch: { some: { user: { some: { userId: req.user.sub } } } } }
+                    : undefined,
+                },
+                {
+                  headOffice: globalAllow(req.user)
+                    ? { user: { some: { userId: req.user.sub } } }
+                    : undefined,
+                },
               ],
             },
       },