fix: always include from head branch

src/controllers/01-branch-controller.ts

@@ -118,7 +118,7 @@ export class BranchController extends Controller {
   async getStats(@Request() req: RequestWithUser, @Query() headOfficeId?: string) {
     const where = {
       AND: {
-        OR: permissionCond(req.user),
+        OR: permissionCond(req.user, true),
       },
     };
 
@@ -217,7 +217,7 @@ export class BranchController extends Controller {
         zipCode,
         headOfficeId: headOfficeId ?? (filter === "head" || tree ? null : undefined),
         NOT: { headOfficeId: filter === "sub" && !headOfficeId ? null : undefined },
-        OR: permissionCond(req.user),
+        OR: permissionCond(req.user, true),
       },
       OR: [
         { nameEN: { contains: query } },

src/services/permission.ts

@@ -17,7 +17,7 @@ export function branchRelationPermInclude(user: RequestWithUser["user"]) {
 }
 
 export function createPermCondition(globalAllow: (user: RequestWithUser["user"]) => boolean) {
-  return (user: RequestWithUser["user"]) =>
+  return (user: RequestWithUser["user"], alwaysIncludeHead?: boolean) =>
     isSystem(user)
       ? undefined
       : [
@@ -25,7 +25,10 @@ export function createPermCondition(globalAllow: (user: RequestWithUser["user"])
             user: { some: { userId: user.sub } },
           },
           {
-            branch: { some: { user: { some: { userId: user.sub } } } },
+            branch:
+              alwaysIncludeHead || globalAllow(user)
+                ? { some: { user: { some: { userId: user.sub } } } }
+                : undefined,
           },
           {
             headOffice: globalAllow(user)