core: disable view contest code by default

packages/hydrooj/package.json

@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "4.0.10",
+    "version": "4.0.11",
     "bin": "bin/hydrooj.js",
     "main": "src/plugin-api",
     "module": "src/plugin-api",

packages/hydrooj/src/handler/record.ts

@@ -155,7 +155,7 @@ class RecordDetailHandler extends Handler {
         canViewCode ||= this.user.hasPriv(PRIV.PRIV_READ_RECORD_CODE);
         canViewCode ||= this.user.hasPerm(PERM.PERM_READ_RECORD_CODE);
         canViewCode ||= this.user.hasPerm(PERM.PERM_READ_RECORD_CODE_ACCEPT) && self?.status === STATUS.STATUS_ACCEPTED;
-        if (tdoc && contest.isDone(tdoc)) {
+        if (tdoc && tdoc.allowViewCode && contest.isDone(tdoc)) {
             const tsdoc = await contest.getStatus(domainId, tdoc.docId, this.user._id);
             canViewCode ||= tsdoc?.attend;
         }

packages/hydrooj/src/interface.ts

@@ -351,6 +351,7 @@ export interface Tdoc<docType = document['TYPE_CONTEST'] | document['TYPE_TRAINI
     _code?: string;
     assign?: string[];
     files?: FileInfo[];
+    allowViewCode?: boolean;
 
     // For contest
     lockAt?: Date;