core: handle 2FA permission check

packages/hydrooj/package.json

@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "4.2.1",
+    "version": "4.2.2",
     "bin": "bin/hydrooj.js",
     "main": "src/plugin-api",
     "module": "src/plugin-api",

packages/hydrooj/src/handler/api.ts

@@ -94,6 +94,8 @@ export function rebuild() {
 }
 
 class ApiHandler extends Handler {
+    noCheckPermView = true;
+
     query(q: string, variables: any) {
         return graphql({
             schema,

packages/hydrooj/src/handler/contest.ts

@@ -44,6 +44,7 @@ registerValue('Contest', [
 registerResolver(
     'Query', 'contest(id: ObjectID!)', 'Contest',
     async (arg, ctx) => {
+        ctx.checkPerm(PERM.PERM_VIEW);
         arg.id = new ObjectID(arg.id);
         ctx.tdoc = await contest.get(ctx.args.domainId, new ObjectID(arg.id));
         if (!ctx.tdoc) throw new ContestNotFoundError(ctx.args.domainId, arg.id);

packages/hydrooj/src/handler/problem.ts

@@ -70,6 +70,7 @@ registerValue('Problem', [
 registerResolver(
     'Query', 'problem(id: Int, pid: String)', 'Problem',
     async (arg, ctx) => {
+        ctx.checkPerm(PERM.PERM_VIEW);
         const pdoc = await problem.get(ctx.args.domainId, arg.pid || arg.id);
         if (!pdoc) return null;
         if (pdoc.hidden) ctx.checkPerm(PERM.PERM_VIEW_PROBLEM_HIDDEN);
@@ -83,6 +84,7 @@ registerResolver(
     },
 );
 registerResolver('Query', 'problems(ids: [Int])', '[Problem]', async (arg, ctx) => {
+    ctx.checkPerm(PERM.PERM_VIEW);
     const res = await problem.getList(ctx.args.domainId, arg.ids, ctx.user.hasPerm(PERM.PERM_VIEW_PROBLEM_HIDDEN) || ctx.user._id,
         ctx.user.group, undefined, undefined, true);
     return Object.keys(res).map((id) => res[+id]);