core: do not allow deleting system domain

packages/hydrooj/package.json

@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "3.3.7",
+    "version": "3.3.8",
     "bin": "bin/hydrooj.js",
     "main": "src/loader",
     "module": "src/loader",

packages/hydrooj/src/handler/domain.ts

@@ -99,10 +99,11 @@ class DomainEditHandler extends ManageHandler {
         this.response.redirect = this.url('domain_dashboard');
     }
 
-    async postDelete({ password }) {
+    async postDelete({ domainId, password }) {
         this.user.checkPassword(password);
-        if (this.domain.owner === this.user._id) throw new ForbiddenError('You are not the owner of this domain.');
-        await domain.del(this.domainId);
+        if (domainId === 'system') throw new ForbiddenError('You are not allowed to delete system domain');
+        if (this.domain.owner !== this.user._id) throw new ForbiddenError('You are not the owner of this domain.');
+        await domain.del(domainId);
         this.response.redirect = this.url('home_domain', { domainId: 'system' });
     }
 }