Hydro.error; csrf_token validation

hydro/model/builtin.js

@@ -160,7 +160,8 @@ PERM.PERM_BASIC = PERM.PERM_VIEW
     + PERM.PERM_VIEW_CONTEST_SCOREBOARD
     + PERM.PERM_VIEW_HOMEWORK
     + PERM.PERM_VIEW_HOMEWORK_SCOREBOARD
-    + PERM.PERM_VIEW_TRAINING;
+    + PERM.PERM_VIEW_TRAINING
+    + PERM.PERM_VIEW_RANKING;
 
 PERM.PERM_DEFAULT = PERM.PERM_VIEW
     + PERM.PERM_VIEW_PROBLEM
@@ -203,7 +204,8 @@ PERM.PERM_DEFAULT = PERM.PERM_VIEW
     + PERM.PERM_REPLY_DISCUSSION
     + PERM.PERM_ATTEND_CONTEST
     + PERM.PERM_CREATE_TRAINING
-    + PERM.PERM_ATTEND_HOMEWORK;
+    + PERM.PERM_ATTEND_HOMEWORK
+    + PERM.PERM_VIEW_RANKING;
 
 PERM.PERM_ADMIN = PERM.PERM_ALL;
 

hydro/model/token.js

@@ -53,14 +53,17 @@ async function get(tokenId, tokenType) {
  */
 async function update(tokenId, tokenType, expireSeconds, data) {
     const now = new Date();
-    const res = await coll.findOneAndUpdate({ _id: tokenId, tokenType }, {
-        $set: {
-            ...data,
-            updateAt: now,
-            expireAt: new Date(now.getTime() + expireSeconds * 1000),
-            tokenType,
+    const res = await coll.updateOne(
+        { _id: tokenId, tokenType },
+        {
+            $set: {
+                ...data,
+                updateAt: now,
+                expireAt: new Date(now.getTime() + expireSeconds * 1000),
+                tokenType,
+            },
         },
-    });
+    );
     return res.value;
 }