core: move tfa check to a seperate route

packages/hydrooj/src/handler/user.ts

@@ -119,6 +119,16 @@ class UserSudoHandler extends Handler {
     }
 }
 
+class UserTFAHandler extends Handler {
+    @param('q', Types.String)
+    async get({ }, q: string) {
+        let udoc = await user.getByUname('system', q);
+        udoc ||= await user.getByEmail('system', q);
+        if (!udoc) this.response.body = { tfa: false, authn: false };
+        else this.response.body = { tfa: udoc.tfa, authn: udoc.authn };
+    }
+}
+
 class UserWebauthnHandler extends Handler {
     noCheckPermView = true;
 
@@ -500,6 +510,7 @@ export async function apply(ctx: Context) {
     ctx.Route('user_login', '/login', UserLoginHandler);
     ctx.Route('user_oauth', '/oauth/:type', OauthHandler);
     ctx.Route('user_sudo', '/user/sudo', UserSudoHandler, PRIV.PRIV_USER_PROFILE);
+    ctx.Route('user_tfa', '/user/tfa', UserTFAHandler);
     ctx.Route('user_webauthn', '/user/webauthn', UserWebauthnHandler);
     ctx.Route('user_oauth_callback', '/oauth/:type/callback', OauthCallbackHandler);
     ctx.Route('user_register', '/register', UserRegisterHandler, PRIV.PRIV_REGISTER_USER);
@@ -523,8 +534,6 @@ export async function apply(ctx: Context) {
             ['regat', 'Date!'],
             ['priv', 'Int!', 'User Privilege'],
             ['avatarUrl', 'String'],
-            ['tfa', 'Boolean!'],
-            ['authn', 'Boolean!'],
             ['displayName', 'String @if(perm: "PERM_VIEW_DISPLAYNAME")'],
             ['rpInfo', 'JSONObject'],
         ]);

packages/hydrooj/src/service/api.ts

@@ -71,7 +71,7 @@ const applyAuthDirective = (s) => mapSchema(s, {
 
 class ApiHandler extends Handler {
     category = '#api';
-    noCheckPermView = true;
+    // FIXME: adding PERM_VIEW check will break omnibar search
 
     query(q: string, variables: any) {
         return graphql({

packages/ui-default/pages/user_verify.page.ts

@@ -74,19 +74,11 @@ export default new AutoloadPage('user_verify', () => {
     ev.preventDefault();
     const form = ev.currentTarget.form;
     const uname = $(form).find('[name="uname"]').val() as string;
-    const info = await api(gql`
-      uname: user(uname:${uname}){
-        tfa authn
-      }
-      mail: user(mail:${uname}){
-        tfa authn
-      }
-    `, ['data']);
-    if (!info.uname && !info.mail) {
-      Notification.error(i18n('User not found.'));
+    if (!uname) {
+      form.elements.namedItem('uname')?.focus();
       return;
     }
-    const { authn, tfa } = info.uname || info.mail;
+    const { authn, tfa } = await request.get('/user/tfa', { q: uname });
     if (authn || tfa) {
       const handleKeyDown = (event) => {
         if (event.key === 'Enter') {