core: contest: fix permission control

packages/hydrooj/src/handler/contest.ts

@@ -78,7 +78,16 @@ export class ContestListHandler extends Handler {
         if (rule && contest.RULES[rule].hidden) throw new BadRequestError();
         const rules = Object.keys(contest.RULES).filter((i) => !contest.RULES[i].hidden);
         const q = {
-            ...this.user.hasPerm(PERM.PERM_VIEW_HIDDEN_CONTEST) ? {} : { $or: [{ assign: { $in: this.user.group } }, { assign: { $size: 0 } }] },
+            ...this.user.hasPerm(PERM.PERM_VIEW_HIDDEN_CONTEST)
+                ? {}
+                : {
+                    $or: [
+                        { maintainer: this.user._id },
+                        { owner: this.user._id },
+                        { assign: { $in: this.user.group } },
+                        { assign: { $size: 0 } },
+                    ],
+                },
             ...rule ? { rule } : { rule: { $in: rules } },
         };
         const cursor = contest.getMulti(domainId, q);

packages/hydrooj/src/handler/homework.ts

@@ -25,7 +25,16 @@ class HomeworkMainHandler extends Handler {
     async get(domainId: string, page = 1) {
         const cursor = contest.getMulti(domainId, {
             rule: 'homework',
-            ...this.user.hasPerm(PERM.PERM_VIEW_HIDDEN_HOMEWORK) ? {} : { $or: [{ assign: { $in: this.user.group } }, { assign: { $size: 0 } }] },
+            ...this.user.hasPerm(PERM.PERM_VIEW_HIDDEN_HOMEWORK)
+                ? {}
+                : {
+                    $or: [
+                        { maintainer: this.user._id },
+                        { owner: this.user._id },
+                        { assign: { $in: this.user.group } },
+                        { assign: { $size: 0 } },
+                    ],
+                },
         });
         const [tdocs, tpcount] = await paginate<Tdoc>(cursor, page, system.get('pagination.contest'));
         const calendar = [];