fix

account/decorators.py

@@ -20,27 +20,32 @@ class BasePermissionDecorator(object):
             return functools.partial(self._async_call, obj)
         return functools.partial(self.__call__, obj)
 
-    def error(self, data):
-        return JSONResponse.response({"error": "permission-denied", "data": data})
+    def error(self, data, err="permission-denied"):
+        return JSONResponse.response({"error": err, "data": data})
+
+    def _permission_error(self, request):
+        if not request.user.is_authenticated:
+            return self.error("请先登录", err="login-required")
+        return self.error("权限不足", err="permission-denied")
 
     def __call__(self, *args, **kwargs):
         request = args[1]
 
         if self.check_permission(request):
             if request.user.is_disabled:
-                return self.error("Your account is disabled")
+                return self.error("账号已禁用")
             return self.func(*args, **kwargs)
         else:
-            return self.error("Please login first")
+            return self._permission_error(request)
 
     async def _async_call(self, *args, **kwargs):
         request = args[1]
 
         if self.check_permission(request):
             if request.user.is_disabled:
-                return self.error("Your account is disabled")
+                return self.error("账号已禁用")
             return await self.func(*args, **kwargs)
-        return self.error("Please login first")
+        return self._permission_error(request)
 
     def check_permission(self, request):
         raise NotImplementedError()
@@ -110,43 +115,42 @@ def check_contest_permission(check_type="details"):
     若通过验证，在view中可通过self.contest获得该contest
     """
 
+    def _get_contest_id(request):
+        return request.data.get("contest_id") or request.GET.get("contest_id")
+
+    def _check_access(self, request, user):
+        if not user.is_authenticated:
+            return self.error("请先登录", err="login-required")
+
+        if user.is_contest_admin(self.contest):
+            return None
+
+        if self.contest.contest_type == ContestType.PASSWORD_PROTECTED_CONTEST:
+            if not check_contest_password(request.session.get(CONTEST_PASSWORD_SESSION_KEY, {}).get(self.contest.id), self.contest.password):
+                return self.error("Wrong password or password expired")
+
+        if self.contest.status == ContestStatus.CONTEST_NOT_START and check_type != "details":
+            return self.error("Contest has not started yet.")
+
+        return None
+
     def decorator(func):
-        def _check_permission(*args, **kwargs):
+        @functools.wraps(func)
+        async def _wrapper(*args, **kwargs):
             self = args[0]
             request = args[1]
-            user = request.user
-            if request.data.get("contest_id"):
-                contest_id = request.data["contest_id"]
-            else:
-                contest_id = request.GET.get("contest_id")
+            contest_id = _get_contest_id(request)
             if not contest_id:
                 return self.error("Parameter error, contest_id is required")
-
             try:
-                # use self.contest to avoid query contest again in view.
-                self.contest = Contest.objects.select_related("created_by").get(id=contest_id, visible=True)
+                self.contest = await Contest.objects.select_related("created_by").aget(id=contest_id, visible=True)
             except Contest.DoesNotExist:
                 return self.error("Contest %s doesn't exist" % contest_id)
-
-            # Anonymous
-            if not user.is_authenticated:
-                return self.error("Please login first.")
-
-            # creator or owner
-            if user.is_contest_admin(self.contest):
-                return func(*args, **kwargs)
-
-            if self.contest.contest_type == ContestType.PASSWORD_PROTECTED_CONTEST:
-                # password error
-                if not check_contest_password(request.session.get(CONTEST_PASSWORD_SESSION_KEY, {}).get(self.contest.id), self.contest.password):
-                    return self.error("Wrong password or password expired")
-
-            # regular user get contest problems, ranks etc. before contest started
-            if self.contest.status == ContestStatus.CONTEST_NOT_START and check_type != "details":
-                return self.error("Contest has not started yet.")
-
-            return func(*args, **kwargs)
-        return _check_permission
+            error = _check_access(self, request, request.user)
+            if error:
+                return error
+            return await func(*args, **kwargs)
+        return _wrapper
     return decorator
 
 

account/middleware.py

@@ -37,8 +37,10 @@ class AdminRoleRequiredMiddleware(MiddlewareMixin):
     def process_request(self, request):
         path = request.path_info
         if path.startswith("/admin/") or path.startswith("/api/admin/"):
-            if not (request.user.is_authenticated and request.user.is_admin_role()):
-                return JSONResponse.response({"error": "login-required", "data": "Please login in first"})
+            if not request.user.is_authenticated:
+                return JSONResponse.response({"error": "login-required", "data": "请先登录"})
+            if not request.user.is_admin_role():
+                return JSONResponse.response({"error": "permission-denied", "data": "权限不足"})
 
 
 class LogSqlMiddleware(MiddlewareMixin):

contest/views/oj.py

@@ -1,6 +1,7 @@
 import io
 
 import xlsxwriter
+from asgiref.sync import sync_to_async
 from django.http import HttpResponse
 from django.utils.timezone import now
 
@@ -11,7 +12,7 @@ from account.decorators import (
 )
 from account.models import AdminType
 from problem.models import Problem
-from utils.api import APIView, AsyncAPIView, validate_serializer
+from utils.api import AsyncAPIView, validate_serializer
 from utils.constants import CONTEST_PASSWORD_SESSION_KEY, ContestStatus
 from utils.shortcuts import check_is_id, datetime2str
 
@@ -20,19 +21,20 @@ from ..serializers import ACMContestRankSerializer, ContestAnnouncementSerialize
 
 
 # DEPRECATED: 前端未调用 (2026-05-26)
-class ContestAnnouncementListAPI(APIView):
+class ContestAnnouncementListAPI(AsyncAPIView):
     @check_contest_permission(check_type="announcements")
-    def get(self, request):
+    async def get(self, request):
         contest_id = request.GET.get("contest_id")
         if not contest_id:
             return self.error("Invalid parameter, contest_id is required")
-        data = ContestAnnouncement.objects.select_related("created_by").filter(
+        qs = ContestAnnouncement.objects.select_related("created_by").filter(
             contest_id=contest_id, visible=True
         )
         max_id = request.GET.get("max_id")
         if max_id:
-            data = data.filter(id__gt=max_id)
-        return self.success(ContestAnnouncementSerializer(data, many=True).data)
+            qs = qs.filter(id__gt=max_id)
+        data = await self.async_serialize_data(ContestAnnouncementSerializer, [item async for item in qs], many=True)
+        return self.success(data)
 
 
 class ContestAPI(AsyncAPIView):
@@ -76,13 +78,13 @@ class ContestListAPI(AsyncAPIView):
         return self.success(await self.async_paginate_data(request, contests, ContestSerializer))
 
 
-class ContestPasswordVerifyAPI(APIView):
+class ContestPasswordVerifyAPI(AsyncAPIView):
     @validate_serializer(ContestPasswordVerifySerializer)
     @login_required
-    def post(self, request):
+    async def post(self, request):
         data = request.data
         try:
-            contest = Contest.objects.get(
+            contest = await Contest.objects.aget(
                 id=data["contest_id"], visible=True, password__isnull=False
             )
         except Contest.DoesNotExist:
@@ -90,23 +92,21 @@ class ContestPasswordVerifyAPI(APIView):
         if not check_contest_password(data["password"], contest.password):
             return self.error("Wrong password or password expired")
 
-        # password verify OK.
         if CONTEST_PASSWORD_SESSION_KEY not in request.session:
             request.session[CONTEST_PASSWORD_SESSION_KEY] = {}
         request.session[CONTEST_PASSWORD_SESSION_KEY][contest.id] = data["password"]
-        # https://docs.djangoproject.com/en/dev/topics/http/sessions/#when-sessions-are-saved
         request.session.modified = True
         return self.success(True)
 
 
-class ContestAccessAPI(APIView):
+class ContestAccessAPI(AsyncAPIView):
     @login_required
-    def get(self, request):
+    async def get(self, request):
         contest_id = request.GET.get("contest_id")
         if not contest_id:
             return self.error()
         try:
-            contest = Contest.objects.get(
+            contest = await Contest.objects.aget(
                 id=contest_id, visible=True, password__isnull=False
             )
         except Contest.DoesNotExist:
@@ -119,7 +119,7 @@ class ContestAccessAPI(APIView):
         )
 
 
-class ContestRankAPI(APIView):
+class ContestRankAPI(AsyncAPIView):
     def get_rank(self):
         return (
             ACMContestRank.objects.filter(
@@ -138,8 +138,40 @@ class ContestRankAPI(APIView):
             string = chr(65 + remainder) + string
         return string
 
+    def _build_xlsx(self, data, contest_problems):
+        problem_id_to_col = {p.id: i for i, p in enumerate(contest_problems)}
+        f = io.BytesIO()
+        workbook = xlsxwriter.Workbook(f)
+        worksheet = workbook.add_worksheet()
+        worksheet.write("A1", "User ID")
+        worksheet.write("B1", "Username")
+        worksheet.write("C1", "Real Name")
+        worksheet.write("D1", "AC")
+        worksheet.write("E1", "Total Submission")
+        worksheet.write("F1", "Total Time")
+        for i, p in enumerate(contest_problems):
+            worksheet.write(self.column_string(7 + i) + "1", p.title)
+
+        for index, item in enumerate(data):
+            worksheet.write_string(index + 1, 0, str(item["user"]["id"]))
+            worksheet.write_string(index + 1, 1, item["user"]["username"])
+            worksheet.write_string(
+                index + 1, 2, item["user"]["real_name"] or ""
+            )
+            worksheet.write_string(index + 1, 3, str(item["accepted_number"]))
+            worksheet.write_string(index + 1, 4, str(item["submission_number"]))
+            worksheet.write_string(index + 1, 5, str(item["total_time"]))
+            for k, v in item["submission_info"].items():
+                worksheet.write_string(
+                    index + 1, 6 + problem_id_to_col[int(k)], str(v["is_ac"])
+                )
+
+        workbook.close()
+        f.seek(0)
+        return f.read()
+
     @check_contest_permission(check_type="ranks")
-    def get(self, request):
+    async def get(self, request):
         download_csv = request.GET.get("download_csv")
         is_contest_admin = (
             request.user.is_authenticated
@@ -149,50 +181,24 @@ class ContestRankAPI(APIView):
         qs = self.get_rank()
 
         if download_csv:
-            data = ACMContestRankSerializer(qs, many=True, is_contest_admin=is_contest_admin).data
-            contest_problems = list(Problem.objects.filter(
-                contest=self.contest, visible=True
-            ).order_by("_id"))
-            # 预建 problem_id → 列索引 的字典，避免循环中 O(n) list.index()
-            problem_id_to_col = {p.id: i for i, p in enumerate(contest_problems)}
-
-            f = io.BytesIO()
-            workbook = xlsxwriter.Workbook(f)
-            worksheet = workbook.add_worksheet()
-            worksheet.write("A1", "User ID")
-            worksheet.write("B1", "Username")
-            worksheet.write("C1", "Real Name")
-            worksheet.write("D1", "AC")
-            worksheet.write("E1", "Total Submission")
-            worksheet.write("F1", "Total Time")
-            for i, p in enumerate(contest_problems):
-                worksheet.write(self.column_string(7 + i) + "1", p.title)
-
-            for index, item in enumerate(data):
-                worksheet.write_string(index + 1, 0, str(item["user"]["id"]))
-                worksheet.write_string(index + 1, 1, item["user"]["username"])
-                worksheet.write_string(
-                    index + 1, 2, item["user"]["real_name"] or ""
-                )
-                worksheet.write_string(index + 1, 3, str(item["accepted_number"]))
-                worksheet.write_string(index + 1, 4, str(item["submission_number"]))
-                worksheet.write_string(index + 1, 5, str(item["total_time"]))
-                for k, v in item["submission_info"].items():
-                    worksheet.write_string(
-                        index + 1, 6 + problem_id_to_col[int(k)], str(v["is_ac"])
-                    )
-
-            workbook.close()
-            f.seek(0)
-            response = HttpResponse(f.read())
+            rank_list = [item async for item in qs]
+            data = await self.async_serialize_data(
+                ACMContestRankSerializer, rank_list, many=True, is_contest_admin=is_contest_admin
+            )
+            contest_problems = await sync_to_async(
+                lambda: list(Problem.objects.filter(contest=self.contest, visible=True).order_by("_id"))
+            )()
+            xlsx_bytes = await sync_to_async(self._build_xlsx)(data, contest_problems)
+            response = HttpResponse(xlsx_bytes)
             response["Content-Disposition"] = (
                 f"attachment; filename=content-{self.contest.id}-rank.xlsx"
             )
             response["Content-Type"] = "application/xlsx"
             return response
 
-        page_qs = self.paginate_data(request, qs)
-        page_qs["results"] = ACMContestRankSerializer(
+        page_qs = await self.async_paginate_data(request, qs)
+        page_qs["results"] = await self.async_serialize_data(
+            ACMContestRankSerializer,
             page_qs["results"], many=True, is_contest_admin=is_contest_admin
-        ).data
+        )
         return self.success(page_qs)

problem/views/oj.py

@@ -7,7 +7,7 @@ from django.utils import timezone
 from account.decorators import check_contest_permission
 from account.models import User
 from submission.models import JudgeStatus, Submission
-from utils.api import APIView, AsyncAPIView
+from utils.api import AsyncAPIView
 from utils.async_helpers import async_cache_get, async_cache_set
 from utils.constants import CacheKey
 
@@ -144,7 +144,7 @@ class ProblemAPI(AsyncAPIView):
         return self.success(data)
 
 
-class ContestProblemAPI(APIView):
+class ContestProblemAPI(AsyncAPIView):
     def _add_problem_status(self, request, queryset_values):
         if request.user.is_authenticated:
             profile = request.user.userprofile
@@ -153,31 +153,26 @@ class ContestProblemAPI(APIView):
                 problem["my_status"] = problems_status.get(str(problem["id"]), {}).get("status")
 
     @check_contest_permission(check_type="problems")
-    def get(self, request):
+    async def get(self, request):
         problem_id = request.GET.get("problem_id")
         if problem_id:
             try:
-                problem = Problem.objects.select_related("created_by").get(_id__iexact=problem_id, contest=self.contest, visible=True)
+                problem = await Problem.objects.select_related("created_by").aget(_id__iexact=problem_id, contest=self.contest, visible=True)
             except Problem.DoesNotExist:
                 return self.error("Problem does not exist.")
             if self.contest.problem_details_permission(request.user):
-                problem_data = ProblemSerializer(problem).data
-                self._add_problem_status(
-                    request,
-                    [
-                        problem_data,
-                    ],
-                )
+                problem_data = await self.async_serialize_data(ProblemSerializer, problem)
+                self._add_problem_status(request, [problem_data])
             else:
-                problem_data = ProblemSafeSerializer(problem).data
+                problem_data = await self.async_serialize_data(ProblemSafeSerializer, problem)
             return self.success(problem_data)
 
         contest_problems = Problem.objects.select_related("created_by").prefetch_related("tags").filter(contest=self.contest, visible=True)
         if self.contest.problem_details_permission(request.user):
-            data = ProblemListSerializer(contest_problems, many=True).data
+            data = await self.async_serialize_data(ProblemListSerializer, [p async for p in contest_problems], many=True)
             self._add_problem_status(request, data)
         else:
-            data = ProblemSafeSerializer(contest_problems, many=True).data
+            data = await self.async_serialize_data(ProblemSafeSerializer, [p async for p in contest_problems], many=True)
         return self.success(data)
 
 

submission/views/admin.py

@@ -1,6 +1,6 @@
 from django.db.models import Count, Q
 
-from account.decorators import super_admin_required
+from account.decorators import super_admin_required, teacher_admin_required
 from account.models import AdminType, User
 from judge.tasks import judge_task
 from problem.models import Problem
@@ -35,7 +35,7 @@ class SubmissionRejudgeAPI(APIView):
 
 
 class SubmissionStatisticsAPI(APIView):
-    @super_admin_required
+    @teacher_admin_required
     def get(self, request):
         start = request.GET.get("start")
         end = request.GET.get("end")

submission/views/oj.py

@@ -10,7 +10,7 @@ from options.options import SysOptions
 
 # from judge.dispatcher import JudgeDispatcher
 from problem.models import Problem, ProblemRuleType
-from utils.api import APIView, AsyncAPIView, validate_serializer
+from utils.api import AsyncAPIView, validate_serializer
 from utils.cache import cache
 from utils.captcha import Captcha
 from utils.throttling import TokenBucket
@@ -26,9 +26,8 @@ from ..serializers import (
 )
 
 
-class SubmissionAPI(APIView):
+class SubmissionAPI(AsyncAPIView):
     def throttling(self, request):
-        # 使用 open_api 的请求暂不做限制
         auth_method = getattr(request, "auth_method", "")
         if auth_method == "api_key":
             return
@@ -39,14 +38,8 @@ class SubmissionAPI(APIView):
         if not can_consume:
             return "Please wait %d seconds" % (int(wait))
 
-        # ip_bucket = TokenBucket(key=request.session["ip"],
-        #                         redis_conn=cache, **SysOptions.throttling["ip"])
-        # can_consume, wait = ip_bucket.consume()
-        # if not can_consume:
-        #     return "Captcha is required"
-
     @check_contest_permission(check_type="problems")
-    def check_contest_permission(self, request):
+    async def check_contest_permission(self, request):
         contest = self.contest
         if contest.status == ContestStatus.CONTEST_ENDED:
             return self.error("The contest have ended")
@@ -61,11 +54,11 @@ class SubmissionAPI(APIView):
 
     @validate_serializer(CreateSubmissionSerializer)
     @login_required
-    def post(self, request):
+    async def post(self, request):
         data = request.data
         hide_id = False
         if data.get("contest_id"):
-            error = self.check_contest_permission(request)
+            error = await self.check_contest_permission(request)
             if error:
                 return error
             contest = self.contest
@@ -75,19 +68,19 @@ class SubmissionAPI(APIView):
         if data.get("captcha"):
             if not Captcha(request).check(data["captcha"]):
                 return self.error("Invalid captcha")
-        error = self.throttling(request)
+        error = await sync_to_async(self.throttling)(request)
         if error:
             return self.error(error)
 
         try:
-            problem = Problem.objects.get(
+            problem = await Problem.objects.aget(
                 id=data["problem_id"], contest_id=data.get("contest_id"), visible=True
             )
         except Problem.DoesNotExist:
             return self.error("Problem not exist")
         if data["language"] not in problem.languages:
             return self.error(f"{data['language']} is not allowed in the problem")
-        submission = Submission.objects.create(
+        submission = await Submission.objects.acreate(
             user_id=request.user.id,
             username=request.user.username,
             language=data["language"],
@@ -97,8 +90,6 @@ class SubmissionAPI(APIView):
             contest_id=data.get("contest_id"),
         )
 
-        # use this for debug
-        # JudgeDispatcher(submission.id, problem.id).judge()
         judge_task.send(submission.id, problem.id)
         if hide_id:
             return self.success()
@@ -106,12 +97,12 @@ class SubmissionAPI(APIView):
             return self.success({"submission_id": submission.id})
 
     @login_required
-    def get(self, request):
+    async def get(self, request):
         submission_id = request.GET.get("id")
         if not submission_id:
             return self.error("Parameter id doesn't exist")
         try:
-            submission = Submission.objects.select_related("problem").get(
+            submission = await Submission.objects.select_related("problem").aget(
                 id=submission_id
             )
         except Submission.DoesNotExist:
@@ -123,10 +114,9 @@ class SubmissionAPI(APIView):
             submission.problem.rule_type == ProblemRuleType.OI
             or request.user.is_admin_role()
         ):
-            submission_data = SubmissionModelSerializer(submission).data
+            submission_data = await self.async_serialize_data(SubmissionModelSerializer, submission)
         else:
-            submission_data = SubmissionSafeModelSerializer(submission).data
-        # 是否有权限取消共享
+            submission_data = await self.async_serialize_data(SubmissionSafeModelSerializer, submission)
         submission_data["can_unshare"] = submission.check_user_permission(
             request.user, check_share=False
         )
@@ -134,12 +124,9 @@ class SubmissionAPI(APIView):
 
     @validate_serializer(ShareSubmissionSerializer)
     @login_required
-    def put(self, request):
-        """
-        share submission
-        """
+    async def put(self, request):
         try:
-            submission = Submission.objects.select_related("problem").get(
+            submission = await Submission.objects.select_related("problem").aget(
                 id=request.data["id"]
             )
         except Submission.DoesNotExist:
@@ -152,7 +139,7 @@ class SubmissionAPI(APIView):
         ):
             return self.error("Can not share submission now")
         submission.shared = request.data["shared"]
-        submission.save(update_fields=["shared"])
+        await submission.asave(update_fields=["shared"])
         return self.success()
 
 
@@ -215,9 +202,9 @@ class SubmissionListAPI(AsyncAPIView):
         return self.success(data)
 
 
-class ContestSubmissionListAPI(APIView):
+class ContestSubmissionListAPI(AsyncAPIView):
     @check_contest_permission(check_type="submissions")
-    def get(self, request):
+    async def get(self, request):
         if not request.GET.get("limit"):
             return self.error("Limit is needed")
 
@@ -231,7 +218,7 @@ class ContestSubmissionListAPI(APIView):
         username = request.GET.get("username")
         if problem_id:
             try:
-                problem = Problem.objects.get(
+                problem = await Problem.objects.aget(
                     _id__iexact=problem_id, contest_id=contest.id, visible=True
                 )
             except Problem.DoesNotExist:
@@ -245,35 +232,35 @@ class ContestSubmissionListAPI(APIView):
         if result:
             submissions = submissions.filter(result=result)
 
-        # filter the test submissions submitted before contest start
         if contest.status != ContestStatus.CONTEST_NOT_START:
             submissions = submissions.filter(create_time__gte=contest.start_time)
 
-
-        data = self.paginate_data(request, submissions)
+        data = await self.async_paginate_data(request, submissions)
         results = data["results"]
         if request.user.is_authenticated and request.user.is_regular_user():
             problem_ids = list({s.problem_id for s in results})
-            progress_cache = bulk_fetch_problemset_progress(request.user, problem_ids)
+            progress_cache = await sync_to_async(bulk_fetch_problemset_progress)(request.user, problem_ids)
         else:
             progress_cache = {}
-        data["results"] = SubmissionListSerializer(
+        data["results"] = await self.async_serialize_data(
+            SubmissionListSerializer,
             results, many=True, user=request.user, problemset_progress_cache=progress_cache
-        ).data
+        )
         return self.success(data)
 
 
 # DEPRECATED: 前端未调用 (2026-05-26)
-class SubmissionExistsAPI(APIView):
-    def get(self, request):
+class SubmissionExistsAPI(AsyncAPIView):
+    async def get(self, request):
         if not request.GET.get("problem_id"):
             return self.error("Parameter error, problem_id is required")
-        return self.success(
+        exists = (
             request.user.is_authenticated
-            and Submission.objects.filter(
+            and await Submission.objects.filter(
                 problem_id=request.GET["problem_id"], user_id=request.user.id
-            ).exists()
+            ).aexists()
         )
+        return self.success(exists)
 
 
 class SubmissionsTodayCount(AsyncAPIView):