fix(fe): restrict contest pages to contest admin and manager

apps/frontend/app/admin/contest/[contestId]/_components/ContestAccessDenied.tsx

@@ -0,0 +1,23 @@
+'use client'
+
+import { useRouter } from 'next/navigation'
+import { useEffect, useRef } from 'react'
+import { toast } from 'sonner'
+
+export function ContestAccessDenied() {
+  const router = useRouter()
+  const done = useRef(false)
+
+  useEffect(() => {
+    if (done.current) {
+      return
+    }
+    done.current = true
+    router.replace('/admin/contest')
+    setTimeout(() => {
+      toast.error('You do not have access to this contest.')
+    }, 100)
+  }, [router])
+
+  return null
+}

apps/frontend/app/admin/contest/[contestId]/layout.tsx

@@ -0,0 +1,41 @@
+import { safeFetcherWithAuth } from '@/libs/utils'
+import { ContestRole, type UserContest } from '@generated/graphql'
+import { ContestAccessDenied } from './_components/ContestAccessDenied'
+
+export const dynamic = 'force-dynamic'
+
+async function fetchContestRoles() {
+  try {
+    const response: UserContest[] = await safeFetcherWithAuth
+      .get('contest/role')
+      .json()
+
+    return response
+  } catch (error) {
+    console.error('Error fetching contest roles:', error)
+    return []
+  }
+}
+
+export default async function Layout({
+  children,
+  params
+}: {
+  children: React.ReactNode
+  params: Promise<{ contestId: string }>
+}) {
+  const { contestId } = await params
+  const roles = await fetchContestRoles()
+
+  const hasPermission = roles.some(
+    (r) =>
+      r.contestId === Number(contestId) &&
+      (r.role === ContestRole.Admin || r.role === ContestRole.Manager)
+  )
+
+  if (!hasPermission) {
+    return <ContestAccessDenied />
+  }
+
+  return children
+}