web: Make badge claim codes single-use

1 files changed, 2 insertions, 1 deletions

diff --git a/fig-web/src/Fig/Web/Module/Claim.hs b/fig-web/src/Fig/Web/Module/Claim.hs
index 507c622..eb84569 100644
--- a/fig-web/src/Fig/Web/Module/Claim.hs
+++ b/fig-web/src/Fig/Web/Module/Claim.hs
@@ -13,10 +13,11 @@ secure :: SecureModule
 secure a = do
   onPost "/api/claim/:code" $ authed a \creds -> do
     code <- pathParam "code"
-    DB.run a.db (DB.hget code "claim:codes") >>= \case
+    DB.run a.db (DB.hget "claim:codes" code) >>= \case
       Nothing -> log $ "user " <> creds.user <> " tried invalid badge claim code: " <> decodeUtf8 code
       Just badge -> do
         log $ "user " <> creds.user <> " redeemed valid badge claim code: " <> decodeUtf8 code
         let bstid = encodeUtf8 creds.twitchId
         DB.run a.db do
+          DB.hdel "claim:codes" code
           DB.sadd ("user:badges:" <> bstid) [badge]