From 094d875acbf873b0ed587bc1c688850ceaa51e97 Mon Sep 17 00:00:00 2001 From: LLLL Colonq Date: Tue, 21 Jul 2026 03:16:04 -0400 Subject: web: Make badge claim codes single-use --- fig-web/src/Fig/Web/Module/Claim.hs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fig-web/src/Fig/Web/Module/Claim.hs b/fig-web/src/Fig/Web/Module/Claim.hs index 507c622..eb84569 100644 --- a/fig-web/src/Fig/Web/Module/Claim.hs +++ b/fig-web/src/Fig/Web/Module/Claim.hs @@ -13,10 +13,11 @@ secure :: SecureModule secure a = do onPost "/api/claim/:code" $ authed a \creds -> do code <- pathParam "code" - DB.run a.db (DB.hget code "claim:codes") >>= \case + DB.run a.db (DB.hget "claim:codes" code) >>= \case Nothing -> log $ "user " <> creds.user <> " tried invalid badge claim code: " <> decodeUtf8 code Just badge -> do log $ "user " <> creds.user <> " redeemed valid badge claim code: " <> decodeUtf8 code let bstid = encodeUtf8 creds.twitchId DB.run a.db do + DB.hdel "claim:codes" code DB.sadd ("user:badges:" <> bstid) [badge] -- cgit v1.3.1