Fix race condition

apps/labrinth/src/database/models/users_redeemals.rs

@@ -129,6 +129,30 @@ impl UserRedeemal {
 
         Ok(())
     }
+
+    pub async fn update<'a, E>(&self, exec: E) -> sqlx::Result<()>
+    where
+        E: sqlx::PgExecutor<'a>,
+    {
+        let query = query!(
+            r#"
+          UPDATE users_redeemals
+          SET
+            offer = $2,
+            status = $3,
+            redeemed = $4
+          WHERE id = $1
+          "#,
+            self.id,
+            self.offer.as_str(),
+            self.status.as_str(),
+            self.redeemed,
+        );
+
+        query.execute(exec).await?;
+
+        Ok(())
+    }
 }
 
 #[derive(Debug)]

apps/labrinth/src/routes/internal/medal.rs

@@ -65,9 +65,11 @@ pub async fn redeem(
 ) -> Result<HttpResponse, ApiError> {
     // Check the offer hasn't been redeemed yet, then insert into the table.
 
+    let mut txn = pool.begin().await?;
+
     let maybe_fields =
         RedeemalLookupFields::redeemal_status_by_username_and_offer(
-            &**pool,
+            &mut *txn,
             &username,
             Offer::Medal,
         )
@@ -86,6 +88,19 @@ pub async fn redeem(
         }
     };
 
+    // Link user to offer redeemal.
+    let mut redeemal = UserRedeemal {
+        id: 0,
+        user_id,
+        offer: Offer::Medal,
+        redeemed: Utc::now(),
+        status: Status::Pending,
+    };
+
+    redeemal.insert(&mut *txn).await?;
+
+    txn.commit().await?;
+
     let client = reqwest::Client::new();
 
     // Find the Medal product price
@@ -213,16 +228,9 @@ pub async fn redeem(
     .upsert(&mut txn)
     .await?;
 
-    // Link user to offer redeemal.
+    // Update `users_redeemal`, mark subscription as redeemed.
-    let mut redeemal = UserRedeemal {
+    redeemal.status = Status::Redeemed;
-        id: 0,
+    redeemal.update(&mut *txn).await?;
-        user_id,
-        offer: Offer::Medal,
-        redeemed: Utc::now(),
-        status: Status::Redeemed,
-    };
-
-    redeemal.insert(&mut *txn).await?;
 
     txn.commit().await?;