Ensure coupons are only used once

app/dashboard/views/coupon.py

@@ -68,9 +68,14 @@ def coupon_route():
                 )
                 return redirect(request.url)
 
-            coupon.used_by_user_id = current_user.id
-            coupon.used = True
-            Session.commit()
+            updated = (
+                Session.query(Coupon)
+                .filter_by(code=code, used=False)
+                .update({"used_by_user_id": current_user.id, "used": True})
+            )
+            if updated != 1:
+                flash("Coupon is not valid", "error")
+                return redirect(request.url)
 
             manual_sub: ManualSubscription = ManualSubscription.get_by(
                 user_id=current_user.id

tests/dashboard/test_coupon.py

@@ -0,0 +1,18 @@
+from flask import url_for
+from app.models import Coupon
+from app.utils import random_string
+from tests.utils import login
+
+
+def test_use_coupon(flask_client):
+    login(flask_client)
+    code = random_string(10)
+    Coupon.create(code=code, nb_year=1, commit=True)
+
+    r = flask_client.post(
+        url_for("dashboard.coupon_route"),
+        data={"code": code},
+    )
+
+    assert r.status_code == 200
+    assert Coupon.get_by(code=code).used