From dd0dd9d754e21534d72a7bc3a166fc22cda6a048 Mon Sep 17 00:00:00 2001
From: Adam Soltys <asoltys@gmail.com>
Date: Mon, 1 Apr 2019 22:24:53 -0700
Subject: update balance before sending coins

---
 docker/stack.yml | 15 +++++++++++++++
 index.js         | 38 ++++++++++++++++++++++++++------------
 2 files changed, 41 insertions(+), 12 deletions(-)
 create mode 100644 docker/stack.yml

diff --git a/docker/stack.yml b/docker/stack.yml
new file mode 100644
index 00000000..76a7cebe
--- /dev/null
+++ b/docker/stack.yml
@@ -0,0 +1,15 @@
+version: '3.1'
+
+services:
+
+  db:
+    image: mariadb
+    restart: always
+    environment:
+      MYSQL_ROOT_PASSWORD: example
+
+  adminer:
+    image: adminer
+    restart: always
+    ports:
+      - 8080:8080
diff --git a/index.js b/index.js
index ab1937b7..09fd0d3c 100644
--- a/index.js
+++ b/index.js
@@ -689,9 +689,20 @@ const authy = new Client({ key: config.authy.key });
       amount = req.user.balance - MINFEE
     }
 
-    if (amount > req.user.balance) {
-      return res.status(401).send('Insufficient funds')
-    }
+    await db.transaction(async transaction => {
+      let { balance } = await db.User.findOne({
+        where: {
+          username: req.user.username,
+        },
+      })
+
+      if (amount > balance) {
+        return res.status(401).send('Insufficient funds')
+      }
+
+      req.user.balance -= amount + 10000
+      await req.user.save()
+    })
 
     try {
       await bc.walletPassphrase(config.bitcoin.walletpass, 300)
@@ -710,16 +721,19 @@ const authy = new Client({ key: config.authy.key });
 
       let fees = inputTotal - outputTotal
       let total = Math.min(parseInt(amount) + fees, req.user.balance)
-      req.user.balance -= total
-      await req.user.save()
-      emit(req.user.username, 'user', req.user)
+      req.user.balance += 10000 - fees
 
-      await db.Payment.create({
-        amount: -total,
-        user_id: req.user.id,
-        hash: txid,
-        rate: app.get('rates').ask,
-        currency: 'CAD',
+      await db.transaction(async transaction => {
+        await req.user.save()
+        emit(req.user.username, 'user', req.user)
+
+        await db.Payment.create({
+          amount: -total,
+          user_id: req.user.id,
+          hash: txid,
+          rate: app.get('rates').ask,
+          currency: 'CAD',
+        })
       })
 
       res.send({ txid, tx, amount, fees })
-- 
cgit v1.2.3