Fix bug with auto-claim for unverified balance

internal/service/handlers/fulfill_qr_event.go

@@ -71,6 +71,12 @@ func FulfillQREvent(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if !balance.IsVerified {
+		Log(r).Infof("Balance nullifier=%s is not verified, fulfill or claim not allowed", event.Nullifier)
+		ape.RenderErr(w, problems.Forbidden())
+		return
+	}
+
 	err = EventsQ(r).Transaction(func() error {
 		event, err = claimEvent(r, event, balance)
 		return err

internal/service/workers/nooneisforgotten/main.go

@@ -48,6 +48,7 @@ func updatePassportScanEvents(db *pgdb.DB, types evtypes.Types, levels config.Le
 		return nil
 	}
 
+	// ensured in query that all balances are verified
 	balances, err := pg.NewBalances(db).WithoutPassportEvent()
 	if err != nil {
 		return fmt.Errorf("failed to select balances without points for passport scan: %w", err)
@@ -146,21 +147,14 @@ func claimReferralSpecificEvents(db *pgdb.DB, types evtypes.Types, levels config
 	}
 
 	// we need to have maps which link nullifiers to events slice
-	toClaim := make([]string, 0, len(events))
 	nullifiers := make([]string, 0, len(events))
 	for _, event := range events {
-		toClaim = append(toClaim, event.ID)
 		nullifiers = append(nullifiers, event.Nullifier)
 	}
-	if len(toClaim) == 0 {
+	if len(nullifiers) == 0 {
 		return nil
 	}
 
-	_, err = pg.NewEvents(db).FilterByID(toClaim...).Update(data.EventClaimed, nil, &evType.Reward)
-	if err != nil {
-		return fmt.Errorf("update event status: %w", err)
-	}
-
 	balances, err := pg.NewBalances(db).FilterByNullifier(nullifiers...).Select()
 	if err != nil {
 		return fmt.Errorf("failed to select balances for claim passport scan event: %w", err)
@@ -169,6 +163,26 @@ func claimReferralSpecificEvents(db *pgdb.DB, types evtypes.Types, levels config
 		return errors.New("critical: events present, but no balances with nullifier")
 	}
 
+	toClaim := make([]string, 0, len(events))
+	// select events to claim only for verified balances
+	for _, event := range events {
+		for _, balance := range balances {
+			if event.Nullifier != balance.Nullifier || !balance.IsVerified {
+				continue
+			}
+			toClaim = append(toClaim, event.ID)
+			break
+		}
+	}
+	if len(toClaim) == 0 {
+		return nil
+	}
+
+	_, err = pg.NewEvents(db).FilterByID(toClaim...).Update(data.EventClaimed, nil, &evType.Reward)
+	if err != nil {
+		return fmt.Errorf("update event status: %w", err)
+	}
+
 	for _, balance := range balances {
 		err = handlers.DoClaimEventUpdates(
 			levels,