From 5342f891f39f1088049436a38ec51aca52a5e032 Mon Sep 17 00:00:00 2001
From: Bryan Richter <b@chreekat.net>
Date: Sat, 14 May 2016 15:40:07 -0700
Subject: [PATCH] Add key reuse warning (#1222) (#1233)

---
 yesod-auth/Yesod/Auth/Email.hs | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/yesod-auth/Yesod/Auth/Email.hs b/yesod-auth/Yesod/Auth/Email.hs
index 88bba70f..c7e26db9 100644
--- a/yesod-auth/Yesod/Auth/Email.hs
+++ b/yesod-auth/Yesod/Auth/Email.hs
@@ -142,6 +142,12 @@ class ( YesodAuth site
 
     -- | Verify the email address on the given account.
     --
+    -- __/Warning!/__ If you have persisted the @'AuthEmailId' site@
+    -- somewhere, this method should delete that key, or make it unusable
+    -- in some fashion. Otherwise, the same key can be used multiple times!
+    --
+    -- See <https://github.com/yesodweb/yesod/issues/1222>.
+    --
     -- Since 1.1.0
     verifyAccount :: AuthEmailId site -> HandlerT site IO (Maybe (AuthId site))