Ensure we dont return already claimed token again (#3420)

certificate/authorization/service.go

@@ -47,9 +47,12 @@ func (service *Service) GetOrCreate(ctx context.Context, userID string) (_ *Toke
 	}
 
 	if existingGroup != nil && len(existingGroup) > 0 {
-		authorization := existingGroup[0]
+		for _, authorization := range existingGroup {
+			if authorization.Claim == nil {
 				return &authorization.Token, nil
 			}
+		}
+	}
 
 	createdGroup, err := service.db.Create(ctx, userID, 1)
 	if err != nil {