Fixed race condition when linking subscriptions

no-issue

Without forcing linkSubscription to run inside a transaction - it's
possible to have race conditions where it is called twice, and attempt
to insert duplicate rows into the database.

ghost/members-api/lib/repositories/member.js

@@ -519,6 +519,15 @@ module.exports = class MemberRepository {
         if (!this._stripeAPIService.configured) {
             throw new errors.BadRequestError(tpl(messages.noStripeConnection, {action: 'link Stripe Subscription'}));
         }
+
+        if (!options.transacting) {
+            return this._Member.transaction((transacting) => {
+                return this.linkSubscription(data, {
+                    ...options,
+                    transacting
+                });
+            });
+        }
         const member = await this._Member.findOne({
             id: data.id
         }, options);