I'm not sure because I haven't tested it. Duplicate files do not make sense at all. You will never ever need more than one record of a user having permissions to download files. If you're selling one month and they have 10 days left, it's only fair that they'll have 40 days if they buy it again. (assuming the month is 30 days)

That said, the code probably WILL do just that (operate on the first result from the db). Like I said though, I haven't tested it because starting from now, dupes are a thing of the past.