[jrollinson]

Problem

The TOTP form auto-submits when the sixth digit is entered (#790), but a follow-up Enter keypress or a password-manager form submit still triggers a second POST /api/user/totp. The first request consumes the pending TOTP session, so the duplicate gets 401 (TOTP verification attempt without pending TOTP session) and the mutation's onError raises the verification-failed toast during the 500 ms window before the redirect — users see a false "verification failed" after every successful TOTP login.

The login form has the same unguarded path: password autofill plus Enter double-submits POST /api/user/login, creating extra pending TOTP sessions and counting against auth.loginMaxRetries rate limiting.

Observed on a self-hosted v5.2.0 deployment: server logs show a trailing POST /api/user/totp 401 after every successful verification, and doubled POST /api/user/login 200s in the same second.

Fix

Ignore form submissions while the mutation is pending or after it succeeded (retry after a failed verification still works) — applied to both TotpPage and LoginPage, covering the auto-submit, Enter, and external submit-button paths. The auto-submit UX from #790 is untouched.

Verification

• tsc -b and vite build pass
• Root cause traced through totp-page.tsx / login-page.tsx / auth_service.go (a successful verification flips totp_pending off, so the duplicate POST can only answer 401)
• Playwright e2e not run

AI disclosure

Per AI_POLICY.md: this patch was drafted with AI assistance. It is small (2 files), and the account holder is reviewing and taking ownership of it before this PR leaves draft status.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}