Prevent concurrent login submissions

[guerricv]

Description

Repeated Enter presses, clicks or YubiKey events can start overlapping login requests while an earlier attempt is still pending. This change allows one submission at a time and gives the form a consistent busy state.

• Lock submitted fields and controls until the attempt completes; restore their previous state after refusal, a network error or an MFA challenge.
• Keep the lock through session-key renewal and credential replay, and wait for an already-running background session check before submitting.
• Preserve the lock during successful login and Duo/OAuth2 redirects; reload a locked page restored by browser Back navigation.
• Add 40 JavaScript regression tests, a dedicated CI job and a manual authentication checklist, using Node.js built-ins only.

Server-side credential validation and brute-force controls are unchanged. Completed attempts can be retried immediately; no artificial delay is introduced.

Related issue

None. General login-form hardening.

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (existing behaviour changes)
• Documentation
• Translation
• Refactor / maintenance

How has this been tested?

All CI checks passed for commit 54b81982b2f7b482681da191863594fd7248751a.

• Quality workflow:
  • PHP 8.2 and 8.3: 1,712 tests and 59,377 assertions passed on each version.
  • Login JavaScript: 40 tests passed with Node.js 22.
  • PHPStan level 4: passed.
  • Production-autoloader and table-prefix guards: passed.
• CodeQL workflow: JavaScript/TypeScript and GitHub Actions analyses passed; the CodeQL PR check also passed.
• Scrutinizer: no new issues; tests passed.

Local checks also passed: 40 JavaScript tests, 94 targeted PHP 8.2 authentication tests (245 assertions), PHPStan level 4, PHP syntax validation on 8.2/8.3, and git diff --check.

The JavaScript suite executes the shipped login code with simulated controls, HTTP responses, navigation and timers. It covers duplicate events, failures, MFA, redirects and session renewal.

Live browser/provider validation remains to be completed: local/LDAP login, Google/YubiKey MFA, Duo/OAuth2 redirects and callbacks, browser Back navigation and expired sessions. Administrator/non-administrator redirects are simulated; live manager/standard/read-only roles, personal folders on/off and audit-log creation have not been exercised. See tests/JavaScript/README.md for the manual checklist.

Checklist

• PHPStan level 4 passes (php app/vendor/bin/phpstan analyse --memory-limit=2G)
• The test suite passes (php _tools/phpunit.phar — see CONTRIBUTING.md for the one-time setup)
• Every new public function has a docblock
• Variable names and comments are in English
• No var_dump() or console.log() left in the code — no new debugging statements; existing guarded logging is unchanged.
• New app/sources/*.queries.php files have a matching public/sources/ proxy shim — not applicable, no new handlers.
• Changes to teampassclasses were applied to both copies (app/includes/libraries/ and app/vendor/) — not applicable, no class changes.
• app/vendor/composer/ is in its production form (git checkout -- app/vendor/composer/)

Impact on install / upgrade

• No schema change
• Schema change — an install/upgrade_run_X.X.X.php script is included and the fresh install path was tested

No installer or upgrade migration is needed.

Screenshots

Not captured locally. The change concerns the form's busy state and submission lifecycle; browser validation is listed above.