[T3481] FIX: guard the auth forms against a double submit

my_compassion/static/src/js/my2_auth_submit_guard.js

@@ -0,0 +1,51 @@
+/* The auth POSTs can take seconds with no feedback, and a second tap fails CSRF
+   and shows a 400 over the reset that already succeeded (T3481). */
+(function () {
+    "use strict";
+
+    const AUTH_PATHS = ["/web/login", "/web/signup", "/web/reset_password"];
+    const RELEASE_MS = 15000;
+
+    if (!AUTH_PATHS.some((path) => window.location.pathname.endsWith(path))) {
+        return;
+    }
+
+    let pending = null;
+
+    function release() {
+        if (pending) {
+            pending.querySelectorAll("button").forEach((button) => button.classList.remove("disabled"));
+            pending = null;
+        }
+    }
+
+    function showNativeLoader() {
+        const webkitHandlers = window.webkit && window.webkit.messageHandlers;
+        if (window.nativeLoader) {
+            window.nativeLoader.postMessage("show");
+        } else if (webkitHandlers && webkitHandlers.nativeLoader) {
+            webkitHandlers.nativeLoader.postMessage("show");
+        }
+    }
+
+    document.addEventListener(
+        "submit",
+        function (ev) {
+            if (pending) {
+                ev.preventDefault();
+                return;
+            }
+            pending = ev.target;
+            // Bootstrap dims a .disabled button and stops it taking taps.
+            pending.querySelectorAll("button").forEach((button) => button.classList.add("disabled"));
+            showNativeLoader();
+            // A navigation that never commits fires no event, so the form can
+            // only free itself once no response can plausibly still arrive.
+            window.setTimeout(release, RELEASE_MS);
+        },
+        true
+    );
+
+    // Restored from the back/forward cache: the form is live again.
+    window.addEventListener("pageshow", release);
+})();

my_compassion/templates/my2_assets.xml

@@ -7,6 +7,7 @@
     <template id="my_compassion_assets" name="My Compassion 2.0 assets" inherit_id="website.assets_frontend">
         <xpath expr="." position="inside">
             <script type="text/javascript" src="/my_compassion/static/src/js/toast_notification.js" />
+            <script type="text/javascript" src="/my_compassion/static/src/js/my2_auth_submit_guard.js" />
             <script type="text/javascript" src="/my_compassion/static/src/js/toast_service.js" />
             <script type="text/javascript" src="/my_compassion/static/src/js/my2_child_letters.js" />
             <script type="text/javascript" src="/my_compassion/static/src/js/my2_donation_form.js" />