feat: Add option otpAutoSubmit to control auto-submitting the login form after entering a one-time password

[sonivaidehi]

Pull Request

• Report security issues confidentially.
• Any contribution is under this license.

Issue

When a user has MFA enabled, the login form is submitted automatically as soon as the entered one-time password reaches the expected length. This was introduced in e528705 (#2257) and is currently hardcoded with no way to opt out.

That is convenient in the common case, but there is no way to disable it, and the behavior is problematic in a few situations:

• A single mistyped digit submits immediately; the user cannot review or correct the code before submitting.
• The failed attempt causes a full page reload, so the user has to re-enter the one-time password from scratch — and by then the TOTP window may have advanced.
• Assistive technology and password managers that fill the field progressively can trigger a submit mid-fill.

There is currently no configuration option to turn this off.

Approach

Adds a new root-level dashboard option otpAutoSubmit (Boolean, default true) that controls whether the login form is auto-submitted once a complete one-time password has been entered.

• true / omitted — current behavior, unchanged. This is fully backwards compatible; existing installations are not affected.
• false — the one-time password field no longer triggers a submit; the user submits the form manually.

The option is plumbed to the login page following the existing enableResourceCache pattern, which is the established way this repository passes configuration to frontend code:

1. Parse-Dashboard/app.js — the /login route injects PARSE_DASHBOARD_OTP_AUTO_SUBMIT into the page shell, next to the existing PARSE_DASHBOARD_PATH global. The check is config.otpAutoSubmit === false rather than a truthy test, so that only an explicit false disables the feature and any other value (including an absent key) keeps the current default.
2. src/login/Login.js — reads the global once in the constructor as window.PARSE_DASHBOARD_OTP_AUTO_SUBMIT !== false and adds it to the existing auto-submit guard in updateField. Defaulting to true when the global is undefined keeps the component behaving correctly if it is ever mounted outside the server-rendered shell.

The auto-submit mechanism itself is deliberately left untouched to keep the diff minimal and easy to review; this PR only gates it.

Because the option is a plain root-level config key, it works across all integration styles with no extra plumbing — the Express middleware (new ParseDashboard({ otpAutoSubmit: false, ... })), a --config file, and the PARSE_DASHBOARD_CONFIG environment variable. No new CLI flag or environment variable is introduced.

Example configuration:

{
  "apps": [{ "...": "..." }],
  "otpAutoSubmit": false,
  "users": [
    {
      "user": "user1",
      "pass": "pass",
      "mfa": "lmvmOIZGMTQklhOIhveqkumss"
    }
  ]
}

Tasks

• Add tests
• Add changes to documentation (guides, repository pages, in-code descriptions)

Tests

src/lib/tests/OtpAutoSubmit.test.js mounts the dashboard over a real HTTP server and asserts the value rendered into the login page for all three states — option omitted, true, and false. It follows the existing src/lib/tests/RemoteAccess.test.js pattern.

Note that Jest roots is limited to src/lib and no jsdom environment is configured for this suite, so the flag is verified at the server-rendered boundary rather than by rendering the React component.

Documentation

• Added otpAutoSubmit to the Root Options table in README.md.
• Added a paragraph with an example to the Multi-Factor Authentication (One-Time Password) section describing the current auto-submit behavior and how to disable it.

Summary by CodeRabbit

• New Features

  • Added the otpAutoSubmit login configuration option, enabled by default.
  • Administrators can disable automatic form submission after a complete one-time password is entered.

• Documentation

  • Documented the new OTP login setting and configuration example.

• Tests

  • Added coverage for enabled, disabled, and default OTP auto-submit behavior.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. Our CI and AI review are safeguards, not development tools. If many issues are flagged, rethink your development approach. Invest more effort in planning and design rather than using review cycles to fix low-quality code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 8018ec86-a40a-4131-92fa-7ac5a8753d80

📥 Commits

Reviewing files that changed from the base of the PR and between 33a37e4 and 910ac51.

📒 Files selected for processing (4)

• Parse-Dashboard/app.js
• README.md
• src/lib/tests/OtpAutoSubmit.test.js
• src/login/Login.js

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

The dashboard adds the otpAutoSubmit option. The login page defaults to automatic OTP submission and supports manual submission when the option is false. Tests and README documentation cover the behavior.

Changes

OTP auto-submit

Layer / File(s)	Summary
Configuration propagation and validation Parse-Dashboard/app.js, src/lib/tests/OtpAutoSubmit.test.js, README.md	The login page exposes PARSE_DASHBOARD_OTP_AUTO_SUBMIT. The option defaults to true, supports false, and has HTTP coverage and documentation.
Conditional OTP submission src/login/Login.js	The login form submits a complete OTP automatically only when otpAutoSubmit is enabled.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 910ac

This adds a documented OTP auto-submit setting while preserving automatic submission by default; disabling it requires manual form submission. No current merge-blocking risk remains.

Sequence Diagram(s)

sequenceDiagram
  participant DashboardConfig
  participant LoginPage
  participant User
  participant LoginForm
  DashboardConfig->>LoginPage: embed OTP auto-submit setting
  LoginPage->>LoginForm: initialize login behavior
  User->>LoginForm: enter complete OTP
  LoginForm->>LoginForm: submit automatically when enabled

Loading

Suggested reviewers: mtrezza, dblythy

🚥 Pre-merge checks | ✅ 6 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 3 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (6 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	PASS. The pull request only gates the existing client-side OTP form submission. The server still validates the OTP and protects POST /login with CSRF middleware and Passport authentication. The new …
Engage In Review Feedback	✅ Passed	PASS: The check is not triggered because the pull request has no review feedback to engage with. GitHub PR #3448 reports 0 review comments; the reviews endpoint returns no submitted reviews, and the o…
Title check	✅ Passed	The title begins with the allowed feat: prefix and uses a capitalized first word. It clearly describes the new otpAutoSubmit option.
Description check	✅ Passed	The description includes the required Pull Request, Issue, Approach, and Tasks sections. It explains the change, documents compatibility, and marks tests and documentation as complete.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 3 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[sonivaidehi]

@mtrezza Could you please approve the ci workflow run so the workflows can execute? Thanks!
Run: https://github.com/parse-community/parse-dashboard/actions/runs/33729468029