From aa76c3be27c65ca3b2d8ef88d7ffe5e9d8660fc4 Mon Sep 17 00:00:00 2001
From: Ayush <135319056+ayussh-2@users.noreply.github.com>
Date: Tue, 14 Jul 2026 13:35:09 +0530
Subject: [PATCH] =?UTF-8?q?fix(login):=20keep=20submit=20button=20disabled?=
 =?UTF-8?q?/loading=20during=20password=20set=20r=E2=80=A6=20(#12429)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

- On Login V2 after a user sets their password during the invite or
reset-password flows and clicks continue,
there is a few seconds delay before the redirect occurs because no
loading spinner is visible on the button
during this delay users assume nothing happened and click continue
again.
- Clicking the button again starts a duplicate form submission. Since
the first request was already fired the second request triggers an error
right before the redirect from the first request completion creating a
bad user experience

# How the Problems Are Solved

- Kept the `loading` state active `true` throughout the lifeline of the
request which includes the 2-second database consistency delay and the
subsequent `sendPassword` verification request.
- Added `setLoading(false)` calls only in early-return error handling
blocks and at the end of the
redirection flow ensuring the button remains disabled and shows the
spinner until the redirect happens.

# Additional Changes

- None

# Additional Context

- Solves  #12416

Co-authored-by: Max Peintner <max@caos.ch>
---
 .../src/components/set-password-form.tsx      | 29 +++++++++----------
 1 file changed, 13 insertions(+), 16 deletions(-)

diff --git a/apps/login/src/components/set-password-form.tsx b/apps/login/src/components/set-password-form.tsx
index 860f21e42..e363596fd 100644
--- a/apps/login/src/components/set-password-form.tsx
+++ b/apps/login/src/components/set-password-form.tsx
@@ -101,21 +101,20 @@ export function SetPasswordForm({
       payload = { ...payload, code: values.code };
     }
 
-    const changeResponse = await changePassword(payload)
-      .catch(() => {
-        setError(t("set.errors.couldNotSetPassword"));
-        return;
-      })
-      .finally(() => {
-        setLoading(false);
-      });
+    const changeResponse = await changePassword(payload).catch(() => {
+      setError(t("set.errors.couldNotSetPassword"));
+      setLoading(false);
+      return;
+    });
 
     if (changeResponse && "error" in changeResponse) {
+      setLoading(false);
       setError(changeResponse.error);
       return;
     }
 
     if (!changeResponse) {
+      setLoading(false);
       setError(t("set.errors.couldNotSetPassword"));
       return;
     }
@@ -138,15 +137,13 @@ export function SetPasswordForm({
         password: { password: values.password },
       }),
       requestId,
-    })
-      .catch(() => {
-        setError(t("set.errors.couldNotVerifyPassword"));
-        return;
-      })
-      .finally(() => {
-        setLoading(false);
-      });
+    }).catch(() => {
+      setError(t("set.errors.couldNotVerifyPassword"));
+      setLoading(false);
+      return;
+    });
 
+    setLoading(false);
     handleServerActionResponse(passwordResponse as any, router, setSamlData, setError);
 
     return;