LG-13138 Avoid sending account reset notification on duplicate submission

[kevinsmaster5]

🎫 Ticket

Link to the relevant ticket:
LG-13138

🛠 Summary of changes

Updates the "Yes, continue..." button to use a simple_form component adding built-in protection against double clicking the button.

Set the rate limiter timing to 2 minutes so the page response will have time to finish POSTing regardless of multiple button mashing and slow connection. If the user ended up needing to re-submit a request the limiter should expire by the time they return there.

📜 Testing Plan

Provide a checklist of steps to confirm the changes.

• Go to http://localhost:3000
• Sign in with email and password
• When prompted for MFA, click "Choose another authentication method"
• click "delete your account"
• On the "Are you sure.." page click Delete my account
• Emulate a slow connection https://developer.chrome.com/docs/devtools/network/reference#throttling
• Click "Yes, continue deletion" a bunch of times

The simulated email pop up should only appear once and not every time you clicked.

[mdiarra3]

looks good can u add a test

[jmdembe]

Changes make sense.

[mitchellhenke]

Mentioned here, but I think a more comprehensive mitigation is needed based on reading the ticket

[kevinsmaster5]

I have added rate limiting with d4577ff
I left in the UI change so I think unless they have JS turned off they'll never hit the rate limit but it's there as an additional stopgap.

[kevinsmaster5]

looks good can u add a test
Test added with 1543f16

[mdiarra3]

what happens if account reset request isnt created? right now it looks like we take them to account reset confirm, this could cause confusion for users that may hit this limit naturally especially if its 2 requests per 2 days.

[kevinsmaster5]

I set the limiter to 2 minutes because the real world thing this is trying to prevent (the controller not POSTing in time with button mashing) I expect should be over by then. 542a916

[mitchellhenke]

I don't have strong opinions on what the values here should be, but it should be monitored for potential adjustments

[mdiarra3]

LGTM