The OTP email whitelist tag input does not hydrate saved emails when loading the page. They are sent properly in the API response, so this is purely a UI bug.
The whitelist is saved properly and it does work - so the issue is just on the frontend, but it prevents being able to see which emails have been whitelisted, and makes it impossible to update the whitelist without re-entering everything from scratch again.
The cause is just that whitelistForm is redeclared in the OneTimePasswordFormSection component when it has already been declared in the ResourceAuthenticationPage component, and only the first instance is the one that gets hydrated with data. It instead either needs passed in as a prop, or some refactoring needs done to allow the form to properly live inside OneTimePasswordFormSectionwhile adding some new functionality to hydrate it.
Environment
Server:
OS Type & Version: Debian 13
Pangolin Version: CE 1.14.1
Client:
Firefox on MacOS (but I don't think it's a browser-specific issue - it happens in Chrome too).
To Reproduce
Simple reproduction:
Go to the authentication settings for a public resource
Add an email to the whitelist and save:
Refresh the page and notice the input is empty again:
Notice the data comes back as expected from the API call to whitelist, highlighting that it's a frontend issue:
Expected Behavior
I expect the saved email addresses to repopulate the tag input, so that you can see which emails are whitelisted and edit the list.
Originally created by @aptkingston on GitHub (Dec 31, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2190
Originally assigned to: @miloschwartz on GitHub.
### Describe the Bug
Firstly, thanks for making a great product!
The OTP email whitelist tag input does not hydrate saved emails when loading the page. They are sent properly in the API response, so this is purely a UI bug.
The whitelist is saved properly and it does work - so the issue is just on the frontend, but it prevents being able to see which emails have been whitelisted, and makes it impossible to update the whitelist without re-entering everything from scratch again.
The cause is just that `whitelistForm` is [redeclared in the `OneTimePasswordFormSection` component](https://github.com/fosrl/pangolin/blob/f7fcde8312063c534345f9674a8018867dbbe287/src/app/%5BorgId%5D/settings/resources/proxy/%5BniceId%5D/authentication/page.tsx#L792) when it has already been declared in the `ResourceAuthenticationPage` component, and only the first instance is the one that gets hydrated with data. It instead either needs passed in as a prop, or some refactoring needs done to allow the form to properly live inside `OneTimePasswordFormSection`while adding some new functionality to hydrate it.
### Environment
Server:
- OS Type & Version: Debian 13
- Pangolin Version: CE 1.14.1
Client:
Firefox on MacOS (but I don't think it's a browser-specific issue - it happens in Chrome too).
### To Reproduce
Simple reproduction:
- Go to the authentication settings for a public resource
- Add an email to the whitelist and save:
<img width="630" height="345" alt="Image" src="https://github.com/user-attachments/assets/e6cef33f-8820-4bff-b02a-b1bc6eb02569" />
- Refresh the page and notice the input is empty again:
<img width="655" height="339" alt="Image" src="https://github.com/user-attachments/assets/80ddaa0c-0327-431c-bf6f-14db5ca1ed54" />
- Notice the data comes back as expected from the API call to `whitelist`, highlighting that it's a frontend issue:
<img width="209" height="93" alt="Image" src="https://github.com/user-attachments/assets/9c713753-ad21-4946-b2c6-5105e6965a2c" />
### Expected Behavior
I expect the saved email addresses to repopulate the tag input, so that you can see which emails are whitelisted and edit the list.
GiteaMirror
added the bug label 2026-04-25 15:53:23 -05:00
<!-- gh-comment-id:3746856244 -->
@zerolith commented on GitHub (Jan 13, 2026):
Can confirm. This is irritating
- Safari on Mac
- Pangolin Version: CE 1.14.0 & 1.14.1
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @aptkingston on GitHub (Dec 31, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2190
Originally assigned to: @miloschwartz on GitHub.
Describe the Bug
Firstly, thanks for making a great product!
The OTP email whitelist tag input does not hydrate saved emails when loading the page. They are sent properly in the API response, so this is purely a UI bug.
The whitelist is saved properly and it does work - so the issue is just on the frontend, but it prevents being able to see which emails have been whitelisted, and makes it impossible to update the whitelist without re-entering everything from scratch again.
The cause is just that
whitelistFormis redeclared in theOneTimePasswordFormSectioncomponent when it has already been declared in theResourceAuthenticationPagecomponent, and only the first instance is the one that gets hydrated with data. It instead either needs passed in as a prop, or some refactoring needs done to allow the form to properly live insideOneTimePasswordFormSectionwhile adding some new functionality to hydrate it.Environment
Server:
Client:
Firefox on MacOS (but I don't think it's a browser-specific issue - it happens in Chrome too).
To Reproduce
Simple reproduction:
Go to the authentication settings for a public resource
Add an email to the whitelist and save:
Refresh the page and notice the input is empty again:
Notice the data comes back as expected from the API call to
whitelist, highlighting that it's a frontend issue:Expected Behavior
I expect the saved email addresses to repopulate the tag input, so that you can see which emails are whitelisted and edit the list.
@zerolith commented on GitHub (Jan 13, 2026):
Can confirm. This is irritating
@miloschwartz commented on GitHub (Jan 15, 2026):
Thanks. This will be fixed in the next release.