fix(ui): remove duplicate onclick handler causing double-click for CA cert upload (#4090)

* fix(ui): remove duplicate onclick handler causing double-click for CA cert upload

Fixes #3558

The CA certificate upload drop zone had both an inline onclick attribute
and a JavaScript event listener (initializeCACertUpload), causing the
file selection dialog to open twice.

Removed the inline onclick handler since initializeCACertUpload() already
provides complete functionality including click-to-upload, drag-and-drop,
and visual feedback.

Signed-off-by: Vishu Bhatnagar <vishu.bhatnagar@ibm.com>

* fix(ui): prevent multiple event listener registrations for CA cert upload

The initializeCACertUpload() function is called multiple times:
- On DOMContentLoaded
- After 500ms delay
- When switching to gateways tab

Each call was adding new event listeners without removing old ones,
causing multiple click handlers to accumulate and trigger the file
dialog multiple times.

Added initialization guard using data-initialized attribute to prevent
duplicate event listener registrations.

Signed-off-by: Vishu Bhatnagar <vishu.bhatnagar@ibm.com>

* feat: secrets updated

Signed-off-by: Vishu Bhatnagar <vishu.bhatnagar@ibm.com>

* test(ui): cover CA cert upload double-init guard

Add a regression test that calls initializeCACertUpload() twice on the
same drop zone and asserts the click listener is only attached once, so
the file picker opens a single time.

Also refresh the detect-secrets baseline so generated_at and line
numbers match the rebased tree.

Signed-off-by: Jonathan Springer <jps@s390x.com>

---------

Signed-off-by: Vishu Bhatnagar <vishu.bhatnagar@ibm.com>
Signed-off-by: Jonathan Springer <jps@s390x.com>
Co-authored-by: Jonathan Springer <jps@s390x.com>

Author: vishu-bh

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "^.secrets.baseline|package-lock.json|Cargo.lock|scripts/sign_image.sh|scripts/zap|sonar-project.properties|uv.lock|^.secrets.baseline$",
     "lines": null
   },
-  "generated_at": "2026-04-11T12:17:13Z",
+  "generated_at": "2026-04-11T13:00:03Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -6288,7 +6288,7 @@
         "hashed_secret": "b4e44716dbbf57be3dae2f819d96795a85d06652",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 12461,
+        "line_number": 12460,
         "type": "Secret Keyword",
         "verified_result": null
       }

mcpgateway/admin_ui/caCertificate.js

@@ -314,6 +314,12 @@ export const initializeCACertUpload = function () {
   const fileInput = safeGetElement("upload-ca-certificate");
 
   if (dropZone && fileInput) {
+    // Prevent multiple initializations
+    if (dropZone.dataset.initialized === "true") {
+      return;
+    }
+    dropZone.dataset.initialized = "true";
+
     // Click to upload
     dropZone.addEventListener("click", function (e) {
       fileInput.click();

mcpgateway/templates/admin.html

@@ -6033,7 +6033,6 @@ <h3 class="text-lg font-bold mb-4 dark:text-gray-200">
               <div
                 id="ca-certificate-upload-drop-zone"
                 class="border-2 border-dashed border-gray-300 dark:border-gray-600 rounded-lg p-6 text-center hover:border-gray-400 dark:hover:border-gray-500 cursor-pointer"
-                onclick="Admin.safeGetElement('upload-ca-certificate').click()"
               >
                 <div class="space-y-2">
                   <svg

tests/unit/js/caCertificate.test.js

@@ -279,6 +279,21 @@ describe("initializeCACertUpload", () => {
     expect(() => initializeCACertUpload()).not.toThrow();
   });
 
+  test("does not re-attach listeners when called twice on the same drop zone", () => {
+    const { dropZone, fileInput } = setupDropZone();
+    const addSpy = vi.spyOn(dropZone, "addEventListener");
+
+    initializeCACertUpload();
+    initializeCACertUpload();
+
+    const clickCalls = addSpy.mock.calls.filter((c) => c[0] === "click");
+    expect(clickCalls).toHaveLength(1);
+
+    const clickSpy = vi.spyOn(fileInput, "click");
+    dropZone.click();
+    expect(clickSpy).toHaveBeenCalledTimes(1);
+  });
+
   test("click on drop zone triggers file input click", () => {
     const { dropZone, fileInput } = setupDropZone();
     initializeCACertUpload();