From 22c33161096af664b495bd5b8317eba91eaac989 Mon Sep 17 00:00:00 2001
From: jelveh <nj@puter.com>
Date: Mon, 31 Aug 2026 20:07:47 -0700
Subject: [PATCH] Hide app landing after session restore

Remove the /app landing overlay once `whoami` confirms the user is authenticated, even if the server rendered the page as anonymous because the session cookie was missing. This prevents the overlay from covering the email, phone, and card verification gates during localStorage-based session restores.
---
 src/gui/src/initgui.js | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/gui/src/initgui.js b/src/gui/src/initgui.js
index 889dc1460..911dccfef 100644
--- a/src/gui/src/initgui.js
+++ b/src/gui/src/initgui.js
@@ -1963,6 +1963,18 @@ window.initgui = async function (options) {
         }
         // update local user data
         if (whoami) {
+            // The server renders the /app/<name> landing overlay only for
+            // requests it saw as anonymous, but its only signal is the session
+            // cookie — which can be gone (e.g. browser restart) while the
+            // localStorage session is still valid. whoami just proved this is
+            // a logged-in user, so drop the overlay. This must happen before
+            // the verification gates below: the overlay's max z-index would
+            // cover them.
+            const app_landing = document.getElementById('appLanding');
+            if (app_landing) {
+                app_landing.classList.add('fade-out');
+                setTimeout(() => app_landing.remove(), 600);
+            }
             // Verification gates run in order: email → phone (SMS) → card,
             // matching the server-side order in assertVerifiedAccount.
             if (whoami.requires_email_confirmation) {