From 3bf83d40e9f163b0b72563234c3ecaedeabb036c Mon Sep 17 00:00:00 2001
From: Daniel Salazar <daniel.salazar@puter.com>
Date: Mon, 13 Jul 2026 21:47:11 -0400
Subject: [PATCH] fix: ui signup order (#3385)

---
 src/gui/src/UI/UIWindowSignup.js | 25 ++++++++++++++-----------
 src/gui/src/initgui.js           | 25 ++++++++++++++-----------
 2 files changed, 28 insertions(+), 22 deletions(-)

diff --git a/src/gui/src/UI/UIWindowSignup.js b/src/gui/src/UI/UIWindowSignup.js
index 1b868e183..70c6ed6dd 100644
--- a/src/gui/src/UI/UIWindowSignup.js
+++ b/src/gui/src/UI/UIWindowSignup.js
@@ -511,6 +511,20 @@ function UIWindowSignup(options) {
                             show_email_dialog
                         ) {
                             $(el_window).close();
+                            // Verification gates run in order: email →
+                            // phone (SMS) → card, matching the server-side
+                            // order in assertVerifiedAccount.
+                            if (show_email_dialog) {
+                                email_verified =
+                                    await UIWindowEmailConfirmationRequired({
+                                        stay_on_top: true,
+                                        has_head: true,
+                                        reload_on_success:
+                                            options.reload_on_success,
+                                        window_options:
+                                            options.window_options ?? {},
+                                    });
+                            }
                             if (data.user?.requires_phone_verification) {
                                 let phone_ok = false;
                                 do {
@@ -527,17 +541,6 @@ function UIWindowSignup(options) {
                                         );
                                 } while (!phone_ok);
                             }
-                            if (show_email_dialog) {
-                                email_verified =
-                                    await UIWindowEmailConfirmationRequired({
-                                        stay_on_top: true,
-                                        has_head: true,
-                                        reload_on_success:
-                                            options.reload_on_success,
-                                        window_options:
-                                            options.window_options ?? {},
-                                    });
-                            }
                             // Card verification is the last gate.
                             if (data.user?.requires_card_verification) {
                                 let card_ok = false;
diff --git a/src/gui/src/initgui.js b/src/gui/src/initgui.js
index 55d87cc33..75552a2df 100644
--- a/src/gui/src/initgui.js
+++ b/src/gui/src/initgui.js
@@ -1143,11 +1143,12 @@ window.initgui = async function (options) {
         }
 
         if (whoami) {
-            // is phone verification required? (hard gate for low-rep signups)
-            if (whoami.requires_phone_verification) {
+            // Verification gates run in order: email → phone (SMS) → card,
+            // matching the server-side order in assertVerifiedAccount.
+            if (whoami.requires_email_confirmation) {
                 let is_verified;
                 do {
-                    is_verified = await UIWindowPhoneVerificationRequired({
+                    is_verified = await UIWindowEmailConfirmationRequired({
                         show_close_button: false,
                         stay_on_top: true,
                         has_head: false,
@@ -1157,10 +1158,11 @@ window.initgui = async function (options) {
                     });
                 } while (!is_verified);
             }
-            if (whoami.requires_email_confirmation) {
+            // is phone verification required? (hard gate for low-rep signups)
+            if (whoami.requires_phone_verification) {
                 let is_verified;
                 do {
-                    is_verified = await UIWindowEmailConfirmationRequired({
+                    is_verified = await UIWindowPhoneVerificationRequired({
                         show_close_button: false,
                         stay_on_top: true,
                         has_head: false,
@@ -1394,11 +1396,12 @@ window.initgui = async function (options) {
         }
         // update local user data
         if (whoami) {
-            // is phone verification required? (hard gate for low-rep signups)
-            if (whoami.requires_phone_verification) {
+            // Verification gates run in order: email → phone (SMS) → card,
+            // matching the server-side order in assertVerifiedAccount.
+            if (whoami.requires_email_confirmation) {
                 let is_verified;
                 do {
-                    is_verified = await UIWindowPhoneVerificationRequired({
+                    is_verified = await UIWindowEmailConfirmationRequired({
                         show_close_button: false,
                         stay_on_top: true,
                         has_head: false,
@@ -1410,11 +1413,11 @@ window.initgui = async function (options) {
                     });
                 } while (!is_verified);
             }
-            // is email confirmation required?
-            if (whoami.requires_email_confirmation) {
+            // is phone verification required? (hard gate for low-rep signups)
+            if (whoami.requires_phone_verification) {
                 let is_verified;
                 do {
-                    is_verified = await UIWindowEmailConfirmationRequired({
+                    is_verified = await UIWindowPhoneVerificationRequired({
                         show_close_button: false,
                         stay_on_top: true,
                         has_head: false,