From 36ddd5eae55074d8efd0b2ce714b17179bdb7038 Mon Sep 17 00:00:00 2001
From: Andy Balaam <andy.balaam@matrix.org>
Date: Mon, 30 Mar 2026 14:32:51 +0100
Subject: [PATCH] Ensure the incoming verification request appears above the
 please verify prompt (#32931)

---
 .../e2e/crypto/device-verification.spec.ts       | 16 +++++++++++++---
 apps/web/src/toasts/SetupEncryptionToast.tsx     |  7 ++++++-
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/apps/web/playwright/e2e/crypto/device-verification.spec.ts b/apps/web/playwright/e2e/crypto/device-verification.spec.ts
index 6beda36a98..1a1731e6ae 100644
--- a/apps/web/playwright/e2e/crypto/device-verification.spec.ts
+++ b/apps/web/playwright/e2e/crypto/device-verification.spec.ts
@@ -270,10 +270,9 @@ test.describe("Device verification", { tag: "@no-webkit" }, () => {
         await checkDeviceIsConnectedKeyBackup(app, expectedBackupVersion, true);
     }
 
-    test("Handle incoming verification request with SAS", async ({ page, credentials, homeserver, toasts }) => {
+    test("Handle incoming verification request with SAS", async ({ page, credentials, homeserver, toasts, app }) => {
+        /* Log in but don't verify the device */
         await logIntoElement(page, credentials);
-
-        /* Dismiss "Verify this device" */
         const authPage = page.locator(".mx_AuthPage");
         await authPage.getByRole("button", { name: "Skip verification for now" }).click();
         await authPage.getByRole("button", { name: "I'll verify later" }).click();
@@ -281,6 +280,17 @@ test.describe("Device verification", { tag: "@no-webkit" }, () => {
         await page.waitForSelector(".mx_MatrixChat");
         const elementDeviceId = await page.evaluate(() => window.mxMatrixClientPeg.get().getDeviceId());
 
+        /* Create an encrypted room so the "Verify this device" toast appears */
+        await app.client.createRoom({
+            initial_state: [
+                {
+                    type: "m.room.encryption",
+                    state_key: "",
+                    content: { algorithm: "m.megolm.v1.aes-sha2" },
+                },
+            ],
+        });
+
         /* Now initiate a verification request from the *bot* device. */
         const botVerificationRequest = await aliceBotClient.evaluateHandle(
             async (client, { userId, deviceId }) => {
diff --git a/apps/web/src/toasts/SetupEncryptionToast.tsx b/apps/web/src/toasts/SetupEncryptionToast.tsx
index 5f75bd538a..c021f1370d 100644
--- a/apps/web/src/toasts/SetupEncryptionToast.tsx
+++ b/apps/web/src/toasts/SetupEncryptionToast.tsx
@@ -365,7 +365,12 @@ export const showToast = (state: DeviceStateForToast): void => {
             overrideWidth: state === "key_storage_out_of_sync" ? "366px" : undefined,
         },
         component: GenericToast,
-        priority: state === "verify_this_session" ? 95 : 40,
+        // verify_this_session is more important than most toasts, but
+        // needs to appear below an incoming verification request, so we can fix
+        // the problem by accepting it.
+        //
+        // Other states are less urgent.
+        priority: state === "verify_this_session" ? 85 : 40,
     });
 };