# App Overview

Architecture overview of the app's entry point, main container, navigation system, and global session lifecycle.

---

## Entry Point — `MainActivity`

`MainActivity` is a transparent trampoline activity. On `onCreate` it reads app state and immediately forwards to the correct destination with no visible UI of its own:

| Condition | Destination |
|---|---|
| Onboarding not done | `OnboardingActivity` |
| No saved credentials | `LoginActivity` |
| Security lock configured | `LockActivity` |
| All checks pass | `HomeActivity` |

### Intent Actions

External intents (from NFC, shortcuts, or notifications) are passed through to `HomeActivity` via the same forwarding intent:

| Action | Effect |
|---|---|
| `OPEN_TRANSFER` | Opens transfer screen |
| `OPEN_SCAN_QR` | Opens QR scanner |
| `OPEN_PAY_WITH_CARD` | Opens BML card QR payment |
| `TAP_TO_PAY` | Opens BML tap-to-pay NFC flow |

`BmlTapToPayActivity` is a dedicated NFC entry point registered in the manifest. It immediately re-fires a `TAP_TO_PAY` intent to `MainActivity` and finishes.

---

## Main Container — `HomeActivity`

`HomeActivity` is the persistent shell containing all in-app screens. It owns:

- The `NavHostFragment` and `NavController`
- The `DrawerLayout` and `NavigationView`
- The `BottomNavigationView`
- The toolbar (lock icon + hide-amounts eye icon)
- The connectivity banner
- The autolock timer
- The MIB session keepAlive scheduler

### Toolbar

| Icon | Behavior |
|---|---|
| Lock icon | Immediately locks the app → `LockActivity` (animated with scale + alpha) |
| Eye icon | Toggles `hideAmounts` in `HomeViewModel`; all balance displays redact to `••••` |

### Auto-refresh

On launch and after unlock `HomeActivity.autoRefresh()` fires parallel login refresh calls for all banks with active sessions. Each bank runs independently — a failure in one bank does not block the others.

### Connectivity Banner

A persistent banner appears at the top of `HomeActivity` when network connectivity is lost. It disappears automatically when connectivity is restored. Per-bank connectivity errors (e.g., session expired) are surfaced via `HomeViewModel.connectivityErrors`.

---

## Navigation Modes

The user can choose between two navigation modes in Settings → Appearance:

### Drawer (default)

A slide-out navigation drawer containing up to 10 configurable nav items. The hamburger icon in the toolbar opens it.

### Bottom Navigation

A bottom bar with 3 configurable slots plus a fixed **Dashboard** tab (always leftmost) and a **More** tab (always rightmost). Tapping **More** opens `NavMoreSheetFragment` — a bottom sheet listing all items not assigned to the 3 visible slots.

---

## Navigation Slots

10 possible navigation destinations can be assigned to slots. The user reorders them via drag-and-drop in Settings → Appearance.

| Destination | Default slot |
|---|---|
| Accounts | 1 |
| Transfer | 2 |
| Activities | 3 |
| Contacts | 4 |
| Financing | 5 |
| OTP | 6 |
| PayMV QR | 7 |
| BML QR Pay | 8 |
| Transfer History | 9 |
| Settings | 10 |

Two **Quick Action** slots appear as FAB-style buttons on the dashboard and are independently configurable.

---

## Autolock

Autolock fires after a configurable period of user inactivity. Any touch event resets the timer.

| Timeout option |
|---|
| 30 seconds |
| 1 minute |
| 3 minutes |
| 5 minutes |
| Never |

When the timeout expires a 10-second countdown warning dialog appears. If dismissed, the timer resets. If ignored, the app calls `LockActivity` and clears `app.isUnlocked`.

---

## Global State — `BasedBankApp`

`BasedBankApp` holds all in-memory session data. Nothing is stored to disk except encrypted credentials.

| Field | Description |
|---|---|
| `isUnlocked` | Set to `true` after successful lock-screen auth; guards against process-restart bypass |
| `mibSessions` | Map of MIB profile ID → active session (cookies + DH key) |
| `bmlSessions` | Map of BML profile ID → OAuth token pair |
| `fahipaySessions` | Map of Fahipay login ID → authID + session cookie |
| `mibLoginFlows` | Active `MibLoginFlow` instances per profile |
| `bmlLoginFlows` | Active `BmlLoginFlow` instances per profile |
| `mibMutex` | Coroutine mutex — serializes all MIB API calls to prevent session corruption |

### Profile Visibility

Each stored profile has a visibility flag. Hidden profiles are excluded from the accounts list and from all API refresh cycles until re-enabled in Settings → Logins.

---

## MIB Session KeepAlive

MIB web sessions expire after approximately 30 seconds of inactivity. `HomeActivity` schedules a coroutine that calls the MIB keepAlive endpoint every 25 seconds for each active MIB session while the app is in the foreground.

---

 

---

[← README](README.md)     **Next →** [Onboarding](01-onboarding.md)