# Settings

The settings hub and the logins management screen.

---

## Settings Hub — `SettingsFragment`

A simple preference-list screen with navigation links to sub-sections (order as defined in `SettingsFragment.kt:26-33`):

| Entry | Destination |
|---|---|
| Logins | `SettingsLoginsFragment` |
| Appearance | `SettingsAppearanceFragment` |
| Privacy & Security | `SettingsSecurityFragment` |
| Notifications | `SettingsNotificationsFragment` |
| Storage | `SettingsStorageFragment` |
| About | `SettingsAboutFragment` |

---

## Logins — `SettingsLoginsFragment`

Manages all connected bank accounts and profiles.

### Account List

Each connected login is shown as a card. Within each login card, individual profiles (CIF profiles for MIB, or the single account for BML/Fahipay) are listed.

Each profile entry shows:
- Profile name / CIF type
- Account number(s)
- Profile image (circular avatar)
- Visibility toggle switch

### Login Order

All logins are shown as one list, across banks. When there is more than one login, each row gets a three-line handle (`ic_reorder_lines`) on the right; press and drag it to move the login up or down (`SettingsLoginsFragment.attachDragHandle()`). Tapping the rest of the row still opens the login details.

On drop the order is saved with `CredentialStore.setLoginOrder()`, which:
- writes the combined order to the `login_order` pref as a JSON array of login tags (`mib_<id>`, `bml_<id>`, `fahipay_<id>`, `mfaisa_<id>` — the same format as `BankAccount.loginTag`)
- rewrites each bank's own list (`mib_login_ids`, `bml_login_ids`, …) in the same relative order, so code that walks one bank's logins stays consistent

It then calls `HomeViewModel.resortByLoginOrder()` so already-open screens re-sort immediately.

`CredentialStore.getLoginOrder()` returns the effective order: saved tags that still exist, followed by any logins not yet ordered (e.g. newly added) in the default MIB → BML → Fahipay → M-Faisa order. `loginRank()` turns that into a sort key; unknown tags sort last.

See [Login Order](00-app-overview.md#login-order) for where the order is applied.

### Visibility Toggle

Toggling a profile off hides it from the accounts list and excludes it from API refresh cycles. The session is kept alive — the profile can be re-enabled without re-logging in.

### Profile Image

A pencil icon (`ic_edit`) next to each profile opens an image chooser:
- **Gallery** — pick from device photo library
- **Camera** — capture via device camera (temp file: `cacheDir/profile_photo_tmp.jpg`)

Profile images are stored locally via `ProfileImageStore`:
- BML: key `bml_{profileId}`
- Fahipay: key `fahipay_{loginId}`
- MIB: uploaded to the MIB server via profile image API (P40); retrieved via hash (P41); deleted via P42

### Add Account

A **+** (Add) button navigates to `LoginActivity` → `BankSelectionFragment` to add a new bank login.

### Logout

A **Logout** button on each login card shows a confirmation dialog. On confirm:
- Session tokens are revoked where supported
- Credentials are removed from `CredentialStore`
- All associated `BankAccount` objects are removed from `BasedBankApp`
- The accounts list is refreshed

### BML Business Profile Activation

For inactive BML business profiles, an **Activate** button kicks off the OTP-channel selection (email / SMS) and OTP confirmation flow — see `SettingsLoginsFragment.kt:572, 722 activateBmlBusinessProfile()` and [Business Profile OTP](../bmlapi/02-business-otp.md).

### OTP Seed

OTP seeds (MIB and BML business) are imported **during initial login** in `CredentialsFragment` — either by scanning the `otpauth://` QR or pasting the raw seed. The seed is stored encrypted in `CredentialStore` and used by the [OTP Screen](10-otp-screen.md). To replace a seed, remove the login and re-add it.

---

&nbsp;

---

[← Financing](13-financing.md) &nbsp;&nbsp;&nbsp; **Next →** [Settings — Security](15-settings-security.md)