package dev.privacyllc.period.core.datastore

import java.time.LocalTime

/**
 * How a reminder appears on a lock screen.
 *
 * This is the most consequential setting in the app. The likeliest real breach
 * of a user's privacy here is not a database compromise — it is a notification
 * read over a shoulder, or by whoever else picks the phone up.
 *
 * PRODUCT_PLAN.md §28. The user must choose [DIRECT] explicitly; it is never a
 * default and never a fallback.
 */
enum class NotificationPrivacy {
    /** "Quick check-in — something may be coming up." The default. */
    DISCREET,

    /** "Reminder", and nothing else. No health information of any kind. */
    MAXIMUM_PRIVACY,

    /** "Your period may start in 2 days." Only when explicitly chosen. */
    DIRECT,
}

enum class AppTheme { LIGHT, DARK, SYSTEM }

/**
 * Everything that is a setting rather than health history.
 *
 * Deliberately **not** in the cycle database. Different lifetime, different
 * sensitivity, and different deletion semantics: Delete My Data removes the
 * health history and must not reset the user's notification privacy choice to
 * a default they did not pick.
 */
data class UserPreferences(
    val notificationPrivacy: NotificationPrivacy = NotificationPrivacy.DISCREET,
    val reminderTime: LocalTime = DEFAULT_REMINDER_TIME,
    // §29 gives six types an INDEPENDENT toggle each. Folding them into one
    // "reminders" switch would make the common case — a period reminder and no
    // fertility notifications — impossible to express.
    val periodApproachingEnabled: Boolean = true,
    val periodExpectedTodayEnabled: Boolean = true,
    val didItStartEnabled: Boolean = true,
    val periodEndCheckInEnabled: Boolean = true,
    val fertileWindowReminderEnabled: Boolean = false,
    val ovulationReminderEnabled: Boolean = false,
    val biometricLockEnabled: Boolean = false,
    val theme: AppTheme = AppTheme.SYSTEM,
    val adsRemoved: Boolean = false,
    val onboardingCompleted: Boolean = false,
) {
    companion object {
        /**
         * Late morning, not 8am. A reminder that fires while somebody is on a
         * commuter train is a reminder read by strangers, and the whole point
         * of the privacy modes is that this app is careful about being seen.
         */
        val DEFAULT_REMINDER_TIME: LocalTime = LocalTime.of(10, 0)

        /**
         * The defaults a fresh install gets, before anything has been written.
         *
         * Two of these are decisions rather than conveniences:
         * [NotificationPrivacy.DISCREET] because a default of DIRECT would leak
         * on a lock screen before the user has been asked anything, and the
         * fertility reminders off because most users are not tracking fertility
         * and an unrequested ovulation notification is an unpleasant surprise —
         * doubly so on a lock screen somebody else can see.
         */
        val Defaults = UserPreferences()
    }
}
