# KeePassXC replaces KWallet as the org.freedesktop.secrets provider so the
# vault can be unlocked with a YubiKey (HMAC-SHA1 challenge-response on OTP
# slot 2) instead of the login password. KWallet's only unattended-unlock
# path is pam_kwallet inheriting the login password, which passwordless
# YubiKey login (module.yubikey.nix) never supplies -- KeePassXC is the only
# one of the two with native hardware-key support.
#
# Database creation is manual/interactive (GUI wizard), not declared here:
# the .kdbx is mutable state, and the Secret Service "exposed group" setting
# lives inside the database file itself with no Nix-level equivalent. See
# yubikey-chalresp (caesium.home.nix) for programming the shared
# challenge-response secret onto each key first.
{
  lib,
  ...
}:

{
  xdg.autostart.enable = true;

  programs.keepassxc = {
    enable = true;
    autostart = true;
    settings = {
      FdoSecrets.Enabled = true;
      FdoSecrets.ConfirmDeleteItem = true;

      # Required, not cosmetic: this home-manager module installs its own
      # browser native-messaging manifest. Leaving KeePassXC's own updater on
      # collides with it and throws an error dialog on every launch.
      Browser.UpdateBinaryPath = false;

      GUI.ShowTrayIcon = true;
      GUI.MinimizeToTray = true;

      General.MinimizeAfterUnlock = true;
      General.BackupBeforeSave = true;

      Security.LockDatabaseIdle = true;
      Security.LockDatabaseIdleSeconds = 900;
    };
  };

  # Non-empty `programs.keepassxc.settings` links keepassxc.ini read-only into
  # the Nix store; KeePassXC will report a config-write error at startup
  # because it also persists runtime state (last-opened DB, window geometry)
  # there. Expected and harmless -- see nix-community/home-manager#8257. If
  # the dialog proves intolerable, drop `settings` above, install the package
  # via home.packages instead, and seed a mutable keepassxc.ini with a
  # home.activation script (module.evolution.nix uses the same technique for
  # EDS *.source files).

  # Disable KWallet outright so nothing fights KeePassXC for the
  # org.freedesktop.secrets D-Bus name. Linked read-only on purpose: it stops
  # Plasma silently re-enabling the wallet from System Settings.
  xdg.configFile."kwalletrc".text = lib.generators.toINI { } {
    Wallet = {
      Enabled = false;
    };
  };
}