feat: payjoin toggle on send confirm so the sender can opt out

Author: i5hi

lib/core/screens/send_confirm_screen.dart

@@ -1,3 +1,4 @@
+import 'package:bb_mobile/core/widgets/switch/bb_switch.dart';
 import 'package:bb_mobile/core/errors/send_errors.dart';
 import 'package:bb_mobile/core/widgets/address_viewer.dart';
 import 'package:bb_mobile/core/swaps/domain/entity/swap.dart';
@@ -117,7 +118,8 @@ class CommonOnchainSendInfoSection extends StatelessWidget {
     required this._selectedFeeOptionTitle,
     this._onFeePriorityTap,
     this._isToSelf = false,
-    this._checkedStatusLabel,
+    this._payjoinToggleValue,
+    this._onPayjoinToggleChanged,
     this._note = '',
   });
   final String _sendWalletLabel;
@@ -129,8 +131,12 @@ class CommonOnchainSendInfoSection extends StatelessWidget {
   final VoidCallback? _onFeePriorityTap;
   final bool _isToSelf;
 
-  /// Optional checked capability/status row supplied by the owning feature.
-  final String? _checkedStatusLabel;
+  /// Payjoin toggle row: shown when [_payjoinToggleValue] is non-null (i.e.
+  /// a payjoin is available for this send), letting the sender choose NOT to
+  /// payjoin. The value mirrors the feature's will-attempt state so the
+  /// switch and the sign path can never disagree.
+  final bool? _payjoinToggleValue;
+  final ValueChanged<bool>? _onPayjoinToggleChanged;
   final String _note;
   Widget _divider(BuildContext context) {
     return Container(height: 1, color: context.appColors.secondaryFixedDim);
@@ -176,16 +182,15 @@ class CommonOnchainSendInfoSection extends StatelessWidget {
               ),
             ),
           ],
-          if (_checkedStatusLabel != null) ...[
+          if (_payjoinToggleValue != null) ...[
             _divider(context),
             CommonInfoRow(
-              title: _checkedStatusLabel,
+              title: context.loc.sendPayjoinLabel,
               details: Align(
                 alignment: Alignment.centerRight,
-                child: Icon(
-                  Icons.check,
-                  color: context.appColors.secondary,
-                  size: 20,
+                child: BBSwitch(
+                  value: _payjoinToggleValue,
+                  onChanged: _onPayjoinToggleChanged,
                 ),
               ),
             ),

lib/features/send/presentation/bloc/send_cubit.dart

@@ -1895,6 +1895,14 @@ class SendCubit extends Cubit<SendState>
     }
   }
 
+  /// The sender's choice on the confirm screen: attempt the payjoin or send
+  /// a plain transaction. Ignored once signing has started — the decision is
+  /// consumed by [signTransaction]'s payjoin branch.
+  void togglePayjoin(bool attempt) {
+    if (state.signingTransaction || state.txId != null) return;
+    emit(state.copyWith(payjoinOptedOut: !attempt));
+  }
+
   Future<void> signTransaction() async {
     try {
       emit(state.copyWith(signingTransaction: true));

lib/features/send/presentation/bloc/send_state.dart

@@ -74,6 +74,10 @@ abstract class SendState with _$SendState {
     // fetched settings at least once, no payjoin is attempted. Mirrors
     // SettingsEntity.isPayjoinEnabled.
     @Default(false) bool payjoinGloballyEnabled,
+    // The sender's per-send opt-out: payjoin can be available for this send
+    // (see [isPayjoinAvailable]) and still deliberately not attempted. Reset
+    // is not needed — the cubit lives per send flow.
+    @Default(false) bool payjoinOptedOut,
     @Default('') String amount,
     int? confirmedAmountSat,
     BitcoinUnit? bitcoinUnit,
@@ -176,25 +180,30 @@ abstract class SendState with _$SendState {
   /// Whether we have a valid payment request
   bool get hasValidPaymentRequest => paymentRequest != null;
 
-  /// Single source of truth for whether a payjoin will actually be attempted
-  /// for this send — same pattern as [Payjoin.canManuallyBroadcastOriginal],
-  /// which unifies a button's visibility and its action guard. Used BOTH to
-  /// gate `signTransaction`'s payjoin branch and to show the "a payjoin will
-  /// be attempted" indicator on the confirm screen, so the two can never
-  /// disagree.
+  /// Whether a payjoin is structurally possible for this send: the setting
+  /// is on, the wallet signs locally, and the recipient's BIP21 advertises a
+  /// pj= endpoint. Drives whether the confirm screen offers the payjoin
+  /// toggle at all — [willAttemptPayjoin] adds the sender's choice on top.
   ///
   /// Gated on [Wallet.signsLocally]: a hardware/remote-signer wallet
   /// (Ledger/BitBox) never reaches `signTransaction`'s payjoin branch (the
   /// confirm screen swaps in a device-specific sign button for those
-  /// wallets instead), so without this check the indicator could promise a
+  /// wallets instead), so without this check the toggle could promise a
   /// payjoin that structurally can never happen for that wallet class.
-  bool get willAttemptPayjoin =>
+  bool get isPayjoinAvailable =>
       payjoinGloballyEnabled &&
       (selectedWallet?.signsLocally ?? false) &&
       isToSelf != true &&
       paymentRequest is Bip21PaymentRequest &&
       (paymentRequest! as Bip21PaymentRequest).pj.isNotEmpty;
 
+  /// Single source of truth for whether a payjoin will actually be attempted
+  /// for this send — same pattern as [Payjoin.canManuallyBroadcastOriginal],
+  /// which unifies a control's state and its action guard. Used BOTH to
+  /// gate `signTransaction`'s payjoin branch and as the confirm screen's
+  /// toggle value, so the two can never disagree.
+  bool get willAttemptPayjoin => isPayjoinAvailable && !payjoinOptedOut;
+
   String get paymentRequestAddress {
     if (paymentRequest == null) {
       return copiedRawPaymentRequest.isNotEmpty

lib/features/send/ui/screens/send_screen.dart

@@ -1006,6 +1006,9 @@ class _OnchainTransactionReview extends StatelessWidget {
       (SendCubit cubit) => cubit.state.isToSelf == true,
     );
     final label = context.select((SendCubit cubit) => cubit.state.label);
+    final isPayjoinAvailable = context.select(
+      (SendCubit cubit) => cubit.state.isPayjoinAvailable,
+    );
     final willAttemptPayjoin = context.select(
       (SendCubit cubit) => cubit.state.willAttemptPayjoin,
     );
@@ -1021,9 +1024,9 @@ class _OnchainTransactionReview extends StatelessWidget {
           absoluteFees: formattedAbsoluteFees,
           selectedFeeOptionTitle: selectedFeeOption.title(),
           isToSelf: isToSelf,
-          checkedStatusLabel: willAttemptPayjoin
-              ? context.loc.sendPayjoinLabel
-              : null,
+          payjoinToggleValue: isPayjoinAvailable ? willAttemptPayjoin : null,
+          onPayjoinToggleChanged: (attempt) =>
+              context.read<SendCubit>().togglePayjoin(attempt),
           note: label,
           onFeePriorityTap: hasFinalizedTx
               ? null

test/features/send/presentation/bloc/send_state_test.dart

@@ -369,6 +369,18 @@ void main() {
             )
             as Bip21PaymentRequest;
 
+    test('the sender opt-out defeats an otherwise-available payjoin, and '
+        'isPayjoinAvailable stays true so the toggle keeps rendering', () {
+      final state = SendState(
+        paymentRequest: bip21WithPj(),
+        payjoinGloballyEnabled: true,
+        selectedWallet: bitcoinWallet(),
+        payjoinOptedOut: true,
+      );
+      expect(state.isPayjoinAvailable, isTrue);
+      expect(state.willAttemptPayjoin, isFalse);
+    });
+
     test('false when payjoin is disabled globally, even with a pj= URI', () {
       final state = SendState(
         paymentRequest: bip21WithPj(),