Alan Runyan: Building a Secure Cross Platform Mobile/Tablet Application (Flutter) using Plone as Backend Server

Enfold has been working on a secure cross platform mobile application the past eight months. Walk through of the Requirements, Security, Flutter framework, Backend configuration of Plone, Authentication and Lessons Learned. Our goal is to have a free public release of a limited version of the application Q4 2021.

It was an adventure for us. The core team never built a large mobile application. We did not know what we did not know.

The big picture:

• A mix of devices (Android, iOS) needs to synchronize files to and from Plone.
• All services are self-hosted in GovCloud. So we have no central database or server that we control.
• If this becomes a success, then future phases may require a lot of certification of the codebase, code reviews.
• Initially we worked with 15k devices, supporting 40k would be a success, the ceiling that we might support is 300k.
• Users are completely offline for longer times.

We used Flutter to create a React native app, see https://flutter.dev It is a UI toolkit. Why did we use Flutter?

• It is cross platform mobile.
• It uses Dart, which is statically typed, making code analysus much easier.
• Google seems to be prioritizing developer user experience, it really shows of quite a bit.

Dart has asynchronous code as a first class citizen. Quite different from Python. Runtime reflection (pdb) is unavailable. It has good ergonomics, with generics and closures. It is a driving force behind the Flutter toolkit.

Thoughts on mobile development:

• It is a lot to take in.
• You need to understand lots of languages, for us: kotlin/java, swift/obj-c, and Dart.
• No idea how to test platform integration.
• Native libraries are managed using Cocoapods/Gradle. Flutter drives those. Setting it up is yet another new thing to learn.
• There are lots of inconveniences, like how do you read sqlite off a device, because that is how we store some of the info?
• Also inconsistencies: if the app works on an emulator, that does not mean it works on a device.

On the server side:

• Plone operating as a Webdav server
• We need to support OIDC (mod_openids/oauth2)
• Not many writes, maybe 100-1000 per day, but lots of reads.
• 20k+ devices daily

Alternatives to the server/protocol could be nice:

• Honestly, are there any standards other than WebDav?
• An S3 api would be reasonable.
• So ideas are welcome, let me know.
• We have been working on prototypes with guillotina_webdav + openidc.

The good parts of Flutter:

• UI/UX development is very fast, with lots of widgets. We had two developers who were used to Angular, and they took it up quite fast.
• The bridge to native code (Pigeon) is straight forward.
• Drift is an amazing sqlite library.
• Riverpod for state management
• Dependency management is good (flutter pub). You can tell that they learned a ton from others, like pip. Except that very occasionally the package cache is broken so you need to clean it.
• They have a good community, with add-ons.

The not so good parts of Flutter:

• Inconsistent platform features, like WorkManager (Android) versus NSUrlSession (iOS)
• Dependency churn: often new versions come in, which you then need to check.

The mobile app:

• We are still wrapping up the remote file operations.
• After we deploy into production, we will improve the UI.

Yes, we hope to open source the synchronization framework, and maybe the foreground/background transferring subsystem. Yes, we have built a Flutter web-app of this, but it looks just like the mobile app currently. Needs a separate layout really. No, we have not done a Desktop app.