blasco86/tstsiteapp

Purpose and targets

TstSiteApp is a Kotlin Multiplatform frontend for the external TstSite REST API. It shares Compose UI, API models, request orchestration, and encryption logic across Android, iOS, JVM desktop, JS, and WasmJS. Build topology is defined in build.gradle.kts, composeApp/build.gradle.kts, and settings.gradle.kts.

Entry points and presentation

The shared Compose Material UI is rooted at composeApp/src/commonMain/kotlin/org/tstsite/tstsiteapp/App.kt. Platform launch adapters host that UI:

• Android activity: composeApp/src/androidMain/kotlin/org/tstsite/tstsiteapp/MainActivity.kt

• iOS view controller, embedded by the Swift shell: composeApp/src/iosMain/kotlin/org/tstsite/tstsiteapp/MainViewController.kt, iosApp/iosApp/iOSApp.swift

• JVM desktop main: composeApp/src/jvmMain/kotlin/org/tstsite/tstsiteapp/main.kt

• Browser main and host assets: composeApp/src/webMain/kotlin/org/tstsite/tstsiteapp/main.kt, composeApp/src/webMain/resources/index.html

The UI drives asynchronous login, token validation/profile/logout, user querying, and catalog retrieval via coroutines and the API client boundary.

Shared domain and configuration

Serializable request/response/domain types form the common API contract in composeApp/src/commonMain/kotlin/org/tstsite/tstsiteapp/model/Models.kt. Shared runtime/platform abstraction is declared in composeApp/src/commonMain/kotlin/org/tstsite/tstsiteapp/Platform.kt.

composeApp/src/commonMain/kotlin/org/tstsite/tstsiteapp/config/AppConfig.kt centralizes DEV versus cloud endpoint selection, including Android-emulator localhost handling, and resolves the embedded encrypted payload secret in memory. The cloud API is hosted at Alwaysdata; its backend is separately described as Node.js/Express/PostgreSQL.

API transport boundary

composeApp/src/commonMain/kotlin/org/tstsite/tstsiteapp/network/ApiClient.kt declares the common expect API client contract consumed by shared UI/business flow. Concrete actual clients isolate Ktor engine/platform mechanics:

• Android/OkHttp: composeApp/src/androidMain/kotlin/org/tstsite/tstsiteapp/network/ApiClient.android.kt

• iOS/Darwin: composeApp/src/iosMain/kotlin/org/tstsite/tstsiteapp/network/ApiClient.ios.kt

• JVM/CIO: composeApp/src/jvmMain/kotlin/org/tstsite/tstsiteapp/network/ApiClient.jvm.kt

• JS/Wasm Fetch: composeApp/src/jsMain/kotlin/org/tstsite/tstsiteapp/network/ApiClient.js.kt, composeApp/src/wasmJsMain/kotlin/org/tstsite/tstsiteapp/network/ApiClient.wasmJs.kt

Control flow is UI → client contract → encrypted HTTP request → TstSite API → decrypt/deserialize response → rendered state. JWT, obtained by login, is the authorization boundary; no API key is intended in clients.

Cryptographic boundary

Common expect declarations separate security policy from native implementations: composeApp/src/commonMain/kotlin/org/tstsite/tstsiteapp/utils/crypto/Cryptor.kt and composeApp/src/commonMain/kotlin/org/tstsite/tstsiteapp/utils/crypto/PayloadCrypto.kt.

Cryptor decrypts Fernet-wrapped embedded configuration secrets. PayloadCrypto encrypts API bodies using an AES-256-GCM-compatible payload format where supported. Native implementations are isolated per runtime, for example Android JCE at composeApp/src/androidMain/kotlin/org/tstsite/tstsiteapp/utils/crypto/Cryptor.android.kt and iOS CoreCrypto at composeApp/src/iosMain/kotlin/org/tstsite/tstsiteapp/utils/crypto/PayloadCrypto.ios.kt. This is a material compatibility boundary: README notes iOS payload encryption uses CBC rather than GCM.

Runtimes and delivery

The project requires Kotlin Multiplatform/Compose Multiplatform, Gradle Kotlin DSL, and JDK 21; Android targets minSdk 24. The native iOS wrapper/project is under iosApp/iosApp.xcodeproj and iosApp/iosApp. Web/Wasm output is browser-hosted, with deployment referenced through GitHub Actions in a related central repository and Apache/Alwaysdata hosting. Platform-specific source sets allow security and HTTP dependencies to vary without duplicating the application UI or domain layer.