Security Best Practices

The Fikak application implements several layers of security to protect user data and ensure the integrity of the coffee-sharing platform. This document outlines the security architecture, focusing on authentication, secure data handling, and build-time protections.

The primary security scope involves the integration with Firebase services for identity management and the use of the BLoC (Business Logic Component) pattern to maintain a secure, predictable state for authenticated sessions. Developers should refer to the Authentication Architecture section for details on session management.

Authentication and Identity Management

The application relies on Firebase Authentication to handle user credentials and session tokens. By delegating authentication to an industry-standard provider, the app avoids storing sensitive password data locally or on custom servers.

Authentication Flow

The AuthRepository serves as the abstraction layer for all security-sensitive operations involving user identity. It manages the lifecycle of the FirebaseUser and provides streams for authentication state changes.

The flow ensures that raw credentials are never stored in the application state; only the resulting authentication token is utilized.
Sources: lib/data/repositories/auth_repository.dart:10-45, lib/logic/blocs/auth/auth_bloc.dart:15-30

Key Security Components

Sources: pubspec.yaml:25-30, lib/data/repositories/auth_repository.dart

Secure State Management

Security is enforced at the logic level using the AuthBloc. The application prevents access to protected resources by verifying the current state of the BLoC before rendering specific views or executing sensitive commands.

Access Control Logic

The AuthBloc monitors the authentication stream provided by the repository. If a token expires or a user logs out, the bloc immediately emits a state that triggers a global redirect to the login screen.

Build and Environment Security

The application configuration includes measures to protect the codebase and API keys during deployment and execution on Android and iOS devices.

Code Obfuscation and Minification

The Android build configuration utilizes R8/Proguard to obfuscate the Dart-to-Native bridge and Java/Kotlin code, making reverse engineering significantly more difficult.

• Minification: Enabled to remove unused code and reduce the attack surface.
• Shrinking: Removes unused resources that might contain sensitive metadata.

Sources: android/app/build.gradle:55-65

Dependency Security

The project tracks specific versions of security-critical packages to prevent supply chain attacks. Key packages include:

• firebase_core: Base security for Firebase services.
• google_sign_in: Secure OAuth2 implementation for Google accounts.
• flutter_bloc: Ensures predictable and verifiable state transitions.

Sources: pubspec.yaml:20-40

Infrastructure and API Security

Since the app uses Firebase, security is primarily defined by Firebase Security Rules (though the rules themselves are managed outside the Flutter codebase, the app is architected to comply with them).

1. Transport Security: All communication between the app and Firebase services is encrypted via TLS/SSL.
2. API Key Restriction: Keys found in google-services.json (Android) and GoogleService-Info.plist (iOS) are restricted to the application's package name and SHA-1 fingerprint.

Sources: lib/main.dart:10-25, README.md

Conclusion

Security in the Fikak application is built on the principle of least privilege and the delegation of credential management to trusted providers. By combining Firebase Authentication with the BLoC pattern for state management, the application ensures that user data is protected both in transit and during the active session. Future security enhancements should focus on implementing local biometric storage for persistent sessions.