Architecture
- Stack: React Native + Expo Router v4 (file-based), NativeWind v4, TanStack Query, Zustand, expo-secure-store. Monorepo via pnpm (
node-linker=hoisted). - Auth: Supabase with AsyncStorage; the app sends a Bearer JWT to a dedicated
/api/mobile/*surface (~47 endpoints) that returns simplified, flat shapes for the client. - White-label: a dynamic ThemeProvider reads the tenant theme from
/api/mobile/meafter login; pre-login branding comes from the public/api/mobile/tenant-brandingendpoint. - OTA updates:
expo-updateswithruntimeVersionpinned to the SDK; anAppVersionGatecan force-update when the installed build is below a configured minimum.
What's in the app
| Area | Screens |
|---|---|
| Learning | dashboard, courses (list + catalog + detail), lesson viewer, progress |
| Assessment | native quiz player, assignment submission |
| Tutor | AI tutor chat (SSE streaming), talking avatar (WebView), quarantine/safety notices |
| Social | direct messages, forums (forum → thread → reply), announcements, course materials |
| Gamification | XP/level/streak, badges, leaderboard, contests, rewards shop |
| Records | grades, certificates, notifications (list + mark read) |
| Live | live classes (WebView), calendar |
SSO on mobile
The backend route /api/auth/sso/[tenantSlug] accepts a redirect=studeia://... deep link; the callback emits a 302 to studeia://auth/callback#access_token=...&refresh_token=.... A Linking listener in the auth provider calls supabase.auth.setSession(), and the SSO screen uses an in-app browser session so focus returns to the app.
Security model
Mobile endpoints reuse the same authorization guards as the web: forum/thread access guards, lesson access (publish + prerequisite + enrollment), assignment attachments in a private bucket with a validated path prefix, and server-side HTML sanitization before any WebView render (WebViews run with a strict origin whitelist and JS disabled where possible).
Avatar on mobile
The talking AI avatar runs in a WebView that loads the same /avatar-embed page used on web (no native WebRTC modules in Expo); a small React Native bridge forwards control messages.
Roadmap
iOS is not published yet — it requires an Apple Developer account and a dedicated EAS build.