Simple World

1. Start here

This package contains the source for a social community app and its administration console. Each installation uses the buyer’s own Firebase project and accounts. The admin panel requires the included server functions for privileged actions.

Install Flutter, an Android SDK with API 36 build support, JDK 21, Node.js 22 and the Firebase CLI. iOS builds require macOS and Xcode and target iOS 13 or later. Dart and Node dependency versions are pinned in the supplied lockfiles. The obsolete native Podfile.lock is omitted; generate a fresh one on macOS after configuring Firebase. Use the same Flutter version recorded in the review report, then validate upgrades separately.

flutter doctor
node --version
npm install -g firebase-tools
firebase --version

Open a terminal in the folder specified before each command. On Windows, extract into a short path such as C:\Projects\SimpleWorld to avoid native font-subsetting path limits, and quote paths containing spaces. Flutter downloads its Dart and platform dependencies when you run flutter pub get.

2. Create your Firebase installation

1. Create your own project in the Firebase console. Choose the region before creating databases.
2. Enable Authentication → Email/Password. Enable Google sign-in if you offer it in the mobile app, and configure the relevant OAuth client IDs and signing certificate fingerprints.
3. Create Cloud Firestore and Cloud Storage. Deploy the supplied restricted rules before opening your app to the public. Do not use permanent test-mode rules.
4. Register Android and iOS apps matching your chosen package and bundle identifiers. Download your google-services.json and GoogleService-Info.plist. Register a separate web app for the admin panel.
5. Cloud Functions and related services may require a billing-enabled plan. Check current Firebase pricing, quotas and budgets for your project.

Public Firebase client configuration identifies a project; it does not grant administrator privileges. Service account keys grant server access and must stay outside this package and outside public hosting.

Install and deploy the backend

cd Source/admin-panel/admin-functions
npm ci
# Copy .env.example to .env.YOUR_PROJECT_ID
# Set SIMPLE_WORLD_STORAGE_BUCKET to the exact bucket shown in Firebase.
cd ..
firebase login
firebase deploy --project YOUR_PROJECT_ID --config firebase.json --only functions,firestore,storage

Wait until every deployment finishes and required Firestore indexes are ready. Functions include moderation, roles, groups, daily analytics, public profile synchronization, follower timeline delivery, activity notifications and story expiry. Emulator mode suppresses external push delivery. Production push needs valid FCM/APNs credentials and a device token.

Protect private profiles

Private profiles live in users/{uid}. The server publishes only the permitted public fields into public_users/{uid}. Administrator access requires matching Firebase custom claims and current profile role data. Editing a client-side boolean does not grant a trusted role.

3. Configure and build the mobile app

1. Open Source/mobile-app and choose your Android application ID and iOS bundle ID. Replace the example publisher identifier consistently in Android Gradle, the Android activity package and the Xcode project.
2. Place your Android configuration at android/app/google-services.json. Add your iOS configuration to ios/Runner/GoogleService-Info.plist and ensure it is included in the Runner target.
3. Set the reversed iOS Google client ID in ios/Runner/Info.plist if Google login is enabled. Select your own Xcode development team. Configure push capabilities, APNs and notification permission prompts.
4. Run dependency installation. Use connected mode for the buyer edition.

cd Source/mobile-app
flutter pub get
flutter analyze lib test
flutter run --dart-define=SIMPLE_WORLD_DEMO=false

The author’s offline portrait and photograph preview assets are omitted from the download. They are distinct from the admin’s local emulator demo. The default connected build keeps the offline flag disabled. The optional on-device demo uses text fixtures and initials; see the v05 quick test and feature scope.

Android signing

Create and securely back up your upload keystore. Copy android/key.properties.example to android/key.properties and enter your own alias and passwords. Place the keystore at the path expected by Gradle, or update the signing configuration. Keep signing files out of public repositories and buyer archives.

flutter build apk --release --dart-define=SIMPLE_WORLD_DEMO=false
flutter build appbundle --release --dart-define=SIMPLE_WORLD_DEMO=false

iOS, ads and commerce

On macOS, install CocoaPods, run flutter pub get, then run pod install --repo-update from ios to generate the native lockfile. Keep that lockfile once the installation is validated.

Use flutter build ipa --release --dart-define=SIMPLE_WORLD_DEMO=false on macOS, then validate through Xcode. AdMob identifiers in this edition are Google test identifiers; configure your own identifiers for release and validate consent requirements. Purchases are disabled in this candidate. The Upgrade screen states that paid products are unavailable. The original unverified integration is under examples/unverified-iap/, outside the running app. Paid products and restoration are excluded from the supported feature list. Implement server receipt verification and entitlement delivery and verify the full store lifecycle before adding purchases. Device and store approval are separate checks.

The Android source targets API 36, matching the current Google Play target requirement checked on 3 October 2026. This setting does not establish device compatibility, native library page-size support or store approval. Verify those with your signed release artifact.

Profile statistics use a server-controlled credit operation with a stable retry ID. Costs are 10 credits for your own profile and 20 for another profile. Clients cannot directly change their credit balance. This credit interaction is not an access-control boundary for the community’s already readable social data.

Translations are included, with some languages falling back to English for untranslated messages. Review l10n.yaml and the generated untranslated-message output before advertising complete translations.

4. Configure the admin panel

1. Copy configuration/firebase-web.example.json to configuration/firebase-web.json.
2. Replace every YOUR_... value with the web app configuration from your own Firebase project. Use the exact Storage bucket name, which can have a different suffix depending on when it was created.
3. Run the panel with that configuration and create your first trusted owner using the next section.

cd Source/admin-panel
flutter pub get
flutter run -d chrome --dart-define-from-file=configuration/firebase-web.json
flutter build web --release --no-tree-shake-icons --dart-define-from-file=configuration/firebase-web.json
firebase deploy --project YOUR_PROJECT_ID --config firebase.json --only hosting

The dynamic icon references require --no-tree-shake-icons. The admin uses a fresh server session check and does not store passwords in application preferences. Host the finished build over HTTPS and add its domain to Firebase Authentication’s authorized domains. The provided Hosting configuration supplies routing and basic response headers.

Generated spot illustrations and the generated preview logo are excluded. The buyer edition uses the author’s original raster logo and licensed PNG icons. To brand your installation, replace the original logo PNG with your own licensed bitmap and update the visible product names. Keep asset dimensions and transparent edges suitable for their UI positions.

5. Set up your admin team

First register a regular account in the mobile app, verify its email and confirm the profile exists in Firestore. Create a service account credential for an operator with sufficient Firebase Auth and Firestore permissions. Store its JSON file outside the source and hosting folders.

# PowerShell, from Source/admin-panel:
$env:GOOGLE_APPLICATION_CREDENTIALS = 'C:\private\your-project-service-account.json'
node tools/bootstrap-owner.cjs --project YOUR_PROJECT_ID --email admin@yourcompany.example
# Review the read-only result before applying:
node tools/bootstrap-owner.cjs --project YOUR_PROJECT_ID --email admin@yourcompany.example --apply

The helper validates the credential project, account state and existing owners. It preserves unrelated claims and keeps access denied until Auth and the profile agree. If a first-owner setup is interrupted, retry the same helper. Once an owner exists, use Admin team to manage further roles. Sign out and sign in again after changing a role.

6. Explore the isolated local sample demo

The included helper only accepts demo-simple-world and the named localhost emulator ports. It refuses other endpoints, does not load operator credentials, and refuses to overwrite a populated demo. Start a fresh emulator session to reseed.

# Terminal 1, Source/admin-panel:
cd admin-functions
npm ci
cd ..
firebase emulators:start --config firebase.emulators.json --project demo-simple-world --only auth,firestore,functions,storage

# Terminal 2, Source/admin-panel:
node deployment/demo/seed-demo.cjs
flutter build web --release --no-tree-shake-icons --dart-define=SIMPLE_WORLD_EMULATORS=true --output=build/demo-web
python -m http.server 5183 --bind 127.0.0.1 --directory build/demo-web

Open the local demo. It contains 40 fictional profiles, 48 posts, 12 reports, six groups and 30 dated sample chart buckets. All email addresses use example.test. The author preview can show optional generated illustrations; the buyer seed works with text posts when those assets are absent.

The persistent sample-data banner identifies profiles, content and charts as fictional. Sample counts illustrate capabilities and are not real customers, engagement or business results. These credentials are for localhost only. Never reuse them in a real project.

To exercise server permissions and cleanup on those disposable records:

node deployment/demo/verify-demo.cjs
node deployment/demo/verify-fanout.cjs
node deployment/demo/verify-credits.cjs
node deployment/demo/verify-mobile-boundary.cjs

Run the verification sequence on a fresh sample seed; its disposable fixtures are removed and repeat runs need a new seed. Stop the emulators with Ctrl+C when finished. A publicly hosted demonstration needs its own isolated project, appropriate rules, safe reset handling and separate credentials; the emulator build refuses public hosts.

7. Using the administration console

Directory data are read in bounded batches. Search can continue through the directory, and exports offer loaded rows or a bounded complete scan. Saved views belong to the current admin in that browser. CSV exports guard spreadsheet formulas. PDF exports include bundled multilingual fonts; CSV is the fallback for unsupported characters.

Warnings and restrictions require a reason. Publishing restrictions affect community posts, comments and stories; reading and private messages remain available. Removal jobs keep a stable ID so interrupted cleanup can resume. Reuse the same retry action, and inspect failed jobs before starting a second deletion.

8. Existing installations, backups and updates

1. Preserve the current source and release artifacts. Verify that the backup destination denies public read/write access and has appropriate IAM before exporting private profiles. Export Firestore and separately back up Storage media. Test restoration in a separate project. Record completion only after the operation succeeds.
2. Review public profile fields, UID-scoped upload paths, group adminId/memberIds and report ownerId/postId references. Do not infer group owners from display names.
3. Roll out the compatible mobile client or explicitly plan the interruption of older clients. Keep originals and any ambiguous shared media for manual review.
4. Deploy functions, indexes and rules in the planned window. Wait for indexes to become ready. Confirm matching trusted roles and validate operations with disposable accounts.
5. Check new daily tracking, report reasons, Storage authorization and recovery of failed jobs. Watch logs and rollback indicators before lifting maintenance.

A recorded backup status does not prove that every media file is covered. The panel leaves backup coverage unknown until an operator records a verified result. Emulator verification does not prove production indexes, IAM, quotas, APNs or physical-device behavior.

9. Troubleshooting

10. Asset and dependency credits

The author confirmed original authorship of the application. The buyer edition contains licensed bitmap exports of Ionicons under its MIT license. Copyright and license notices are in licenses/Ionicons-MIT.txt. These PNGs are rendered from the distributed font and are not AI generated.

Space Grotesk, Inter, Poppins, Roboto and bundled Noto PDF fonts retain their included license notices. Local Inter, Poppins and Roboto files prevent runtime font downloads; see mobile-fonts.json for hashes and notice paths. Additional Flutter and Node package notices are in licenses/ and indexed in dependency-license-index.json. The Node catalog records available notice files and each package’s declared license. npm-installed dependencies retain their original notices.

Generated logos, portraits, photographs, videos and decorative spot illustrations shown in the author preview are excluded from this download. See buyer-assets.json for the edition differences. This follows Envato’s AI content policy. Use your own commercially redistributable artwork when customizing the buyer edition.

The application’s commercial license is supplied by the marketplace purchase terms if and when the item is accepted. Third-party components retain their listed licenses. This guide does not change those licenses or guarantee marketplace acceptance.