import 'package:flutter_secure_storage/flutter_secure_storage.dart';

class SecureTokenStore {
  static const _storage = FlutterSecureStorage(
    aOptions: AndroidOptions(encryptedSharedPreferences: true),
    iOptions: IOSOptions(
      accessibility: KeychainAccessibility.first_unlock_this_device,
    ),
  );

  static const _keyAccessToken = 'access_token';
  static const _keyRefreshToken = 'refresh_token';

  Future<void> saveTokens({
    required String accessToken,
    required String refreshToken,
  }) async {
    await Future.wait([
      _storage.write(key: _keyAccessToken, value: accessToken),
      _storage.write(key: _keyRefreshToken, value: refreshToken),
    ]);
  }

  Future<String?> get accessToken => _storage.read(key: _keyAccessToken);
  Future<String?> get refreshToken => _storage.read(key: _keyRefreshToken);

  Future<void> clearAll() async {
    await _storage.deleteAll();
  }
}

import 'package:local_auth/local_auth.dart';
import 'package:flutter_secure_storage/flutter_secure_storage.dart';

class BiometricVault {
  final _auth = LocalAuthentication();
  final _storage = const FlutterSecureStorage();

  Future<String?> readProtectedValue(String key) async {
    final canAuthenticate = await _auth.canCheckBiometrics ||
        await _auth.isDeviceSupported();

    if (!canAuthenticate) return null;

    final authenticated = await _auth.authenticate(
      localizedReason: 'Authenticate to access secure data',
      options: const AuthenticationOptions(
        stickyAuth: true,
        biometricOnly: false, // allow PIN/pattern fallback
      ),
    );

    if (!authenticated) return null;
    return _storage.read(key: key);
  }
}

// drift + sqlcipher example
import 'package:drift/drift.dart';
import 'package:drift/native.dart';
import 'package:sqlcipher_flutter_libs/sqlcipher_flutter_libs.dart';
import 'package:sqlite3/open.dart';

LazyDatabase openEncryptedDb(String path, String passphrase) {
  return LazyDatabase(() async {
    // Ensure sqlcipher is loaded
    open.overrideFor(OperatingSystem.android, openCipherOnAndroid);

    return NativeDatabase.createInBackground(
      File(path),
      setup: (db) {
        // Set the encryption key — must be first statement
        db.execute("PRAGMA key = '$passphrase';");
        db.execute('PRAGMA cipher_compatibility = 4;');
      },
    );
  });
}

import 'dart:io';
import 'package:dio/dio.dart';
import 'package:dio/io.dart';

Dio createPinnedClient() {
  final dio = Dio(BaseOptions(baseUrl: 'https://api.example.com'));

  dio.httpClientAdapter = IOHttpClientAdapter(
    createHttpClient: () {
      final client = HttpClient();
      client.badCertificateCallback = (cert, host, port) => false;

      // Pin the expected certificate fingerprint
      final context = SecurityContext();
      context.setTrustedCertificatesBytes(_pinnedCertBytes);
      return HttpClient(context: context);
    },
  );

  return dio;
}

// Alternative: pin by public key hash in an interceptor
class CertificatePinningInterceptor extends Interceptor {
  // SHA-256 of the SubjectPublicKeyInfo
  static const _expectedPin =
      'sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=';

  @override
  void onRequest(RequestOptions options, RequestInterceptorHandler handler) {
    // Pinning is enforced at the HttpClient level above.
    // This interceptor can add additional header-based verification
    // or log pinning events for monitoring.
    handler.next(options);
  }
}

<!-- ios/Runner/Info.plist -->
<!-- WRONG: disables all transport security -->
<!--
<key>NSAppTransportSecurity</key>
<dict>
  <key>NSAllowsArbitraryLoads</key>
  <true/>
</dict>
-->

<!-- RIGHT: exception only for a specific legacy domain -->
<key>NSAppTransportSecurity</key>
<dict>
  <key>NSExceptionDomains</key>
  <dict>
    <key>legacy-api.example.com</key>
    <dict>
      <key>NSExceptionAllowsInsecureHTTPLoads</key>
      <true/>
      <key>NSExceptionMinimumTLSVersion</key>
      <string>TLSv1.2</string>
    </dict>
  </dict>
</dict>

<!-- android/app/src/main/res/xml/network_security_config.xml -->
<network-security-config>
  <!-- Deny cleartext traffic globally -->
  <base-config cleartextTrafficPermitted="false">
    <trust-anchors>
      <certificates src="system" />
    </trust-anchors>
  </base-config>

  <!-- Pin certificates for your API domain -->
  <domain-config>
    <domain includeSubdomains="true">api.example.com</domain>
    <pin-set expiration="2027-01-01">
      <pin digest="SHA-256">base64EncodedSPKIHash1=</pin>
      <pin digest="SHA-256">base64EncodedBackupPin=</pin>
    </pin-set>
  </domain-config>
</network-security-config>

<application android:networkSecurityConfig="@xml/network_security_config" ...>

// WRONG: hardcoded secret in Dart source
const apiSecret = 'sk_live_XXXXXXXXXXXXXXXX';

// RIGHT: compile-time injection for non-secret, restricted keys only
const mapsKey = String.fromEnvironment('MAPS_API_KEY');

// Build with:
// flutter build apk --dart-define=MAPS_API_KEY=$MAPS_API_KEY

flutter build apk \
  --obfuscate \
  --split-debug-info=build/debug-info

flutter build ipa \
  --obfuscate \
  --split-debug-info=build/debug-info

# Upload to Sentry
sentry-cli upload-dif --org my-org --project my-app build/debug-info/

# Upload to Firebase Crashlytics
firebase crashlytics:symbols:upload \
  --app=1:123456:android:abc123 \
  build/debug-info/

// Runtime string decryption — store encrypted, decrypt at use
import 'dart:convert';
import 'package:crypto/crypto.dart';

class ObfuscatedStrings {
  /// XOR-based string deobfuscation. The key and encrypted value
  /// are generated at build time by a custom build script.
  static String decode(List<int> encoded, List<int> key) {
    final result = <int>[];
    for (var i = 0; i < encoded.length; i++) {
      result.add(encoded[i] ^ key[i % key.length]);
    }
    return utf8.decode(result);
  }
}

import 'package:freerasp/freerasp.dart';

Future<void> initSecurityChecks() async {
  final config = TalsecConfig(
    androidConfig: AndroidConfig(
      packageName: 'com.example.app',
      signingCertHashes: ['EXPECTED_HASH'],
      supportedStores: ['com.android.vending'], // Google Play only
    ),
    iosConfig: IOSConfig(
      bundleIds: ['com.example.app'],
      teamId: 'TEAM_ID',
    ),
    watcherMail: 'security@example.com',
  );

  final callback = ThreatCallback(
    onRootDetected: () => _handleThreat('root'),
    onJailbreakDetected: () => _handleThreat('jailbreak'),
    onDebuggerDetected: () => _handleThreat('debugger'),
    onTamperDetected: () => _handleThreat('tamper'),
    onHookDetected: () => _handleThreat('hook'),
    onUnofficialStoreDetected: () => _handleThreat('unofficial_store'),
  );

  await Talsec.instance.start(config, callback: callback);
}

void _handleThreat(String type) {
  // Tiered response based on threat severity and app requirements
  switch (type) {
    case 'root':
    case 'jailbreak':
      // Option 1: warn and restrict sensitive features
      // Option 2: refuse to run entirely (banking apps)
      _restrictSensitiveFeatures();
    case 'debugger':
    case 'hook':
      // Likely active attack — terminate immediately
      _terminateApp();
    case 'tamper':
      // Binary has been modified — refuse to run
      _terminateApp();
    default:
      _logSecurityEvent(type);
  }
}

import 'package:flutter/services.dart';

class ScreenProtection {
  static const _channel = MethodChannel('com.example.app/security');

  /// Call when entering a sensitive screen (e.g., account details)
  static Future<void> enableProtection() async {
    await _channel.invokeMethod('enableScreenProtection');
  }

  /// Call when leaving the sensitive screen
  static Future<void> disableProtection() async {
    await _channel.invokeMethod('disableScreenProtection');
  }
}

// android/app/src/main/kotlin/.../MainActivity.kt
import android.view.WindowManager
import io.flutter.embedding.android.FlutterActivity
import io.flutter.embedding.engine.FlutterEngine
import io.flutter.plugin.common.MethodChannel

class MainActivity : FlutterActivity() {
    override fun configureFlutterEngine(flutterEngine: FlutterEngine) {
        super.configureFlutterEngine(flutterEngine)
        MethodChannel(flutterEngine.dartExecutor.binaryMessenger,
            "com.example.app/security"
        ).setMethodCallHandler { call, result ->
            when (call.method) {
                "enableScreenProtection" -> {
                    window.setFlags(
                        WindowManager.LayoutParams.FLAG_SECURE,
                        WindowManager.LayoutParams.FLAG_SECURE
                    )
                    result.success(null)
                }
                "disableScreenProtection" -> {
                    window.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)
                    result.success(null)
                }
                else -> result.notImplemented()
            }
        }
    }
}

import 'package:flutter/material.dart';

class SecureApp extends StatefulWidget {
  final Widget child;
  const SecureApp({super.key, required this.child});

  @override
  State<SecureApp> createState() => _SecureAppState();
}

class _SecureAppState extends State<SecureApp> with WidgetsBindingObserver {
  bool _obscured = false;

  @override
  void initState() {
    super.initState();
    WidgetsBinding.instance.addObserver(this);
  }

  @override
  void dispose() {
    WidgetsBinding.instance.removeObserver(this);
    super.dispose();
  }

  @override
  void didChangeAppLifecycleState(AppLifecycleState state) {
    setState(() {
      _obscured = state == AppLifecycleState.inactive ||
          state == AppLifecycleState.hidden;
    });
  }

  @override
  Widget build(BuildContext context) {
    return Stack(
      children: [
        widget.child,
        if (_obscured)
          const Positioned.fill(
            child: ColoredBox(color: Colors.white),
          ),
      ],
    );
  }
}

import 'package:flutter/foundation.dart';

void initApp() {
  if (kDebugMode) {
    // Never reaches production, but explicit is better than implicit
    print('Running in debug mode — security checks relaxed');
    return;
  }

  if (kProfileMode) {
    // Profile builds should still enforce security
  }

  // kReleaseMode — full security enforcement
  _initSecurityChecks();
}

// Assert-based check (stripped in release builds)
bool get isDebugMode {
  bool debug = false;
  assert(() {
    debug = true;
    return true;
  }());
  return debug;
}

import 'dart:async';
import 'package:flutter/services.dart';

class SecureClipboard {
  static Timer? _clearTimer;

  /// Copy a value and auto-clear after [timeout].
  static Future<void> copyWithExpiry(
    String value, {
    Duration timeout = const Duration(seconds: 30),
  }) async {
    await Clipboard.setData(ClipboardData(text: value));

    _clearTimer?.cancel();
    _clearTimer = Timer(timeout, () {
      Clipboard.setData(const ClipboardData(text: ''));
    });
  }
}

class AuthManager {
  final SecureTokenStore _store;
  String? _accessToken; // in-memory only — cleared on app kill

  AuthManager(this._store);

  Future<void> initialize() async {
    final refreshToken = await _store.refreshToken;
    if (refreshToken != null) {
      await _refreshSession(refreshToken);
    }
  }

  Future<void> login(String email, String password) async {
    final response = await _api.login(email: email, password: password);
    _accessToken = response.accessToken;
    await _store.saveTokens(
      accessToken: response.accessToken,
      refreshToken: response.refreshToken,
    );
  }

  Future<String> getValidToken() async {
    if (_accessToken != null) return _accessToken!;

    final refreshToken = await _store.refreshToken;
    if (refreshToken == null) throw UnauthenticatedException();

    return _refreshSession(refreshToken);
  }

  Future<String> _refreshSession(String refreshToken) async {
    try {
      final response = await _api.refresh(refreshToken: refreshToken);
      _accessToken = response.accessToken;
      // Rotate: old refresh token is now invalid server-side
      await _store.saveTokens(
        accessToken: response.accessToken,
        refreshToken: response.refreshToken,
      );
      return response.accessToken;
    } catch (_) {
      // Refresh failed — force re-login
      _accessToken = null;
      await _store.clearAll();
      rethrow;
    }
  }

  Future<void> logout() async {
    try {
      await _api.revoke(refreshToken: (await _store.refreshToken)!);
    } finally {
      _accessToken = null;
      await _store.clearAll();
    }
  }
}

class SessionTimeoutManager with WidgetsBindingObserver {
  static const _timeout = Duration(minutes: 5);
  DateTime _lastActivity = DateTime.now();
  Timer? _timer;

  void start() {
    WidgetsBinding.instance.addObserver(this);
    _resetTimer();
  }

  void recordActivity() {
    _lastActivity = DateTime.now();
    _resetTimer();
  }

  void _resetTimer() {
    _timer?.cancel();
    _timer = Timer(_timeout, _onTimeout);
  }

  void _onTimeout() {
    final elapsed = DateTime.now().difference(_lastActivity);
    if (elapsed >= _timeout) {
      // Clear in-memory token, navigate to lock screen
      AuthManager.instance.lockSession();
    }
  }

  @override
  void didChangeAppLifecycleState(AppLifecycleState state) {
    if (state == AppLifecycleState.resumed) {
      final elapsed = DateTime.now().difference(_lastActivity);
      if (elapsed >= _timeout) {
        _onTimeout();
      }
    }
  }

  void dispose() {
    _timer?.cancel();
    WidgetsBinding.instance.removeObserver(this);
  }
}

import 'package:flutter_appauth/flutter_appauth.dart';

class OAuthService {
  final _appAuth = const FlutterAppAuth();

  Future<TokenResponse?> signIn() async {
    final result = await _appAuth.authorizeAndExchangeCode(
      AuthorizationTokenRequest(
        'client_id',
        'com.example.app://oauth/callback',
        issuer: 'https://auth.example.com',
        scopes: ['openid', 'profile', 'email', 'offline_access'],
        // PKCE is enabled by default — code_verifier generated automatically
        additionalParameters: {'prompt': 'consent'},
      ),
    );

    if (result != null) {
      // Store tokens securely
      await SecureTokenStore().saveTokens(
        accessToken: result.accessToken!,
        refreshToken: result.refreshToken!,
      );
    }

    return result;
  }
}

<!-- android/app/src/main/AndroidManifest.xml -->
<intent-filter android:autoVerify="true">
  <action android:name="android.intent.action.VIEW" />
  <category android:name="android.intent.category.DEFAULT" />
  <category android:name="android.intent.category.BROWSABLE" />
  <!-- HTTPS link — verified against /.well-known/assetlinks.json -->
  <data android:scheme="https"
        android:host="auth.example.com"
        android:pathPrefix="/oauth/callback" />
</intent-filter>

// WRONG: tokens and PII visible in logcat / Console.app
print('Login response: $responseBody');
log('User token: ${user.accessToken}');

// RIGHT: redact sensitive fields
log('Login succeeded for user_id=${user.id}');

// Use a logging wrapper that strips sensitive keys
class SecureLogger {
  static const _redactedKeys = {
    'password', 'token', 'access_token', 'refresh_token',
    'ssn', 'credit_card', 'authorization',
  };

  static String sanitize(Map<String, dynamic> data) {
    return data.map((key, value) {
      if (_redactedKeys.contains(key.toLowerCase())) {
        return MapEntry(key, '[REDACTED]');
      }
      return MapEntry(key, value);
    }).toString();
  }
}

# android/app/proguard-rules.pro

# Keep Flutter engine
-keep class io.flutter.** { *; }
-keep class io.flutter.plugins.** { *; }

# Keep flutter_secure_storage native code
-keep class com.it_nomads.fluttersecurestorage.** { *; }

# Keep serialization classes used by json_serializable
-keepclassmembers class * {
  @com.google.gson.annotations.SerializedName <fields>;
}

# Strip metadata that could help reverse engineering
-dontwarn javax.annotation.**
-renamesourcefileattribute SourceFile
-keepattributes SourceFile,LineNumberTable

android.enableR8=true

<!-- ios/Runner/Runner.entitlements -->
<key>com.apple.developer.default-data-protection</key>
<string>NSFileProtectionComplete</string>

class SensitiveBuffer {
  List<int>? _data;

  void load(List<int> sensitiveBytes) {
    _data = List<int>.from(sensitiveBytes);
  }

  List<int>? read() => _data;

  /// Overwrite memory before releasing the reference.
  void clear() {
    if (_data != null) {
      for (var i = 0; i < _data!.length; i++) {
        _data![i] = 0;
      }
      _data = null;
    }
  }
}

class PrivacyManager {
  final SecureTokenStore _tokenStore;
  final AppDatabase _db;

  PrivacyManager(this._tokenStore, this._db);

  /// Full data erasure — call on account deletion or GDPR request
  Future<void> eraseAllUserData() async {
    await Future.wait([
      _tokenStore.clearAll(),
      _db.deleteEverything(),
      _clearFileCache(),
      _resetAnalyticsId(),
    ]);
  }

  Future<void> _clearFileCache() async {
    final cacheDir = await getTemporaryDirectory();
    if (cacheDir.existsSync()) {
      await cacheDir.delete(recursive: true);
    }
  }

  Future<void> _resetAnalyticsId() async {
    // Reset any persistent analytics identifiers
    // so the user cannot be re-linked after erasure
  }
}