App mobile

Capacitor WebView around the rendered app

The app is a server-rendered Next.js PWA (server components, server actions, the copilot streaming route, auth middleware). It cannot be exported to a static bundle shipped inside the app, so the native iOS shell loads the running app over HTTP. In dev, localhost:4003 or your Mac LAN IP; in production, the HTTPS domain m.freelance-os.fr. The iOS bundle is fr.freelanceos.app, and the shell lets the web content own the env(safe-area-inset) values.

Entirely on the public API

Every screen reads and writes through @fos/api-client. withApiAuth takes the current Supabase session, extracts the JWT and passes it to the API on each call; the workspace goes in the {workspaceId} path param. Tasks, contacts, deals, interactions, inbox replies, the agenda, the analytics summary, revenue, funnel and copilot turn-saving all travel over this surface. Nothing bypasses the API to hit the database directly on the data path.

• Tasks: create, edit, change status, delete
• CRM: contacts, deals, interaction log, mark a booking completed or no-show
• Inbox: reply on a LinkedIn thread (sent via Unipile when connected, otherwise recorded locally)
• Copilot: streaming reply plus turn-saving into the Kernel's shared store
• Stats: summary, revenue and funnel over a range picked in the URL

Seven surfaces, one tab bar

Today and Copilot are always there: every member gets a home and an assistant. The Tasks, Calendar and CRM tabs appear based on the permission that unlocks them (workbench.read, booking.read, contacts.read). Inbox and Stats live in the More screen and the drawer, gated by their own rights. The Today screen makes one server pass: the day agenda, focus tasks, a 7-day analytics snapshot.

Role gating, money redacted

Permission keys come from @fos/domains-identity/permissions, the canonical registry the database persists and the Kernel gates on too. Tabs a role cannot open are hidden, not just disabled, so a setter never taps into a surface that would bounce them back to Today. Monetary figures (invoiced cash, MRR) only surface for finance roles; a setter with funnel.read sees the funnel but never the revenue.

Local auth and workspace switching

No host-to-workspace resolution like the member app: the owner picks their active workspace in-app, cookie-pinned. Switching workspace re-validates membership server-side, so a forged id can never move the user into a workspace they do not belong to. Editing the display name is scoped to the caller's own auth id, never a client-supplied id.

Offline and iOS packaging

A service worker serves an offline page when a navigation fails with no network. The iOS shell is generated by the Capacitor CLI and signed via an App Store Connect API key. A demo account (appreview@freelance-os.fr) on a demo workspace serves Apple review. This version is submitted to App Store review: the PWA runs in production, the native shell awaits Apple validation.