Appearance
Mobile app
Your store as an app on iOS and Android: the kitloom app signs in, prices its cart, places orders and gets push about them from this site.
kitloom/ · admins: kitloom/, kitloom/
Video lessons
Recorded in the Filament admin; the Nova admin works the same way.
Your store as an app on iPhone and Android. The kitloom app is one app for every kitloom site: it reads your catalogue from the same addresses as your site (every page answers as JSON), and it asks this module for what a phone needs beyond that — to sign in, to price the cart it keeps, to place an order, to show the account, and to be told by push when an order moves. One admin, one database, three screens: the site, the iPhone, the Android phone.
The app itself is built from your site's name, icon and colours and published under your own Apple and Google accounts (see Getting the app built). This module is the site's side of it. The admin pages are kitloom/mobile-apps-filament or kitloom/mobile-apps-nova: Mobile app → Settings and Devices.
What the owner does
- Settings → Serve the app. Until it is on, the app's routes answer "not found" and nothing is sent to any phone.
- Install links. Where the app is installed from: the App Store and Google Play links once it is listed, or a public TestFlight link and an APK while it is being tried. The app shows them to nobody; your site's theme and the module's banner do.
- App Store banner. With the App Store id (the number in the App Store link), Safari on an iPhone offers the app at the top of every page of the site. One meta tag, no script, no cookie.
- Push. On, the customer's phone is told when their order is placed and whenever its status changes, in the site's language. Push goes through Expo's push service, which holds the app's Apple and Google credentials; an access token from Expo's dashboard is optional and kept encrypted.
- Oldest app version served. An older app is told to update before it goes on. Leave it empty to serve every version.
- Downloadable products. Off by default: a downloadable product is bought on the site only, because Apple makes an app sell digital goods through its own purchases. Physical goods and services are paid as on the site.
Devices lists the phones the app runs on — the platform, the app's version, whose it is, when it was last seen. Delete one and it gets no more push.
What the app does on the site
- Signs in with the email or login name and the password, as the site's login form takes them, with the same locks against guessing. A sign-in makes an application password named after the phone ("Ada's iPhone · Green Pantry"), which the phone keeps as its token: it is listed with the user's other application passwords (REST API → Application passwords, and on their profile), and revoking it signs the phone out. An account that signs in with a second factor (kitloom/two-factor) is asked to use the site: the app has no step for the code.
- Signs up while Account sign-up is on in the shop's settings, and asks for a lost password through the site's own email.
- Prices its cart. The cart lives on the phone. The site prices it — the lines with their cards, the coupons, the shipping rates for the address, the taxes, the total — and says on each line what cannot be bought (sold out, gone, a download). A signed-in customer's lines are also the ones the site keeps for them, so the phone and the browser share one cart.
- Places the order as the site's checkout does, with the same fields and checks, as the customer or as a guest while the shop allows it. Cash on delivery and a bank transfer end in the app; an online gateway's page opens in the phone's browser, and the app reads the order back to learn it is paid.
- Shows the account: the sections every module offers the account page — orders, addresses, downloads, and bookings' appointments once kitloom/bookings is installed. The app names no module; a section installed later is there at once.
- Asks for the account to be erased. The App Store requires that an app which makes accounts lets the user delete theirs from the app. With kitloom/privacy installed, the app files an erasure request for the user's own email, as the owner files one: the person confirms it from the email, and the owner erases what the law lets go under Tools → Erase Personal Data. Without kitloom/privacy the app shows the site's email instead.
With kitloom/privacy, Tools → Export Personal Data lists the user's devices (never the push token), and Erase Personal Data forgets them.
Getting the app built
The app's code is kitloom/, an Expo (React Native) project. One file, kitloom., names the site: npm run configure -- reads this module's app/ and writes the name, the icon and the colours into it. Then eas build makes the iPhone and Android builds under your own Apple Developer and Google Play accounts, and TestFlight and Google Play's testing tracks hand them to your first testers before the stores list them. Apple lists a store that ships; a demo store is refused.
Routes
Under the site's REST root, /, with WordPress's JSON errors. A phone sends its token as Authorization:; no session, no CSRF. Every route answers mobile_ (404) while the app is not served, and mobile_ (426) to an app older than the minimum (the X- header names its version).
| Route | Methods | What |
|---|---|---|
/ | GET | The site's name, icon and logo, language, currency, the shop's pages and rules, the payment methods, the account's sections, the install links, the minimum version, whether push is on |
/ | POST | login, password, app (the app's name), device (name, platform, app_, locale, push_) → token, user |
/ | POST | name, email, password, app, device → token, user (404 while sign-up is off) |
/ | GET | The token's user with their addresses |
/ | POST | Revokes the token; push_ frees the phone |
/ | POST | login — the site's reset email, the same answer whether an account matched or not |
/ | DELETE | password — an erasure request through kitloom/privacy (202), 501 without it |
/ | POST | lines (product_, quantity, variation_, variation), coupons, destination, shipping_, email → the cart as the site's cart page sees it, plus problems per line |
/ | GET, PUT | The signed-in customer's lines kept on the site |
/ | POST | lines, coupons and the checkout's fields (billing_, shipping_, ship_, shipping_, payment_, order_, createaccount, account_, terms) → order, payment. for a gateway, token for an account made here |
/ | GET | The order, the customer's own or a guest's with ?key= |
/ | GET | A section of the account by key, with its own query (id, list) |
/, / | POST | The details and an address (type: billing or shipping), as the shop's forms save them |
/ | PUT | push_, platform, name, app_, locale — a guest's phone too |
/ | DELETE | Forgets the phone |
The catalogue is not here: a product, a category, a search and the front page are read from their own addresses with Accept: (?include=catalog, product, storefront, menus), as the site's own front end reads them.
Settings
| Option | Default | What |
|---|---|---|
mobile_ | off | The app is served |
mobile_, mobile_, mobile_, mobile_ | — | Install links |
mobile_ | — | The App Store id, for the banner |
mobile_ | off | Safari's App Store banner on the site's pages |
mobile_ | — | The oldest app version served |
mobile_ | on | Push about orders |
mobile_ | — | Expo's access token, encrypted; written by the settings page only |
mobile_ | off | Downloadable products may be bought in the app |
Push
Send is a queued job: the customer's phones are told from the queue, through https://, one ticket per phone. php artisan mobile- (scheduled hourly) reads the receipts and forgets the phones Apple and Google no longer know, as Expo asks every sender to. The phones are mobile_, the tickets mobile_.
Configuration
php artisan vendor: for kitloom-: routes., push. and push., privacy., and the admin sections (filament., nova.). The rate limit and the application passwords are kitloom/api's.
Tests
From the application that installs the package: php vendor/.