The mobile client of LibreDB Studio, for Android and iOS. Sign in with your organization's Keycloak account, see the databases Studio offers you, look inside them, and run SQL from your phone.
Studio stays the only place that holds database credentials and talks to the databases. The phone holds a Keycloak session and sends Keycloak's access token to Studio; under LibreDB Platform, Studio shows each person exactly the connections an admin granted them.
The project is at its start.
| Feature | Status |
|---|---|
| Sign-in through Keycloak (PKCE, refresh, logout) | Done |
| Connection list | First version |
| Studio API layer | Done |
| Object browser | Planned |
| SQL editor | Planned |
| Grant a connection as an admin | Planned, needs Platform v1 |
The plan, milestone by milestone, is in docs/roadmap.md.
Phone (this app) Keycloak LibreDB Studio
─────────────── ──────── ──────────────
1. Sign in (PKCE) ───────────────▶ realm, client libredb-mobile
◀─────────────── ID token, access token, refresh token
2. API call ── Authorization: Bearer <access token> ─────▶ checks issuer, audience, client, role
◀──────────────────────────────────────────── connections, objects, query results
3. Token expired ── refresh ────▶ new tokens
Studio accepts the token through its bearer channel for native clients (OIDC_BEARER_AUDIENCE), which is on Studio's main branch and in no release yet: Studio 1.0.0 does not have it.
docs/architecture.md describes the layers of the app and the Studio contract they follow.
You need FVM, Docker with Compose v2.23.1 or newer, and an Android emulator or an iOS simulator.
fvm install && fvm flutter pub get
# Keycloak and Studio on https://localhost:8443 and https://localhost:9443
docker compose -f tool/studio-dev/docker-compose.yml up -d --wait
# Android emulator: trust the local CA and forward the ports, after every emulator boot
tool/studio-dev/trust-android-emulator.sh
fvm flutter run --target lib/main/main_prod.dart --dart-define-from-file=tool/studio-dev/studio-dev.envSign in as admin / admin or user / user.
docs/studio.md explains the stack, the iOS simulator and how to point the app at your own Studio and Keycloak.
Without a Studio, the app runs against recorded answers, and "Sign in with SSO" signs in through a debug-only stand-in for Keycloak (docs/oidc.md):
fvm flutter run --target lib/main/main_local.dartscripts/generate_l10n.sh # regenerate lib/generated after an ARB change
fvm dart format . --line-length=120 # format
fvm flutter analyze # lint
fvm flutter test # all tests
fvm flutter test --coverage # with coverage; CI requires 65 percent or moreGenerated code is never edited by hand: lib/generated comes only from scripts/generate_l10n.sh, which runs intl_utils and formats its output at 120 columns, and CI fails when the committed files differ from what it writes.
The code follows a feature-first clean architecture with BLoC; CLAUDE.md holds the conventions for people and coding agents alike, and docs/testing-architecture.md the test structure.
| Document | What it covers |
|---|---|
| docs/roadmap.md | Milestones and what each one delivers |
| docs/architecture.md | App layers, the Studio contract, errors, sessions and security |
| docs/studio.md | Keycloak and Studio settings, the local stack, device setup |
| docs/oidc.md | The OpenID Connect sign-in in depth |
| docs/http-client.md | Retries, idempotency keys and the response cache |
| docs/security.md | Token storage, certificate pinning, screen capture protection and the inactivity sign-out |
| docs/crash-reporting.md | Sentry and what it masks before an event leaves the device |
| docs/development.md | Toolchain, test slices, the feature generator and CI |
| docs/testing-architecture.md | Test layers, doubles and guard tests |
| docs/mock-architecture.md | How recorded answers in assets/mock/ are served |
| docs/feature-first-clean-boundaries.md | Layer boundaries and dependency rules |
Issues are welcome: report a bug or propose a change in GitHub Issues. Pull requests from outside the team are not accepted at this time, as CONTRIBUTING.md explains, and SECURITY.md says how to report a vulnerability. For licensing, write to info@libredb.org.
LibreDB Mobile is source-available under the Elastic License 2.0, with SEKOYA GRUP BİLİŞİM VE TEKNOLOJİ LİMİTED ŞİRKETİ as the licensor. You may use, copy, distribute and modify it. You may not provide it to third parties as a hosted or managed service, or alter, remove or obscure any licensing, copyright or other notices of the licensor. This is a summary: the LICENSE file holds the full terms.
The app includes code from the flutter-bloc-advanced template, which is licensed under the MIT License; NOTICE reproduces that license. The app bundles NOTICE and shows it under Settings, Licenses.