System Startup and Authentication Flow
On launch, the SAPOT mobile application checks for a previously stored authentication session in local secure storage. If a valid token is found, the user profile is retrieved from the server; if the token has expired, a silent refresh is requested from the server, and failure to refresh forces the user to log in again. In the absence of any authenticated session, the app checks for an existing guest session and restores it directly without contacting the server. Upon successful authentication, GPS location streaming is activated and the app synchronizes its local data with the server before navigating to the home screen. Guest sessions bypass all server communication and proceed directly to the home screen in LAN-only mode.
LAN Messaging Flow
When a user sends a message, the mobile app selects the best available transport path in descending order of priority. If a direct peer-to-peer connection between the two devices is already active, the message is transmitted immediately without server involvement. If no direct connection exists, the app attempts to reach the recipient over the local area network via the router using a direct TCP link; if the recipient is unreachable on the LAN, the message is relayed through the central server over the network, or queued locally if the server is also unavailable. Once the recipient's device comes online, queued messages are retried and upon delivery the message record is synchronized with the server.
Voice and Video Call Flow
A voice or video call is initiated when the caller's device sends a call request to the recipient through the network; if the recipient does not respond within the timeout window or declines, the call is recorded as missed or declined respectively. Upon acceptance, both devices exchange signaling messages through the network to negotiate a direct peer-to-peer media connection. Once established, audio and video stream directly between the two devices without passing through the central server. On call termination, the call duration is recorded and the call log is synchronized with the server.
GPS Location Sharing Flow
GPS location sharing in SAPOT operates through two complementary sub-flows for authenticated users. In the streaming sub-flow, the mobile app opens a dedicated connection to the server and continuously forwards the device's GPS coordinates whenever the position changes; if the connection is lost, the app reconnects automatically every three seconds. Streaming requires both the user's sharing preference to be enabled and the device's location permission to be granted by the operating system. In the viewing sub-flow, the map screen polls the server every five seconds for the latest positions of all sharing users and renders them as markers on the map, stopping when the user navigates away.
SMS via GSM Module Flow
The SAPOT system enables SMS communication through a hardware bridge attached to the server node, consisting of a SIM-800L GSM module connected to the server via an Arduino UNO over a serial interface. In the send path, the mobile app forwards the outbound message and target phone number to the server over the local network; the server relays the payload to the GSM module via the Arduino, which transmits the SMS through the cellular network to the recipient's phone. A server-reachability check is performed before the request is forwarded — if the server is unreachable, the operation fails immediately. In the receive path, an incoming SMS at the GSM module triggers a notification to the server via the Arduino, after which the server delivers the message to the intended recipient's mobile app over the network.
Guest User Flow
Guest users access SAPOT without an account by providing only a first and last name; the app generates a username and a unique local identifier, storing the guest session entirely on the device without contacting the server. For the duration of the session, all communication is restricted to direct TCP connections between devices over the local area network via the router — server relay and peer-to-peer media channels are not available. On logout, all locally stored messages, conversations, and session data are permanently deleted from the device with no option for recovery. Should the guest elect to create a full account, the registration request is submitted to the server using the guest's existing local identifier as the assigned user ID, ensuring that all previously stored local data is automatically associated with the new account upon synchronization.
Security Implementation
Layer Summary
Encryption and Decryption Flow
SAPOT encrypts data at two points: before writing messages to the local database, and before sending data over the network. The key that protects stored messages is derived from the user's password and retrieved from the server on each login; for guest users, a temporary key is generated on the device and discarded on logout. Network traffic between peers is protected by a separate handshake that produces a one-time shared key for each connection. WebSocket signaling messages use a static key pair unique to the user's account. All encryption uses the NaCl cryptographic library.