Biteo App v1.0.0

Biteo App v1.0.0

Official Website: https://www.biteo.in/

Overview

Biteo is a food-delivery and restaurant ecosystem. Biteo App is the
customer-facing Flutter application that lets users browse vendors, view
menus, build a cart, pay with Razorpay, and pick up orders. This release is
the first public (v1.0.0) version prepared for GitHub publication.

Major implemented functionality

• Vendor browsing and search from the home feed.
• Vendor detail pages with menu items (veg/non-veg badges, pricing).
• Cart with per-vendor scoping, quantity management, and a 5-minute expiry
  lock.
• Address management with Google Maps / Places autocomplete and geocoding.
• Checkout with Razorpay payment, coupon selection, and order placement.
• Order success and tracking screens.
• Phone OTP authentication with profile setup.
• Profile screen with edit profile, notifications, offers, and support.
• Firebase Cloud Messaging notifications.

Technology stack

Layer	Technology
Client	Flutter / Dart, Riverpod, go_router, flutter_dotenv
Auth	Firebase Authentication (phone OTP)
Data	Firebase Firestore, Firebase Storage, Firebase Messaging
Payments	Razorpay
Maps	Google Maps / Places APIs
Backend	Firebase Cloud Functions (functions/, support-ai/)
CI	GitHub Actions (analyze, test, debug APK build)

Requirements

• Flutter stable (latest; project requires Flutter >= 3.38.4 / Dart >= 3.11.0).
• Android SDK for building/running the Android app.
• Firebase project biteo-1e76d (Android client com.biteo.biteo).

Installation / configuration

1. flutter pub get
2. Supply the real Firebase Android client config:
   android/app/google-services.json (download from the Firebase console;
   a placeholder template is at android/app/google-services.json.example).
   This file is normal Android client configuration and is not committed.
3. Optionally create a local .env from .env.example
   (RAZORPAY_KEY_ID, ENVIRONMENT). The app loads .env with
   dotenv.load(isOptional: true) and runs fine without it.
4. For Google Maps features, provide your own key (Android manifest
   placeholder / YOUR_GOOGLE_MAPS_API_KEY) — real keys must never be
   committed.

Build / test status

• flutter analyze — configured in CI (PASS expected).
• flutter test — test/cart_entity_test.dart (pure Dart) in CI.
• flutter build apk --debug — CI compile validation using the debug signing
  key; no production credentials required.
• These run on push to main and on pull requests.

Release Validation

• Secret scan: PASS
• Flutter analyze: PASS
• Flutter tests: 12/12 PASS
• Android debug build: PASS
• CI: PASS

The analyzer is gated on compile errors only
(flutter analyze --no-fatal-warnings --no-fatal-infos); pre-existing
style/info lints remain in the codebase and are non-blocking.

This release also includes post-preparation fixes on the green release
commit: the VendorEntity/VendorModel Freezed-generated dependency was
removed (plain immutable classes), the missing unreadNotificationCountProvider
import in home_app_bar.dart was added, and the CI analyzer gate was
configured for errors-only.

Known limitations

• Android is the only fully configured Firebase target; iOS, web, macOS,
  Windows, and Linux shells are present but Firebase options throw
  UnsupportedError for them.
• Local verification on this machine was limited by the absence of a Flutter
  SDK; the CI workflow is the authoritative validation path.

Security limitations

Status is classified as either FIXED NOW or DOCUMENTED — REQUIRES
FUTURE ARCHITECTURAL CHANGE.

FIXED NOW (repository hygiene)

• Android Attestation keybox linux/yk50.xml (ECDSA private key + cert
  chain) removed from the repository and blocked by .gitignore.
• Real .env, android/local.properties, and functions/.env* removed;
  .env.example template committed; .env no longer bundled as a Flutter
  asset.
• Hardcoded Google Maps API key removed from Dart source.
• android/app/google-services.json (real client config) removed from Git;
  placeholder google-services.json.example committed. It is client
  configuration, not a secret.

DOCUMENTED — REQUIRES FUTURE ARCHITECTURAL CHANGE (not fixed here)

• Firestore security rules — too permissive for production; must be
  scoped to request.auth.uid with vendor/admin collections protected.
• Cloud Storage rules — should allow only authenticated uploads to
  users/{userId}/....
• Cloud Functions authentication — createOrder, verifyPayment,
  askSupportAI, sendNotificationToAllUsers are unauthenticated HTTP
  endpoints and should verify the caller's Firebase ID token.
• createOrder user ownership validation — order userId must derive from
  the verified caller, not an unverified request field.
• verifyPayment ownership/authentication — must confirm the caller owns
  the order being verified.
• sendNotificationToAllUsers authorization — administrative broadcast must
  be restricted to authorized operators.

These backend changes are architectural and were intentionally not
modified during repository preparation. Apply them before public launch.

Checksums

See SHA256SUMS.txt alongside this artifact.

License

MIT — see LICENSE. Copyright (c) 2026 Laksh Yadav.