The Background

This project was developed as part of a mobile application development course at Kristianstad University in collaboration with a real Sony client.

The client was a manager from Sony’s TV testing team who needed a better way to organise student hourly workers, assign tasks, manage schedules, and track attendance across teams.

What started as a scheduling app for one team quickly evolved into a much larger cross-platform team management platform supporting multiple teams, role-based permissions, notifications, analytics, and collaborative workflows.

The Goal

The goal was to build a modern cross-platform mobile application capable of running natively on both Android and iOS from a single shared codebase.

Beyond simply implementing the client requirements, we wanted to design something scalable and production-oriented with proper backend architecture, authentication, security policies, and team workflows.

We also wanted the app to feel like a real engineering project rather than a simple university assignment, so we adopted a professional GitHub workflow with feature branches, pull requests, reviews, and protected branches.

The Stack

The mobile app was built using Kotlin Multiplatform and Compose Multiplatform, allowing the same UI and business logic to compile into native Android and native iOS applications.

Navigation and state management were handled using Voyager ScreenModels, while networking used Ktor with platform-specific engines for Android and iOS.

The backend was powered entirely by Supabase, including authentication, Postgres storage, realtime subscriptions, and object storage.

One of the most important architectural decisions was implementing Row-Level Security policies directly inside Postgres to enforce team-based permissions at the database layer.

The Architecture

The application follows a layered architecture built around Compose UI, Voyager ScreenModels, repository classes, and a shared Supabase client.

Most of the project lives inside the commonMain source set, meaning almost all UI, business logic, repositories, models, and navigation are shared between Android and iOS.

Repositories abstract all communication with Supabase, while ScreenModels expose reactive state to the UI using coroutines and StateFlow.

The backend security model relies heavily on Row-Level Security policies that determine which rows a user can read or modify based on team membership and role permissions.

My Role

Our team rotated responsibilities weekly so every developer touched frontend, backend, planning, and architecture throughout the project.

My primary ownership was the Tasks feature end-to-end, including the task cards, filtering and sorting systems, assignee management, priority and status labels, task detail modals, and repository integration with Supabase.

I also designed the backend Row-Level Security architecture that controls how users access tasks, teams, notifications, availability, and assignments based on their permissions.

Additionally, I set up the GitHub organisation structure, protected the main branch, created the PR workflow, and configured the project management board used by the team during development.

The Challenge

One of the biggest challenges was designing a secure permission system that worked consistently across both Android and iOS while remaining scalable as the project grew beyond the original brief.

Instead of handling permissions inside the mobile app itself, I implemented the access rules directly inside Postgres using Supabase Row-Level Security policies.

Another challenge was managing cross-platform state and navigation cleanly inside Kotlin Multiplatform while keeping nearly all code shared between platforms.

Because the team continuously expanded the scope during development, the data model and architecture also needed to remain flexible enough to support features like multi-team organisations, analytics, notifications, and attendance tracking without major rewrites.

Features

👾 Cross-platform Android + iOS app from a single Kotlin Multiplatform codebase.

👾 Team scheduling with interactive calendar views.

👾 Task assignment system with priorities, statuses, assignees, and filters.

👾 Multi-team organisation support with role-based permissions.

👾 Attendance tracking and shift availability management.

👾 Supabase authentication including signup, login, and password reset flows.

👾 Realtime updates through Supabase WebSocket subscriptions.

👾 Dynamic Material You theming using material-kolor.

👾 Protected GitHub workflow with feature branches and PR reviews.

Backend & Security

The backend architecture is centered around Supabase and Postgres.

Every major table — including tasks, teams, task assignments, notifications, availability, and memberships — is protected through custom Row-Level Security policies.

These policies ensure that users can only access rows belonging to teams they are members of, while administrative actions require elevated permissions defined through helper SQL functions.

This approach creates defense-in-depth because permissions are enforced directly by the database itself rather than relying entirely on client-side logic.

Results

The final application successfully delivered a fully functional cross-platform scheduling platform for the Sony client while supporting significantly more functionality than originally requested.

The Kotlin Multiplatform architecture allowed nearly the entire codebase to be shared across Android and iOS while still producing native mobile applications on both platforms.

Most importantly, the project provided hands-on experience building production-style mobile software within a collaborative engineering workflow involving a real client, backend architecture, permissions systems, and cross-platform application design.

What I Learned

This project taught me how to structure and scale a modern cross-platform mobile application using Kotlin Multiplatform and Compose Multiplatform.

I gained practical experience designing secure backend architectures with Supabase and Postgres Row-Level Security, as well as managing authentication, realtime updates, repositories, and asynchronous application state.

Working with a real client also reinforced how important communication, project management, code reviews, and iterative feedback loops are in professional software development.

Finally, the project showed how much architecture matters in collaborative applications — especially when requirements evolve rapidly and the system needs to scale beyond its original scope.