Arab Expat

Overview

Built for: Expatriate workers in Saudi Arabia, for example from Pakistan, India, Bangladesh and Egypt, who manage Iqama and other documents, shift work, budgets and money sent home, often in Arabic, Urdu or Hindi rather than English.

Main features

• Document vault and reminders

  Tracks Iqama, driver's license, Istimara, insurance and other documents, with Umm al-Qura Hijri dates. Scans are encrypted per file and viewed in the app. Expiry reminders come from scheduled server jobs and from local notifications on the phone.

• Attendance and overtime

  Clock in and out, log breaks and overnight shifts, and set up schedules and contracts. Overtime is estimated server-side from versioned rule sets based on Article 107 of the Labor Law, with optional Ramadan hours and public holidays.

• Wallet, budgets and VAT

  Multiple wallets with balances derived from a ledger, transfers between them, monthly budgets with alerts, reports and duplicate-receipt detection. The VAT calculator handles inclusive, exclusive, zero-rated and exempt amounts.

• ZATCA receipt scanner

  Scans the QR code on Saudi e-invoices with the camera and decodes its TLV data. The same strict parser runs in the app and on the server, tested against official ZATCA examples.

• Remittance tracker

  Logs money sent home, with recipients, history and analytics, and debits the matching wallet. It tracks transfers only and never moves money. Reference exchange rates show their source and are flagged when stale.

• Offline law library

  A "Know your rights" library of 52 labor and traffic law articles copied from laws.boe.gov.sa with links to the source. Full-text search works offline in English, Arabic and Urdu, with bookmarks and updates synced as deltas.

• Sign-in and account control

  Sign-in by phone number with one-time codes, plus biometric app lock, a list of signed-in devices with remote logout, a JSON export of personal data, and account deletion that removes files and personal records.

• Four languages, RTL layouts

  English, Arabic, Urdu and Hindi, with bundled IBM Plex Sans and Noto Nastaliq Urdu fonts so every script renders properly. Layouts mirror for Arabic and Urdu, and a dark mode is included.

Development and architecture

Offline-first sync

I used a generic outbox that replays normal REST calls, so there is one validation path. Idempotency keys stop duplicates, row versions return a conflict instead of overwriting, and a gap-free change feed lets the app pull exactly what it missed.

Decimal money everywhere

Amounts are never floats. The server uses BcMath, the app uses a decimal type, amounts travel as strings, and the database stores DECIMAL columns, so balances and VAT always add up.

Encryption at rest

Passport, national ID and border numbers use field-level XChaCha20-Poly1305 encryption with key IDs and a rotation command. Document scans are encrypted per file and served through five-minute signed links that re-check ownership.

Protecting the phone side

The local database is encrypted with SQLCipher, cached files with AES-GCM, screens with personal data block screenshots, Android backups are off, and release builds only talk HTTPS.

Source-cited labor rules

Overtime rules live in versioned rule sets that cite the law they come from. Each result stores the rule set and the inputs used, so an estimate can always be explained later.

Authorization tested across the API

A matrix test covers all 121 API operations. Reading another user's data returns 404, and any new route without an access rule fails the test suite.

Release readiness

I brought known dependency advisories from 35 to 0 and upgraded the barcode scanner so the release build meets Android's 16 KB page-size requirement.

Technology

• Flutter
• Dart
• Laravel
• PHP
• MySQL
• SQLite
• Android
• Drift
• SQLCipher
• Laravel Sanctum
• Pest
• Larastan

Results

Backend tests passing

1,064Backend tests passingRun on both SQLite and MariaDB 10.4

Flutter tests passing

469Flutter tests passing

Critical and high audit findings closed

61Critical and high audit findings closedFrom my audit of the original prototype

Dependency security advisories

35 to 0Dependency security advisories