IQBoxAndroid file and video sharing app with an admin panel

The problem & workflow

Authenticated Android upload → API stores bytes and metadata → owner creates a sharing token → public viewer handles its gate → recipient streams or downloads; administrator manages the platform.

Key features

• JWT authentication, video/file uploads and storage quotas
• Private ownership and public file/folder sharing
• Streaming, downloads and Android deep links
• Background upload progress and notifications
• Ad gates, views, subscriptions, referrals, wallet and withdrawal records
• React administration and dynamic application settings

Architecture & decisions

• I store account and file metadata in PostgreSQL, while uploaded content lives in filesystem storage.
• I separate ownership permissions from public sharing tokens, keeping editing and deletion behind authenticated API checks.
• The Android app, sharing viewer and admin panel connect to the same upload and sharing workflows.

Inside the source

• server.js
• routes/files.js
• routes/folders.js
• routes/admin.js
• middleware/upload.js
• IQBox-Android/app/src/main/java/com/iqbox/app/data/api/ApiClient.kt

From an Android upload to a public sharing page

I built IQBox as an Android sharing app with an API, public sharing pages and an admin panel.

IQBox connects a Kotlin and Jetpack Compose application, an Express API, PostgreSQL, a PHP sharing viewer and a React administration panel. Keeping these surfaces together makes the upload-to-share boundary visible: private file ownership belongs to the authenticated API, while a generated sharing token permits the public viewer to locate a share. A public link must not grant deletion or unrelated folder access.

The release checks therefore include another user's folder, unauthorized deletion, invalid tokens, rejected executable content and storage quota limits. The viewer needs its own server-reachable API address; the address used by an Android emulator is different. A small local PHP router now reproduces the actual /file and /folder link shapes without a VPS configuration.

Separating product workflows from provider dependencies

The source contains ad gates, view accounting, subscriptions, referrals, wallet records and withdrawals. These are engineering workflows, not evidence of real revenue or a connected payment service. Store buttons remain hidden until a real store URL is configured, and the public demonstration identifies its generated file.

The administration review also caught an initial-loading error: statistics were still null when the folder counter rendered. Fixing that boundary let the fresh database, file list and public viewer form a coherent demonstration. Native background uploads, repeated-view policy and provider state transitions are the next verification priorities.

Project status

I deployed and tested IQBox, developing its video-sharing workflow into file and folder sharing.

Create an empty PostgreSQL database and configure env.example as .env: DB_HOST, DB_PORT, DB_USER, DB_PASSWORD, DB_NAME, JWT_SECRET and DEMO_PASSWORD. The bootstrap creates admin@example.test, demo-user@example.test and demo-other@example.test. Admin VITE_API_URL points to http://127.0.0.1:3000/api. PHP viewer API_BASE_URL must reach the same API. Android IQBOX_API_BASE_URL uses 10.0.2.2 for emulator host access.