How to Set Up a Secure File Sharing System in FlutterFlow

Create a shared_files collection with fields: uploaderId (String), filename (String), storagePath (String, the Firebase Storage path), size (int, bytes), mimeType (String), sharedWith (list of Strings, userIds or 'public'), password (String, hashed, optional), expiresAt (Timestamp, optional), downloadCount (int, default 0), createdAt (Timestamp). The storagePath stores the internal Storage path, never the direct download URL. The sharedWith array controls who can access the file. Setting it to ['public'] allows anyone with the link. An optional password adds a second layer of protection. The expiresAt field makes links expire after a set date.

Create an UploadFile page with a FlutterFlowUploadButton configured for the file types you want to support (documents, images, PDFs). After upload, the button returns the Storage file path. Below the upload button, add sharing options: a Switch for public vs private sharing, a TextField for entering userIds or email addresses to share with (for private), a Switch to enable password protection with a TextField for the password, and a DateTimePicker for optional expiry date. The Share button creates the shared_files Firestore document with all configured options and generates a shareable link (your app URL + the shared_files document ID).

Create a Cloud Function called getSecureDownloadUrl that receives the shared file document ID and optionally a password. The function reads the shared_files document from Firestore and performs access checks: verify the requester is authenticated, check if their userId is in the sharedWith array or if sharedWith contains 'public', verify the password hash matches if password protection is enabled, and check if the current time is before expiresAt. If all checks pass, generate a signed URL for the Storage file with a 15-minute expiry using the Firebase Admin SDK's getSignedUrl method. Increment the downloadCount field. Return the signed URL to the client.

1// Cloud Function: getSecureDownloadUrl
2const functions = require('firebase-functions');
3const admin = require('firebase-admin');
4const crypto = require('crypto');
5admin.initializeApp();
6
7exports.getSecureDownloadUrl = functions.https
8  .onCall(async (data, context) => {
9    const { fileId, password } = data;
10    const uid = context.auth?.uid;
11    
12    const fileDoc = await admin.firestore()
13      .collection('shared_files').doc(fileId).get();
14    if (!fileDoc.exists) throw new functions.https
15      .HttpsError('not-found', 'File not found');
16    
17    const file = fileDoc.data();
18    
19    // Check expiry
20    if (file.expiresAt && file.expiresAt.toDate() < new Date()) {
21      throw new functions.https
22        .HttpsError('deadline-exceeded', 'Link expired');
23    }
24    
25    // Check access
26    const isPublic = file.sharedWith.includes('public');
27    const isAuthorized = uid && file.sharedWith.includes(uid);
28    const isOwner = uid === file.uploaderId;
29    if (!isPublic && !isAuthorized && !isOwner) {
30      throw new functions.https
31        .HttpsError('permission-denied', 'No access');
32    }
33    
34    // Check password
35    if (file.password) {
36      const hash = crypto.createHash('sha256')
37        .update(password || '').digest('hex');
38      if (hash !== file.password) {
39        throw new functions.https
40          .HttpsError('permission-denied', 'Wrong password');
41      }
42    }
43    
44    // Generate signed URL (15 min expiry)
45    const bucket = admin.storage().bucket();
46    const [url] = await bucket.file(file.storagePath)
47      .getSignedUrl({
48        action: 'read',
49        expires: Date.now() + 15 * 60 * 1000,
50      });
51    
52    // Track download
53    await fileDoc.ref.update({
54      downloadCount: admin.firestore.FieldValue.increment(1),
55    });
56    
57    return { url };
58  });

Create a DownloadPage that receives the fileId as a URL parameter. On Page Load, query the shared_files document to get the filename, size, and whether a password is required. Display the file info: filename, size formatted (KB/MB), and upload date. If the file requires a password, show a TextField for password entry and a Download button. If no password is needed, show the Download button directly. On button tap, call the getSecureDownloadUrl Cloud Function with the fileId and password. On success, launch the returned signed URL to start the download. On error, show the appropriate message (expired, no access, wrong password).

Create a MySharedFiles page showing all files uploaded by the current user. Add a ListView bound to shared_files where uploaderId equals the current user's ID, ordered by createdAt descending. Each list item shows: filename, size, download count, expiry date (or 'No expiry'), and the number of people it is shared with. Add action buttons: Copy Link (copies the share URL to clipboard), Edit (modify sharedWith, password, or expiry), and Delete (removes both the Firestore document and the Storage file). This gives file owners full visibility and control over their shared files.