fix(mobile): comply with Android media permissions policy

Author: DIYgod

apps/mobile/app.config.base.ts

@@ -111,6 +111,17 @@ export default ({ config }: ConfigContext): ExpoConfig => {
     },
     android: {
       package: "is.follow",
+      // Media selection uses system pickers; saving only needs write access on older Android versions.
+      blockedPermissions: [
+        "android.permission.ACCESS_MEDIA_LOCATION",
+        "android.permission.CAMERA",
+        "android.permission.READ_EXTERNAL_STORAGE",
+        "android.permission.READ_MEDIA_AUDIO",
+        "android.permission.READ_MEDIA_IMAGES",
+        "android.permission.READ_MEDIA_VIDEO",
+        "android.permission.READ_MEDIA_VISUAL_USER_SELECTED",
+        "android.permission.RECORD_AUDIO",
+      ],
       adaptiveIcon: {
         foregroundImage: adaptiveIconPath,
         monochromeImage: adaptiveIconPath,
@@ -158,7 +169,8 @@ export default ({ config }: ConfigContext): ExpoConfig => {
         {
           photosPermission: "Allow $(PRODUCT_NAME) to access your photos.",
           savePhotosPermission: "Allow $(PRODUCT_NAME) to save photos.",
-          isAccessMediaLocationEnabled: true,
+          isAccessMediaLocationEnabled: false,
+          granularPermissions: [],
         },
       ],
       "expo-apple-authentication",
@@ -192,6 +204,8 @@ export default ({ config }: ConfigContext): ExpoConfig => {
         "expo-image-picker",
         {
           photosPermission: "Allow $(PRODUCT_NAME) to access your photos.",
+          cameraPermission: false,
+          microphonePermission: false,
         },
       ],
       [

apps/mobile/scripts/app-config.base.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest"
 
-import { resolveRuntimeVersion } from "../app.config.base"
+import createExpoConfig, { resolveRuntimeVersion } from "../app.config.base"
 
 describe("resolveRuntimeVersion", () => {
   it("keeps the development runtime version stable", () => {
@@ -33,3 +33,42 @@ describe("resolveRuntimeVersion", () => {
     ).toThrow(/OTA_RUNTIME_VERSION/i)
   })
 })
+
+describe("Android media permissions", () => {
+  const config = createExpoConfig({
+    config: {},
+  } as Parameters<typeof createExpoConfig>[0])
+
+  it("blocks broad media access that is not required by the app", () => {
+    expect(config.android?.blockedPermissions).toEqual([
+      "android.permission.ACCESS_MEDIA_LOCATION",
+      "android.permission.CAMERA",
+      "android.permission.READ_EXTERNAL_STORAGE",
+      "android.permission.READ_MEDIA_AUDIO",
+      "android.permission.READ_MEDIA_IMAGES",
+      "android.permission.READ_MEDIA_VIDEO",
+      "android.permission.READ_MEDIA_VISUAL_USER_SELECTED",
+      "android.permission.RECORD_AUDIO",
+    ])
+  })
+
+  it("configures media APIs for picker and write-only access", () => {
+    expect(config.plugins).toContainEqual([
+      "expo-media-library",
+      {
+        photosPermission: "Allow $(PRODUCT_NAME) to access your photos.",
+        savePhotosPermission: "Allow $(PRODUCT_NAME) to save photos.",
+        isAccessMediaLocationEnabled: false,
+        granularPermissions: [],
+      },
+    ])
+    expect(config.plugins).toContainEqual([
+      "expo-image-picker",
+      {
+        photosPermission: "Allow $(PRODUCT_NAME) to access your photos.",
+        cameraPermission: false,
+        microphonePermission: false,
+      },
+    ])
+  })
+})

apps/mobile/src/components/ui/image/utils.ts

@@ -3,7 +3,7 @@ import { IMAGE_PROXY_URL } from "@follow/utils/img-proxy"
 import ImageEditor from "@react-native-community/image-editor"
 import * as FileSystem from "expo-file-system/legacy"
 import type { ImageProps, ImageSource } from "expo-image"
-import { saveToLibraryAsync, usePermissions } from "expo-media-library"
+import { Asset, usePermissions } from "expo-media-library"
 import * as Sharing from "expo-sharing"
 import { useCallback } from "react"
 import { Image } from "react-native"
@@ -145,7 +145,7 @@ export const saveImageToMediaLibrary = async ({ uri }: { uri: string }) => {
   const croppedImage = await getImageData(uri)
   const filename = `${extractFilenameFromUrl(uri)}.png`
   const { filePath, cleanup } = await createTempFile(croppedImage.base64, filename)
-  await saveToLibraryAsync(filePath)
+  await Asset.create(filePath)
   cleanup()
 }
 
@@ -161,7 +161,7 @@ export const saveImageToMediaLibrary = async ({ uri }: { uri: string }) => {
  */
 export function useSaveImageToMediaLibrary() {
   const [permissionResponse, requestPermission, getPermission] = usePermissions({
-    granularPermissions: ["photo"],
+    writeOnly: true,
   })
   return useCallback(
     async (uri: string) => {