Skip to content

RIC-T40 Permissions fix - #23

Merged
ucswift merged 1 commit into
masterfrom
develop
Jul 25, 2026
Merged

RIC-T40 Permissions fix#23
ucswift merged 1 commit into
masterfrom
develop

Conversation

@ucswift

@ucswift ucswift commented Jul 25, 2026

Copy link
Copy Markdown
Member

Pull Request Description

RIC-T40 Permissions fix

This PR eliminates the need for broad Android media and storage permissions by switching call image selection to use the Android system Photo Picker.

Changes

  1. Removed media library permission requests - The CallImagesModal component no longer calls requestMediaLibraryPermissionsAsync(), removing the runtime permission prompt for media library access.

  2. Adopted non-legacy system Photo Picker - Introduced a dedicated call-image-picker module that launches the image picker with legacy: false, ensuring the modern Android system Photo Picker is used instead of any legacy fallback.

  3. Blocked broad media permissions at the manifest level - Added blockedPermissions to the Expo Android config to explicitly prevent transitive native dependencies from injecting broad media/storage permissions (READ_MEDIA_IMAGES, READ_MEDIA_VIDEO, READ_MEDIA_VISUAL_USER_SELECTED, READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE) during manifest merging.

  4. Added test coverage - New tests verify that broad media permissions remain blocked in the config and that the image picker correctly uses the non-legacy system picker without requesting broad media access.

Impact

This improves user privacy and aligns with modern Android best practices. Users selecting call images will no longer be prompted to grant access to their entire media library; instead, they interact directly with the system Photo Picker, which provides scoped, session-level access only to the selected image.

@coderabbitai

coderabbitai Bot commented Jul 25, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@ucswift, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 50 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: cb8f94b4-b1c0-42b0-9a80-51011c5a069b

📥 Commits

Reviewing files that changed from the base of the PR and between 5f95be3 and e09137a.

📒 Files selected for processing (5)
  • app.config.ts
  • plugins/__tests__/android-media-permissions.test.ts
  • src/components/calls/__tests__/call-image-picker.test.ts
  • src/components/calls/call-image-picker.ts
  • src/components/calls/call-images-modal.tsx
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch develop

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@Resgrid-Bot

Resgrid-Bot commented Jul 25, 2026

Copy link
Copy Markdown

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

Kody Guide: Usage and Configuration
Interacting with Kody
  • Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

  • Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

  • Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration
Review Options

The following review options are enabled or disabled:

Options Enabled
Bug
Performance
Security
Business Logic

Access your configuration settings here.


await expect(launchCallImagePicker()).resolves.toBe(pickerResult);
expect(mockLaunchImageLibraryAsync).toHaveBeenCalledWith({
mediaTypes: ['images'],

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

kody code-review Kody Rules low

Raw string literal used for the media type risks drift from the implementation and obscures intent. Use the shared MediaType constant/enum from the picker module or Expo API, such as mediaTypes: [MediaType.Images].

Kody rule violation: Use enums instead of magic strings

Prompt for LLM

File src/components/calls/__tests__/call-image-picker.test.ts:

Line 21:

Raw string literal used for the media type risks drift from the implementation and obscures intent. Use the shared `MediaType` constant/enum from the picker module or Expo API, such as `mediaTypes: [MediaType.Images]`.

Talk to Kody by mentioning @kody

Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.

expect(mockLaunchImageLibraryAsync).toHaveBeenCalledWith({
mediaTypes: ['images'],
allowsEditing: true,
quality: 0.8,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

kody code-review Kody Rules low

Inlined magic number for the quality value risks inconsistency between the test and implementation, also occurring in src/components/calls/call-image-picker.ts:7-7. Import and reuse the named constant from launchCallImagePicker, such as quality: CALL_IMAGE_PICKER_QUALITY.

Kody rule violation: Replace magic numbers with named constants

Prompt for LLM

File src/components/calls/__tests__/call-image-picker.test.ts:

Line 23:

Inlined magic number for the quality value risks inconsistency between the test and implementation, also occurring in `src/components/calls/call-image-picker.ts:7-7`. Import and reuse the named constant from `launchCallImagePicker`, such as `quality: CALL_IMAGE_PICKER_QUALITY`.

Talk to Kody by mentioning @kody

Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.

@@ -0,0 +1,9 @@
import * as ImagePicker from 'expo-image-picker';

export const launchCallImagePicker = (): Promise<ImagePicker.ImagePickerResult> =>

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

kody code-review Kody Rules low

Missing JSDoc documentation for the Promise-returning function obscures the resolve value shape, rejection conditions, and await requirement. Add a JSDoc block specifying @returns {Promise<ImagePicker.ImagePickerResult>} and detailing rejection conditions like permission denial or user cancellation.

Kody rule violation: Document async/Promise behavior and errors

Prompt for LLM

File src/components/calls/call-image-picker.ts:

Line 3:

Missing JSDoc documentation for the Promise-returning function obscures the resolve value shape, rejection conditions, and await requirement. Add a JSDoc block specifying `@returns {Promise<ImagePicker.ImagePickerResult>}` and detailing rejection conditions like permission denial or user cancellation.

Talk to Kody by mentioning @kody

Was this suggestion helpful? React with 👍 or 👎 to help Kody learn from this interaction.

@ucswift
ucswift merged commit d613aa5 into master Jul 25, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants