Skip to content

fix: location-permission-revoke-handling#689

Open
David-Adegboyega wants to merge 1 commit into
rinafcode:mainfrom
David-Adegboyega:fix/location-permission-revoke-handling
Open

fix: location-permission-revoke-handling#689
David-Adegboyega wants to merge 1 commit into
rinafcode:mainfrom
David-Adegboyega:fix/location-permission-revoke-handling

Conversation

@David-Adegboyega

Copy link
Copy Markdown

Closes #591

This PR addresses a security and reliability gap in the location tracking system by ensuring the application detects OS-level location permission revocation while running in the background. Previously, revoking location permissions from device settings could leave the position watcher active and allow stale location data to persist in the application state.

What Changed
src/services/locationService.ts
Added an AppState listener to detect when the application returns to the foreground and re-check location permissions.
Implemented permission transition detection (granted → denied) to handle runtime permission revocation.
Automatically stops and removes the active location watcher when permission is revoked.
Clears cached location data and updates application state to reflect the revoked permission.
Logs permission revocation events through appLogger for improved observability and troubleshooting.
Added lifecycle management methods (cleanup() and reset()) to safely dispose of watchers and listeners.
Refactored Zustand store interactions to use .getState() for safe access outside the React component tree.
src/store/locationStore.ts (new)
Introduced a dedicated Zustand store for location state management.
Added support for:
coordinates
permissionGranted
setCoordinates()
setPermissionGranted()
clearLocation()
Provides a centralized and predictable interface for reading and clearing location state.
src/store/degradationStore.ts
Fixed an incorrect import path for featureCapabilities.
src/tests/services/locationService.test.ts (new)
Added comprehensive unit tests covering:
No-op behavior when permissions were never granted
Watcher registration after permission approval
Prevention of duplicate watcher registration
Full permission revocation flow, including watcher cleanup and store updates
Subscription and listener cleanup during service teardown
Impact
Prevents stale location data from being served after permissions are revoked.
Ensures background location watchers are properly cleaned up, reducing unnecessary resource usage.
Improves privacy and security by respecting OS-level permission changes without requiring an application restart.
Provides better operational visibility through explicit permission revocation logging.
Acceptance Criteria
✅ Position watcher stops after permission revocation is detected.
✅ Location coordinates are cleared immediately on revoke.
✅ No stale location data remains available to consumers.
✅ Permission state is updated to reflect revocation.
✅ Unit tests verify watcher removal and cleanup behavior.

@drips-wave

drips-wave Bot commented Jun 26, 2026

Copy link
Copy Markdown

@David-Adegboyega Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@RUKAYAT-CODER

Copy link
Copy Markdown
Contributor

Kindly resolve conflict

1 similar comment
@RUKAYAT-CODER

Copy link
Copy Markdown
Contributor

Kindly resolve conflict

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Security] Location service continues watching position after permission is revoked at OS level

2 participants