READ_PHONE_STATE permission added when using with expo (bare workflow)

[andrewjack-cat]

Description

react-native-reanimated/android-npm/expo/linking.gradle

Line 26 in d22fc8a

compileSdkVersion safeExtGet('compileSdkVersion', 30)

Due to no targetSdkVersion being specified in the expo gradle file. This causes the Android manifest to assume the targetSdkVersion is < 4. This causes the Android manifest merger to add the "dangerous" READ_PHONE_STATE permission.

Expected behavior

READ_PHONE_STATE should not be present in the final Android Manifest.

This can be fixed by adding this to expo/linking.gradle:

targetSdkVersion safeExtGet('targetSdkVersion', 30)

Actual behavior & steps to reproduce

READ_PHONE_STATE is present in the final Android Manifest. & can see reanimated mention in manifest-merger-logs.

uses-permission#android.permission.READ_PHONE_STATE
IMPLIED from /path/to/project/app/android/app/src/debug/AndroidManifest.xml:1:1-10:12 reason: com.swmansion.reanimated has a targetSdkVersion < 4

Snack or minimal code example

1. create bare expo app
2. install reanimated
3. build debug or release app
4. Check manifest & app/build/outputs/logs/manifest-merger-debug-report.txt for references to READ_PHONE_STATE

Package versions

name	version
react-native	0.64.3
react-native-reanimated	2.4.1
NodeJS	14
Xcode	13
Java	1.8
Gradle	6.8
expo	44.0.6

Affected platforms

• Android
• iOS
• Web

[andrewjack-cat]

cc @Kudo

[Kudo]

thanks @andrewjack-cat for the good catch. i am working on a better way for expo integration in reanimated and will address this issue together.

[SleeplessByte]

For people running into this with eas and needing a workaround today:

In app.json add a plugin:

{
  "plugins": [
     [
        "./withAndroidRemovedPermissions",
        [
          "android.permission.READ_PHONE_STATE"
        ]
      ],
   ],
}

Then, add a new file in the root of your project, called withAndroidRemovedPermissions.js

const {
  AndroidConfig,
  createRunOncePlugin,
  withAndroidManifest,
} = require('@expo/config-plugins');

const withAndroidRemovedPermissions = (config, permissions) => {
  return withAndroidManifest(config, (config) => {
    AndroidConfig.Permissions.removePermissions(config.modResults, permissions);

    const usesPermissions = config.modResults.manifest['uses-permission'] || [];

    permissions.forEach((permission) => {
      usesPermissions.push({
        $: {
          'tools:node': 'remove',
          'android:name': permission,
        },
      });
    });

    config.modResults.manifest['uses-permission'] = usesPermissions;
    config.modResults.manifest.$['xmlns:tools'] =
      'http://schemas.android.com/tools';

    return config;
  });
};

module.exports = createRunOncePlugin(
  withAndroidRemovedPermissions,
  'withAndroidRemovedPermissions'
);

You can also use this too, for example, remove android.permission.RECORD_AUDIO, which is added by expo-av, if you do not intend to record, but only play:

{
  "plugins": [
     [
        "./withAndroidRemovedPermissions",
        [
          "android.permission.RECORD_AUDIO",
          "android.permission.READ_PHONE_STATE"
        ]
      ],
   ],
}