Android API 33 broke external storage permissions checks in AttachmentsPicker composable

[SchramboVida]

Android Stream SDK 5.8.1 used in an app that targets API 33 (through 21) so the manifest permissions regarding external storage look like this:

<uses-permission
    android:name="android.permission.READ_EXTERNAL_STORAGE"
    android:maxSdkVersion="32" />
<uses-permission android:name="android.permission.READ_MEDIA_AUDIO" />
<uses-permission android:name="android.permission.READ_MEDIA_IMAGES" />
<uses-permission android:name="android.permission.READ_MEDIA_VIDEO" />
<uses-permission
    android:name="android.permission.WRITE_EXTERNAL_STORAGE"
    android:maxSdkVersion="29"
    tools:ignore="ScopedStorage" />

<application
    android:requestLegacyExternalStorage="true"
    ...

The pickerTabContent(...) composable in AttachmentsPickerImagesTabFactory and AttachmentsPickerFilesTabFactory require Manifest.permission.READ_EXTERNAL_STORAGE which like android.permission.WRITE_EXTERNAL_STORAGE is never granted on API 33 and later OS versions.

This prevents the user from selecting an existing image or file via the io.getstream.chat.android.compose.ui.messages.attachments.AttachmentsPicker composable; they can only use the camera and camcorder devices.

Considering that OS 13 is right around the corner, are there plans to fix this in an upcoming release?

[filbabic]

Hey @SchramboVida !

OS 13 is right around the corner but unfortunately not widely available yet (only pixels from what I know). We already have investigated the changes there and are aware of media permission changes required for our picker to work.

However, we cannot push a release out for API 33, because as SDK devs, that would force all of our users to have target SDK version set to 33, essentially making all users migrate to the latest API and having to update their code accordingly.

I'll cc @adasiewiczr here, since it is available on pixels and we might have to shift our priorities, but I'm not 100% sure if it'll fall into the next release or the one after that!

Thank you so much for bringing this up and helping us keep up to date! :]

[jeff-huston]

This seems related, but if it's off-topic let me know and I'll create a new issue or discussion.

In v5.10.0, the WRITE_EXTERNAL_STORAGE permissions was now updated in the stream-chat-android-ui-common to have a maxSdkVersion=32. This is causing an error in our builds, as we currently set maxSdkVersion=29 in our app's manifest. The error suggests using tools:replace="android:maxSdkVersion" to override Stream's maxSdkVersion back down to 29, but I want to ensure this is a safe change to make.

My understanding of this issue isn't deep, but it seems to me from these Android docs that once you're targeting Android 11, the WRITE_EXTERNAL_STORAGE has no effect above API level 29. That would seemingly mean it's safe for me to use tools:override to downgrade it to 29, and also that Stream should update your manifest to maxSdkVersion=29 as well.

Is my understanding here correct, or is it important to let Stream set maxSdkVersion=32 for this permission?

[filbabic]

Hey @hustoj2 !

ccing @adasiewiczr.

We've set our maxSDK version, not the target one. This means that our SDK is not yet targeting API 32/3 (Android 12 and up). This means we can use the Android SDK with that version to prepare the codebase, but at the same time not force our users (you! :D) to migrate.

If your target and/or max SDK is lower (e.g. 29), then you should be fine and shouldn't have to migrate. There are changes to the permissions of storage, yes, and we've migrated our SDK to cover that in case of Android 12. But on lower versions, things should be consistent!

[jeff-huston]

Thanks for the quick reply. I'm not fully understanding the situation just yet, and my question may not have been clear enough, so let me see if I'm understanding this.

In our manifest, we have this:

    <uses-permission
        android:name="android.permission.WRITE_EXTERNAL_STORAGE"
        android:maxSdkVersion="29" />

My understanding of that is that we're only requesting the WRITE_EXTERNAL_STORAGE permission on SDK 29 and below. I don't think that's very related to the target SDK version of our app (which happens to be 33).

In the stream-chat-android-ui-common manifest, you have this:

    <uses-permission
        android:name="android.permission.WRITE_EXTERNAL_STORAGE"
        android:maxSdkVersion="32" />

Which I believe means GetStream will cause any app it's installed in to request WRITE_EXTERNAL_STORAGE permissions all the way up to SDK 32.
Based on the Android docs, I believe if the targetSdkVersion of the app as a whole is 30 or higher (which it is in our case), then WRITE_EXTERNAL_STORAGE has no effect on levels API 30+, so GetStream shouldn't need to request the permission on API levels 30-32. The error message in our build (which started with the update to 5.11.0) itself suggests updating our manifest to this:

    <uses-permission
        android:name="android.permission.WRITE_EXTERNAL_STORAGE"
        android:maxSdkVersion="29"
        tools:replace="android:maxSdkVersion" />

This fixes our compile error, and I believe this effectively overrides the GetStream manifest to only request that permission on API 29 and below. That's the change I want to make sure is safe.
I believe this is safe, and I think if I test that attaching files is working on a phone running an API level above 29, that should confirm that it's safe.
Please let me know if I'm missing anything here, as I don't understand the situation fully.

[adasiewiczr]

hey @hustoj2,
thank you for your input. We improved the way we handed WRITE_EXTERNAL_STORAGE permission in that PR and we are going to ship it early next week!

[jeff-huston]

That's great, thank you for the followup!