From 85ec10836b519551a0d16f0c9bbfd818946111aa Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 5 Aug 2026 22:56:27 +0000
Subject: [PATCH] Request only the Bluetooth permission the app actually uses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Lint flagged ACCESS_FINE_LOCATION declared without ACCESS_COARSE_LOCATION,
which Android 12 requires to be requested together.

Rather than add the missing one, drop location entirely: the Bluetooth
transport only talks to already-paired devices, enumerating bonded
devices and opening an RFCOMM socket. Neither is a scan, so no location
access is needed. BLUETOOTH_SCAN and BLUETOOTH_ADVERTISE go for the same
reason — nothing was using them.

Discovery of unpaired devices would bring all of these back; the manifest
notes what that would require.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015qjfMiPUDshdKEUa6vxqzN
---
 app/src/main/AndroidManifest.xml              | 23 ++++++++-----------
 .../org/prolibertate/games/MainActivity.kt    | 10 +++-----
 2 files changed, 13 insertions(+), 20 deletions(-)

diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index d1e9b20..4e8e6f9 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -10,25 +10,22 @@
     <!-- Lets the app hand a downloaded APK to the system installer. -->
     <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
 
-    <!-- Bluetooth. Android 12 (API 31) split the old catch-all permissions into
-         explicit SCAN/CONNECT/ADVERTISE, so the legacy pair is capped below 31
-         and the new trio is requested at runtime above it. neverForLocation
-         tells the system we aren't deriving physical location from scans, which
-         avoids dragging in the location permission on 12+. -->
+    <!-- Bluetooth. Android 12 (API 31) replaced the catch-all BLUETOOTH
+         permission with explicit ones, so the legacy pair is capped below 31
+         and BLUETOOTH_CONNECT is requested at runtime above it.
+
+         Only CONNECT is declared because the transport talks exclusively to
+         devices that are already paired: it enumerates bonded devices and
+         opens an RFCOMM socket, neither of which is a scan. Adding discovery
+         of unpaired devices later would mean declaring BLUETOOTH_SCAN here
+         (and, below API 31, both ACCESS_FINE_LOCATION and
+         ACCESS_COARSE_LOCATION, which Android requires together). -->
     <uses-permission android:name="android.permission.BLUETOOTH"
         android:maxSdkVersion="30" />
     <uses-permission android:name="android.permission.BLUETOOTH_ADMIN"
         android:maxSdkVersion="30" />
-    <uses-permission android:name="android.permission.BLUETOOTH_SCAN"
-        android:usesPermissionFlags="neverForLocation"
-        tools:targetApi="s" />
     <uses-permission android:name="android.permission.BLUETOOTH_CONNECT"
         tools:targetApi="s" />
-    <uses-permission android:name="android.permission.BLUETOOTH_ADVERTISE"
-        tools:targetApi="s" />
-    <!-- Pre-31, Bluetooth discovery is gated behind location access. -->
-    <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"
-        android:maxSdkVersion="30" />
 
     <!-- Both radios are optional: the app is fully playable against AI without them. -->
     <uses-feature android:name="android.hardware.bluetooth" android:required="false" />
diff --git a/app/src/main/java/org/prolibertate/games/MainActivity.kt b/app/src/main/java/org/prolibertate/games/MainActivity.kt
index eb041c1..7d13af8 100644
--- a/app/src/main/java/org/prolibertate/games/MainActivity.kt
+++ b/app/src/main/java/org/prolibertate/games/MainActivity.kt
@@ -47,14 +47,10 @@ class MainActivity : ComponentActivity() {
     }
 
     private fun requestBluetoothPermissions() {
+        // Only CONNECT: the transport reaches paired devices and never scans.
+        // See the manifest for what discovery of unpaired devices would add.
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
-            bluetoothPermissions.launch(
-                arrayOf(
-                    Manifest.permission.BLUETOOTH_CONNECT,
-                    Manifest.permission.BLUETOOTH_SCAN,
-                    Manifest.permission.BLUETOOTH_ADVERTISE,
-                )
-            )
+            bluetoothPermissions.launch(arrayOf(Manifest.permission.BLUETOOTH_CONNECT))
         }
     }