-
Notifications
You must be signed in to change notification settings - Fork 4
Feat: End to end wallet Integration with minting pages #5
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
3b7d953
79d0594
ba804f1
b9e65ce
d48c940
d6aaf14
3bd30ee
769d602
79cc140
4174c42
05f096d
cd5958b
2e09696
04fd556
35f2e20
c5aae30
15713d5
af3e39f
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1 +1,5 @@ | ||
WALLETCONNECT_PROJECT_ID=<WALLETCONNECT_PROJECT_ID> | ||
WALLETCONNECT_PROJECT_ID=<WALLETCONNECT_PROJECT_ID> | ||
API_KEY=<PINATA_API_KEY> | ||
API_SECRET=<PINATA_API_SECRET> | ||
ALCHEMY_API_KEY=<ALCHEMY_API_KEY> | ||
CONTRACT_ADDRESS=<CONTRACT_ADDRESS> |
Original file line number | Diff line number | Diff line change | ||||
---|---|---|---|---|---|---|
@@ -1,4 +1,25 @@ | ||||||
<manifest xmlns:android="http://schemas.android.com/apk/res/android"> | ||||||
<uses-permission android:name="android.permission.INTERNET"/> | ||||||
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/> | ||||||
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/> | ||||||
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/> | ||||||
<uses-permission android:name="android.permission.VIBRATE"/> | ||||||
<uses-permission android:name="android.permission.WAKE_LOCK"/> | ||||||
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/> | ||||||
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/> | ||||||
<uses-permission android:name="android.permission.ACCESS_BACKGROUND_LOCATION"/> | ||||||
<uses-permission android:name="android.permission.CAMERA"/> | ||||||
<uses-permission android:name="android.permission.RECORD_AUDIO"/> | ||||||
<uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES"/> | ||||||
<uses-permission android:name="android.permission.BLUETOOTH"/> | ||||||
<uses-permission android:name="android.permission.FOREGROUND_SERVICE" /> | ||||||
<uses-permission android:name="android.permission.ACCESS_BACKGROUND_LOCATION" /> | ||||||
<uses-permission android:name="android.permission.FOREGROUND_SERVICE_LOCATION"/> | ||||||
<uses-permission android:name="android.permission.POST_NOTIFICATIONS"/> | ||||||
|
||||||
|
||||||
|
||||||
|
||||||
<queries> | ||||||
<package android:name="io.metamask"/> | ||||||
<package android:name="com.wallet.crypto.trustapp"/> | ||||||
|
@@ -8,7 +29,12 @@ | |||||
<application | ||||||
android:label="tree_planting_protocol" | ||||||
android:name="${applicationName}" | ||||||
android:usesCleartextTraffic="true" | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Security concern: Cleartext network traffic enabled. Enabling If this is needed for development, consider using build variants: - android:usesCleartextTraffic="true"
+ android:usesCleartextTraffic="false" Or use network security config for specific domains if HTTP is required for certain services. 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents
|
||||||
android:icon="@mipmap/ic_launcher"> | ||||||
<service | ||||||
android:name="com.baseflow.geolocator.GeolocatorService" | ||||||
android:exported="false" | ||||||
android:foregroundServiceType="location"/> | ||||||
<activity | ||||||
android:name=".MainActivity" | ||||||
android:exported="true" | ||||||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Verification agent
🧩 Analysis chain
Review and justify the extensive permission set.
The app requests many high-privilege permissions including location, camera, audio recording, and external storage. Ensure each permission is actually required by the NFT minting workflow and consider requesting them at runtime when needed rather than at install time for better user experience.
Please verify that all these permissions are necessary by running this script to check their usage:
🏁 Script executed:
Length of output: 97548
Audit AndroidManifest permissions
Several permissions in
android/app/src/main/AndroidManifest.xml
aren’t actually exercised by the current NFT-minting flow. Please trim the install-time permission set to only what’s used and move high-privilege requests to runtime:• Keep
•
<uses-permission android:name="android.permission.INTERNET"/>
•
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
•
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
/<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
(required by image_picker and IPFS upload)•
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
/<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
(used by LocationService)• Remove or defer to runtime
•
<uses-permission android:name="android.permission.CAMERA"/>
– no camera capture calls (pickImage(source: camera)
) in code•
<uses-permission android:name="android.permission.RECORD_AUDIO"/>
– no audio recording•
<uses-permission android:name="android.permission.ACCESS_BACKGROUND_LOCATION"/>
,<uses-permission android:name="android.permission.FOREGROUND_SERVICE"/>
,<uses-permission android:name="android.permission.FOREGROUND_SERVICE_LOCATION"/>
– app only fetches location in-app, no background service•
<uses-permission android:name="android.permission.VIBRATE"/>
,<uses-permission android:name="android.permission.WAKE_LOCK"/>
– no vibration or wake-lock usage•
<uses-permission android:name="android.permission.BLUETOOTH"/>
,<uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES"/>
,<uses-permission android:name="android.permission.POST_NOTIFICATIONS"/>
– not referenced by any Dart or native codeLocations to update:
• android/app/src/main/AndroidManifest.xml (lines 2–18) – remove unused
<uses-permission>
entries• lib/utils/services/get_current_location.dart – continue prompting for fine/coarse location at runtime when the user lands on the map screen
By stripping out unused install-time permissions and requesting only what you need when you need it, you’ll improve the user’s trust and comply with Play Store best practices.
🤖 Prompt for AI Agents