Flutter-permission-handler: Apple rejecting my app because of extra permissions

[a-v-ebrahimi]

🐛 Bug Report

Apple rejecting my app because of extra permissions

Expected behavior

just add permission_handler to pubspec

Configuration

Version: 4.0.0

Platform:

• [x] :iphone: iOS
• [ ] :robot: Android

Message from Apple :

ITMS-90338: Non-public API usage - The app references non-public symbols in Frameworks/Flutter.framework/Flutter: _ptrace. If method names in your source code match the private Apple APIs listed above, altering your method names will help prevent this app from being flagged in future submissions. In addition, note that one or more of the above APIs may be located in a static library that was included with your app. If so, they must be removed. For further information, visit the Technical Support Information at http://developer.apple.com/support/technical/

ITMS-90683: Missing Purpose String in Info.plist - Your app's code references one or more APIs that access sensitive user data. The app's Info.plist file should contain a NSContactsUsageDescription key with a user-facing purpose string explaining clearly and completely why your app needs the data. Starting Spring 2019, all apps submitted to the App Store that access user data are required to include a purpose string. If you're using external libraries or SDKs, they may reference APIs that require a purpose string. While your app might not use these APIs, a purpose string is still required. You can contact the developer of the library or SDK and request they release a version of their code that doesn't contain the APIs. Learn more (https://developer.apple.com/documentation/uikit/core_app/protecting_the_user_s_privacy).

ITMS-90683: Missing Purpose String in Info.plist - Your app's code references one or more APIs that access sensitive user data. The app's Info.plist file should contain a NSCalendarsUsageDescription key with a user-facing purpose string explaining clearly and completely why your app needs the data. Starting Spring 2019, all apps submitted to the App Store that access user data are required to include a purpose string. If you're using external libraries or SDKs, they may reference APIs that require a purpose string. While your app might not use these APIs, a purpose string is still required. You can contact the developer of the library or SDK and request they release a version of their code that doesn't contain the APIs. Learn more (https://developer.apple.com/documentation/uikit/core_app/protecting_the_user_s_privacy).

ITMS-90683: Missing Purpose String in Info.plist - Your app's code references one or more APIs that access sensitive user data. The app's Info.plist file should contain a NSPhotoLibraryUsageDescription key with a user-facing purpose string explaining clearly and completely why your app needs the data. Starting Spring 2019, all apps submitted to the App Store that access user data are required to include a purpose string. If you're using external libraries or SDKs, they may reference APIs that require a purpose string. While your app might not use these APIs, a purpose string is still required. You can contact the developer of the library or SDK and request they release a version of their code that doesn't contain the APIs. Learn more (https://developer.apple.com/documentation/uikit/core_app/protecting_the_user_s_privacy).

ITMS-90683: Missing Purpose String in Info.plist - Your app's code references one or more APIs that access sensitive user data. The app's Info.plist file should contain a NSAppleMusicUsageDescription key with a user-facing purpose string explaining clearly and completely why your app needs the data. Starting Spring 2019, all apps submitted to the App Store that access user data are required to include a purpose string. If you're using external libraries or SDKs, they may reference APIs that require a purpose string. While your app might not use these APIs, a purpose string is still required. You can contact the developer of the library or SDK and request they release a version of their code that doesn't contain the APIs. Learn more (https://developer.apple.com/documentation/uikit/core_app/protecting_the_user_s_privacy).

ITMS-90683: Missing Purpose String in Info.plist - Your app's code references one or more APIs that access sensitive user data. The app's Info.plist file should contain a NSMotionUsageDescription key with a user-facing purpose string explaining clearly and completely why your app needs the data. Starting Spring 2019, all apps submitted to the App Store that access user data are required to include a purpose string. If you're using external libraries or SDKs, they may reference APIs that require a purpose string. While your app might not use these APIs, a purpose string is still required. You can contact the developer of the library or SDK and request they release a version of their code that doesn't contain the APIs. Learn more (https://developer.apple.com/documentation/uikit/core_app/protecting_the_user_s_privacy).

ITMS-90683: Missing Purpose String in Info.plist - Your app's code references one or more APIs that access sensitive user data. The app's Info.plist file should contain a NSSpeechRecognitionUsageDescription key with a user-facing purpose string explaining clearly and completely why your app needs the data. Starting Spring 2019, all apps submitted to the App Store that access user data are required to include a purpose string. If you're using external libraries or SDKs, they may reference APIs that require a purpose string. While your app might not use these APIs, a purpose string is still required. You can contact the developer of the library or SDK and request they release a version of their code that doesn't contain the APIs. Learn more (https://developer.apple.com/documentation/uikit/core_app/protecting_the_user_s_privacy).

[robbie-cronometer]

Also experiencing this issue. We do not require or use any of the permissions listed but Apple is picking them up when we include permission_handler. This is a summary of what Apple flagged:

ITMS-90683: Missing Purpose String in Info.plist - NSContactsUsageDescription
ITMS-90683: Missing Purpose String in Info.plist - NSCalendarsUsageDescription
ITMS-90683: Missing Purpose String in Info.plist - NSMotionUsageDescription
ITMS-90683: Missing Purpose String in Info.plist - NSSpeechRecognitionUsageDescription
ITMS-90683: Missing Purpose String in Info.plist - NSLocationAlwaysUsageDescription
ITMS-90683: Missing Purpose String in Info.plist - NSLocationWhenInUseUsageDescription
ITMS-90078: Missing Purpose String in Info.plist - Missing Push Notification Entitlement

[fvisticot]

Same pb.
My app was validated by Apple but I get the same feedback from their validation process and I was obliged to add info in plist for permissions not required for the purpose of my app

[danieldai]

This is because Apple does static analysis on submitted app, and a known issue with permission_handler

[ty0x2333]

pubspec.yaml

permission_handler:
    git:
      url: [email protected]:ty0x2333/flutter-permission-handler.git
      ref: ios_permission_selectivity

Podfile

post_install do |installer|
  installer.pods_project.targets.each do |target|
    target.build_configurations.each do |config|
      config.build_settings['ENABLE_BITCODE'] = 'NO'

      # You can remove unused permissions here
      # e.g. when you don't need camera permission, just add 'PERMISSION_CAMERA=0'
      config.build_settings['GCC_PREPROCESSOR_DEFINITIONS'] ||= [
        '$(inherited)',

        ## dart: PermissionGroup.calendar
        'PERMISSION_EVENTS=0',

        ## dart: PermissionGroup.reminders
        # 'PERMISSION_REMINDERS=0',

        ## dart: PermissionGroup.contacts
        'PERMISSION_CONTACTS=0',

        ## dart: PermissionGroup.camera
        # 'PERMISSION_CAMERA=0',

        ## dart: PermissionGroup.microphone
        # 'PERMISSION_MICROPHONE=0',

        ## dart: PermissionGroup.speech
        'PERMISSION_SPEECH_RECOGNIZER=0',

        ## dart: PermissionGroup.photos
        'PERMISSION_PHOTOS=0',

        ## dart: [PermissionGroup.location, PermissionGroup.locationAlways, PermissionGroup.locationWhenInUse]
        # 'PERMISSION_LOCATION=0',

        ## dart: PermissionGroup.notification
        # 'PERMISSION_NOTIFICATIONS=0',

        ## dart: PermissionGroup.mediaLibrary
        'PERMISSION_MEDIA_LIBRARY=0',

        ## dart: PermissionGroup.sensors
        'PERMISSION_SENSORS=0'
      ]
    end
  end
end

Note: if you use "https://pub.dev/packages/camera", then "NSPhotoLibraryUsageDescription" must be added.

more info:

1. https://github.com/ty0x2333/flutter-permission-handler/blob/ios_permission_selectivity/ios/Classes/PermissionHandlerEnums.h
2. https://github.com/ty0x2333/flutter-permission-handler/tree/ios_permission_selectivity

I submitted a PR, you can pay attention to it. https://github.com/Baseflow/flutter-permission-handler/pull/182

[mvanbeusekom]

Duplicate of #26

[mvanbeusekom]

As of version 4.1.0 (released 10th of January) it is now possible to use the solution provided by @ty0x2333 to remove not needed permissions.

[gusabdala]

Created a new issue to track removal of Apple Music permission via preprocessor defintion. https://github.com/Baseflow/flutter-permission-handler/issues/302

[soorya-ha]

I'm using the latest version
I'm still getting the issue even after updating the pod file

[aslanTT]

I'm using the latest version

me too...
version 5.0.1

[heypran]

@soorya-ha @aslanTT How did you solve it? I am still getting an issue for one Microphone permission even though I have disabled it as mentioned by @ty0x2333.

[soorya-ha]

@soorya-ha @aslanTT How did you solve it? I am still getting an issue for one Microphone permission even though I have disabled it as mentioned by @ty0x2333.

I updated my pod file like below & it worked.
In my case, I needed the camera and mic permissions, so I added all other permissions to the list.

post_install do |installer|
  installer.pods_project.targets.each do |target|
    target.build_configurations.each do |config|
      config.build_settings['ENABLE_BITCODE'] = 'NO'
      config.build_settings['DEBUG_INFORMATION_FORMAT'] = 'dwarf'

      # You can remove unused permissions here
      # for more information: https://github.com/BaseflowIT/flutter-permission-handler/blob/develop/ios/Classes/PermissionHandlerEnums.h
      # e.g. when you don't need camera permission, just add 'PERMISSION_CAMERA=0'
      config.build_settings['GCC_PREPROCESSOR_DEFINITIONS'] ||= [
        '$(inherited)',

        ## dart: PermissionGroup.calendar
        'PERMISSION_EVENTS=0',

        ## dart: PermissionGroup.reminders
        'PERMISSION_REMINDERS=0',

        ## dart: PermissionGroup.contacts
        'PERMISSION_CONTACTS=0',

        ## dart: [PermissionGroup.location, PermissionGroup.locationAlways, PermissionGroup.locationWhenInUse]
        'PERMISSION_LOCATION=0',

        ## dart: PermissionGroup.notification
        'PERMISSION_NOTIFICATIONS=0',

        ## dart: PermissionGroup.mediaLibrary
        'PERMISSION_MEDIA_LIBRARY=0',

        ## dart: PermissionGroup.sensors
        'PERMISSION_SENSORS=0',

        ## dart: PermissionGroup.speech
        'PERMISSION_SPEECH_RECOGNIZER=0'
      ]
    end
  end
end

[lukepighetti]

We use locationWhenInUse but not locationAlways, why can we not disable NSLocationAlwaysUsageDescription?

[mvanbeusekom]

@lukepighetti I have not tested this use case, but I don't see why you could not simply omit the NSLocationAlwaysUsageDescription from your Info.plist if you are only using the locationWhenInUse permission.

Does this give you an issue when submitting the App to the App Store?

[lukepighetti]

It gives us a warning that we need a string for NSLocationAlwaysUsageDescription, but it hasn't stopped us so far!

[myxiplx]

I'm trying to use this to solve the App Store Connect warning about push notifications, but even though I'd updated the Podfile and set PERMISSION_NOTIFICATIONS=0, I still get the below warning:

ITMS-90078: Missing Push Notification Entitlement - Your app appears to register with the Apple Push Notification service, but the app signature's entitlements do not include the 'aps-environment' entitlement. If your app uses the Apple Push Notification service, make sure your App ID is enabled for Push Notification in the Provisioning Portal, and resubmit after signing your app with a Distribution provisioning profile that includes the 'aps-environment' entitlement. Xcode does not automatically copy the aps-environment entitlement from provisioning profiles at build time. This behavior is intentional. To use this entitlement, either enable Push Notifications in the project editor's Capabilities pane, or manually add the entitlement to your entitlements file. For more information, see https://developer.apple.com/library/content/documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/HandlingRemoteNotifications.html#//apple_ref/doc/uid/TP40008194-CH6-SW1.

After you’ve corrected the issues, you can upload a new binary to App Store Connect.

[mvanbeusekom]

@myxiplx you can safely ignore this warning if your app isn't using Apple push notifications.

I have published multiple apps with this warning all in production at the moment.