Develop

app.config.ts

@@ -99,7 +99,6 @@ export default ({ config }: ConfigContext): ExpoConfig => ({
       'android.permission.FOREGROUND_SERVICE',
       'android.permission.FOREGROUND_SERVICE_MICROPHONE',
       'android.permission.FOREGROUND_SERVICE_PHONE_CALL',
-      'android.permission.FOREGROUND_SERVICE_CONNECTED_DEVICE',
       'android.permission.READ_PHONE_STATE',
       'android.permission.READ_PHONE_NUMBERS',
       'android.permission.MANAGE_OWN_CALLS',
@@ -108,6 +107,9 @@ export default ({ config }: ConfigContext): ExpoConfig => ({
     // and legacy storage permissions even when a transitive native dependency
     // contributes them during manifest merging.
     blockedPermissions: [
+      // Bluetooth PTT handsets route through the microphone FGS session, so the type is
+      // unused; Play rejects declared foreground-service types that cannot be demonstrated.
+      'android.permission.FOREGROUND_SERVICE_CONNECTED_DEVICE',
       // Background location was removed from the app (Play policy: no declarable
       // background-location feature). Block the permissions outright so a transitive
       // native dependency cannot reintroduce them during manifest merging.
@@ -151,9 +153,11 @@ export default ({ config }: ConfigContext): ExpoConfig => ({
     [
       'expo-secure-store',
       {
-        // Biometric-gated secure storage is not used (no requireAuthentication /
-        // expo-local-authentication anywhere in src); omit NSFaceIDUsageDescription.
-        faceIDPermission: false,
+        // Required even though biometric-gated storage is not used: expo-secure-store
+        // instantiates LAContext() unconditionally (SecureStoreModule.swift), so App Store
+        // static analysis flags a missing NSFaceIDUsageDescription with ITMS-90683.
+        faceIDPermission:
+          'Resgrid IC uses Face ID to unlock the securely stored credentials that keep you signed in to your department. For example, after your device locks, Face ID confirms it is you before the app restores your session.',
       },
     ],
     'expo-image',
@@ -171,19 +175,36 @@ export default ({ config }: ConfigContext): ExpoConfig => ({
     [
       'expo-location',
       {
-        // Foreground-only. The IC app centers the map and computes distances while the
-        // user has it open; it has no background-location feature, so the background /
-        // foreground-service flags and the task manager block stay off. Turning any of
-        // them back on re-adds ACCESS_BACKGROUND_LOCATION and gets the Play listing
-        // rejected for an undeclared background-location feature.
         locationWhenInUsePermission:
-          'Resgrid IC uses your location while you use the app to show your position on the incident map, to center the map when you set a call location, and to share your location in chat. For example, when you create a new call, the map starts at your current position so you can pinpoint the incident scene for responding units.',
-        // `false` deletes the key from Info.plist entirely (the plugin otherwise fills in
-        // its own default text). The "Always" strings advertise background location on
-        // iOS, and nothing here uses Core Motion.
-        locationAlwaysAndWhenInUsePermission: false,
-        locationAlwaysPermission: false,
-        motionUsagePermission: false,
+          'Resgrid IC uses your location while you use the app to show your position on the incident map and to attach your coordinates to incident actions you take. For example, when you assign a resource, your location helps place command on the scene map.',
+        locationAlwaysAndWhenInUsePermission:
+          'Resgrid IC uses your location, including in the background, to keep the incident and department maps updated with your position. For example, while you move around an incident scene, your location is periodically sent so other responders and dispatchers can see where command is, even when the app is not on screen.',
+        locationAlwaysPermission:
+          'Resgrid IC uses your location in the background to keep the incident and department maps updated with your position. For example, while you move around an incident scene, your location is periodically sent so other responders and dispatchers can see where command is, even when the app is not on screen.',
+        // Required even though getMotionActivityAsync() is never called: expo-location links
+        // CoreMotion (MotionActivityPermissionRequester), and App Store static analysis rejects
+        // the binary with ITMS-90683 whenever the framework is referenced and the string is absent.
+        motionUsagePermission:
+          'Resgrid IC uses motion data to improve the accuracy of the location shown on the department map. For example, while you are driving to a call, motion data helps distinguish travel from a stop so dispatchers see an accurate position and heading.',
+        isIosBackgroundLocationEnabled: true,
+        isAndroidBackgroundLocationEnabled: true,
+        isAndroidForegroundServiceEnabled: true,
+        taskManager: {
+          locationTaskName: 'location-updates',
+          locationTaskOptions: {
+            accuracy: 'balanced',
+            distanceInterval: 10,
+            timeInterval: 5000,
+          },
+        },
+      },
+    ],
+    [
+      'expo-task-manager',
+      {
+        taskManager: {
+          taskName: 'location-updates',
+        },
       },
     ],
     [

customManifest.plugin.js

@@ -1,5 +1,7 @@
 const { withAndroidManifest, AndroidConfig } = require('expo/config-plugins');
 
+const SERVICE_NAME = 'app.notifee.core.ForegroundService';
+
 const withForegroundService = (config) => {
   return withAndroidManifest(config, async (config) => {
     const manifest = config.modResults;
@@ -11,13 +13,23 @@ const withForegroundService = (config) => {
     const mainApplication = AndroidConfig.Manifest.getMainApplicationOrThrow(manifest);
 
     mainApplication['service'] = mainApplication['service'] || [];
-    mainApplication['service'].push({
+
+    // Idempotent: a prebuild that reuses an existing android/ dir already has this service in
+    // the base manifest — and non-clean prebuilds have already accumulated duplicates there — so
+    // drop every copy before adding the canonical one.
+    const serviceEntry = {
       $: {
-        'android:name': 'app.notifee.core.ForegroundService',
-        'android:foregroundServiceType': 'microphone|connectedDevice',
+        'android:name': SERVICE_NAME,
+        // microphone only. mediaPlayback and connectedDevice are intentionally absent: this
+        // service backs PTT capture, expo-audio owns its own mediaPlayback service for stream
+        // playback, and Bluetooth PTT handsets run on the same microphone session. Play rejects
+        // foreground-service types whose use case cannot be demonstrated in the app.
+        'android:foregroundServiceType': 'microphone',
         'tools:replace': 'android:foregroundServiceType',
       },
-    });
+    };
+    mainApplication['service'] = mainApplication['service'].filter((service) => service?.$?.['android:name'] !== SERVICE_NAME);
+    mainApplication['service'].push(serviceEntry);
     return config;
   });
 };

src/api/calls/callFiles.ts

@@ -2,8 +2,10 @@ import axios, { type AxiosProgressEvent, type AxiosRequestConfig, type AxiosResp
 import { Platform } from 'react-native';
 
 import { createApiEndpoint } from '@/api/common/client';
+import { getBaseApiUrl } from '@/lib/storage/app';
 import { type CallFilesResult } from '@/models/v4/callFiles/callFilesResult';
 import { type SaveCallFileResult } from '@/models/v4/callFiles/saveCallFileResult';
+import useAuthStore from '@/stores/auth/store';
 
 // Event types for the download process
 export type DownloadEventType = 'start' | 'progress' | 'complete' | 'error';
@@ -30,6 +32,25 @@ const getCallFilesApi = createApiEndpoint('/CallFiles/GetFilesForCall');
 const saveCallFileApi = createApiEndpoint('/CallFiles/SaveCallFile');
 
 // Function to download a file with progress reporting
+/**
+ * Whether `url` points at the department's own Resgrid API.
+ *
+ * Attachment URLs arrive inside the server payload, and not all of them are ours: a department on
+ * external blob storage gets a pre-signed CDN link back. Those links carry their own credential in
+ * the query string and need no bearer, so sending one would hand this member's access token to a
+ * third-party host for nothing.
+ */
+const isApiOrigin = (url: string): boolean => {
+  try {
+    const target = new URL(url, getBaseApiUrl());
+    const api = new URL(getBaseApiUrl());
+    return target.origin === api.origin;
+  } catch {
+    // An unparseable URL is not a host we can vouch for.
+    return false;
+  }
+};
+
 export const getCallAttachmentFile = async (url: string, options: DownloadOptions = {}): Promise<Blob> => {
   const { onEvent, headers = {}, timeout = 30000 } = options;
 
@@ -39,9 +60,16 @@ export const getCallAttachmentFile = async (url: string, options: DownloadOption
       type: 'start',
     });
 
+    // Attach the signed-in bearer, but only for our own API origin: authenticated file routes
+    // require it, the anonymous signed-link route simply ignores it, and an external storage or
+    // CDN host must never see it. Caller-supplied headers win on conflict.
+    const token = isApiOrigin(url) ? useAuthStore.getState().accessToken : null;
     const config: AxiosRequestConfig = {
       responseType: 'blob',
-      headers,
+      headers: {
+        ...(token ? { Authorization: `Bearer ${token}` } : {}),
+        ...headers,
+      },
       timeout,
       onDownloadProgress: (progressEvent: AxiosProgressEvent) => {
         if (progressEvent.total) {

src/api/chat/chat.ts

@@ -219,8 +219,11 @@ export const getChatAttachmentThumbnailUrl = (attachmentId: string): string => `
  * Image source (with bearer auth header) suitable for expo-image / RN Image
  * when rendering a chat attachment.
  */
-export const getChatAttachmentImageSource = (attachmentId: string) => {
-  const token = useAuthStore.getState().accessToken;
+export const getChatAttachmentImageSource = (attachmentId: string, accessToken?: string | null) => {
+  // `accessToken` lets a component pass the token it is subscribed to. Reading it from the store
+  // here is a one-shot snapshot, so a component that does not subscribe would keep rendering the
+  // pre-refresh bearer after a token rotation and the image request would 401.
+  const token = accessToken !== undefined ? accessToken : useAuthStore.getState().accessToken;
   return {
     uri: getChatAttachmentUrl(attachmentId),
     headers: token ? { Authorization: `Bearer ${token}` } : undefined,

src/api/common/client.tsx

@@ -1,6 +1,7 @@
 import axios, { type AxiosError, type AxiosInstance, type InternalAxiosRequestConfig, isAxiosError } from 'axios';
 
 import { refreshTokenSingleFlight } from '@/lib/auth/api';
+import { readProtectedGrantHeaders } from '@/lib/data-protection/grant-provider';
 import { logger } from '@/lib/logging';
 import { getBaseApiUrl } from '@/lib/storage/app';
 import useAuthStore from '@/stores/auth/store';
@@ -44,6 +45,21 @@ axiosInstance.interceptors.request.use(
     if (accessToken) {
       config.headers.Authorization = `Bearer ${accessToken}`;
     }
+
+    // Advanced Data Protection: while the member holds a live grant, every read through this
+    // instance carries it, so a protected value comes back decrypted instead of REDACTED.
+    //
+    // Attached centrally on purpose. The alternative - each screen remembering to add the header -
+    // is the failure mode that already shipped twice on the web side, and it fails SILENTLY: the
+    // screen looks fine and simply shows placeholders. The grant only ever goes to Resgrid's own
+    // API (this instance's baseURL), is short-lived, and is bound to this member, department and
+    // policy epoch, so the server is the only thing that can act on it.
+    if (config.headers) {
+      for (const [name, value] of Object.entries(readProtectedGrantHeaders())) {
+        config.headers.set(name, value);
+      }
+    }
+
     return config;
   },
   (error: AxiosError) => {

src/api/data-protection/data-protection.ts

@@ -0,0 +1,71 @@
+import { api } from '../common/client';
+
+const DATA_PROTECTION = '/DataProtection';
+
+// ---------------------------------------------------------------------------
+// Advanced Data Protection (ADP) — capability report, MFA step-up, and the
+// exemption path.
+//
+// The step-up window is ABSOLUTE: the server returns its expiry once and never
+// slides it. Clients conceal protected values at expiry and ask again on the
+// next reveal.
+// ---------------------------------------------------------------------------
+
+export interface DataProtectionCapabilitiesData {
+  State: number;
+  StateName?: string | null;
+  IsProtectionEnabled: boolean;
+  CatalogVersion: number;
+  CurrentCatalogVersion: number;
+  PolicyEpoch: number;
+  StepUpWindowMinutes: number;
+  IsDepartmentLocked: boolean;
+  LockReason?: string | null;
+  LockProjectedEndUtc?: string | null;
+}
+
+export interface DataProtectionCapabilitiesResult {
+  Data?: DataProtectionCapabilitiesData;
+}
+
+export interface StepUpResult {
+  /** Grant id (jti) for display/audit correlation; null when grants are not configured. */
+  GrantId?: string | null;
+  /** Signed Protected Data Grant. MEMORY ONLY — never persisted, never logged. */
+  GrantToken?: string | null;
+  /** Absolute UTC expiry of the step-up window (ISO 8601). */
+  StepUpExpiresOnUtc?: string | null;
+  StepUpWindowMinutes?: number;
+}
+
+/** Value-free ADP capability report for the caller's department. */
+export const getDataProtectionCapabilities = async (signal?: AbortSignal) => {
+  const response = await api.get<DataProtectionCapabilitiesResult>(`${DATA_PROTECTION}/Capabilities`, { signal });
+  return response.data;
+};
+
+/**
+ * Asks for a grant WITHOUT a second factor.
+ *
+ * A department may release named apps from the step-up prompt (ADP plan 3.3) — a dispatcher on a
+ * live incident cannot stop to read a code off a phone. The server answers with a grant when this
+ * department has exempted THIS app, and with `step_up_required` otherwise. The client never makes
+ * that decision; it only asks and reacts.
+ *
+ * Nothing is weakened by asking: the caller is still authenticated, and the grant that comes back
+ * is still tenant-bound, epoch-bound, short-lived and audited on every read it authorizes.
+ */
+export const requestProtectedGrant = async () => {
+  const response = await api.post<StepUpResult>(`${DATA_PROTECTION}/RequestGrant`, {});
+  return response.data;
+};
+
+/**
+ * Verifies the user's authenticator (TOTP) code for the ADP step-up.
+ * Server problem types: invalid_totp (400/401), mfa_not_enrolled (409),
+ * too_many_attempts (429). The code is never logged anywhere.
+ */
+export const verifyStepUp = async (code: string) => {
+  const response = await api.post<StepUpResult>(`${DATA_PROTECTION}/VerifyStepUp`, { Code: code });
+  return response.data;
+};

src/app/(app)/_layout.tsx

@@ -11,6 +11,7 @@
 import { useSafeAreaInsets } from 'react-native-safe-area-context';
 
 import { OfflineStatusToast } from '@/components/common/offline-status-toast';
+import { StepUpPromptHost } from '@/components/data-protection/step-up-prompt-host';
 import { NotificationButton } from '@/components/notifications/NotificationButton';
 import { NotificationInbox } from '@/components/notifications/NotificationInbox';
 import Sidebar from '@/components/sidebar/sidebar';
@@ -36,6 +37,7 @@
 import { useCoreStore } from '@/stores/app/core-store';
 import { useCallsStore } from '@/stores/calls/store';
 import { useCommandStore } from '@/stores/command/store';
+import { dataProtectionStore } from '@/stores/data-protection/store';
 import { FeatureFlagKeys, featureFlagsStore } from '@/stores/feature-flags/store';
 import { useRolesStore } from '@/stores/roles/store';
 import { securityStore } from '@/stores/security/store';
@@ -184,7 +186,7 @@
         return;
       }
 
-      await featureFlagsStore.getState().fetchFlags();
+      await featureFlagsStore.getState().fetchFlags(), dataProtectionStore.getState().fetchCapabilities();
 
       if (!isCurrentRun()) return;
 
@@ -563,6 +565,13 @@
 
   const content = (
     <View style={styles.container} pointerEvents="box-none">
+      {/*
+        The app's single Advanced Data Protection prompt. Mounted here so any screen can trigger it
+        through the store without carrying a modal of its own, and so two screens can never stack
+        two prompts over each other.
+      */}
+      <StepUpPromptHost />
+
       {/* Loading overlay during initialization — shown on top of Tabs so the navigator stays mounted */}
       {!isInitComplete ? (
         <View style={styles.loadingOverlay}>