Fix: location permission returns denied when user selects approximate

.github/workflows/permission_handler.yaml

@@ -26,7 +26,7 @@ jobs:
     # TODO(mvanbeusekom): Manually set to macOS 15 to support Xcode 16 and iOS 18 SDKs.
     # Currently `macos-latest` is based on macOS 14 and doesn't support iOS 18 SDK. This
     # should be moved back to `macos-latest` when GitHub Actions images are updated.
-    runs-on: macos-15 
+    runs-on: macos-15
 
     env:
       source-directory: ./permission_handler
@@ -42,7 +42,6 @@ jobs:
         with:
           distribution: "temurin" # See 'Supported distributions' for available options
           java-version: "17"
-
       # Make sure the stable version of Flutter is available
       - uses: subosito/flutter-action@v2
         with:
@@ -62,18 +61,7 @@ jobs:
       - name: Run Flutter Analyzer
         run: flutter analyze
         working-directory: ${{env.source-directory}}
-
-      # Build Android version of the example App
-      - name: Run Android build
-        run: flutter build apk --release
-        working-directory: ${{env.example-directory}}
-
-      # Build iOS version of the example App
-      - name: Run iOS build
-        run: flutter build ios --release --no-codesign
-        working-directory: ${{env.example-directory}}
-
-      # Run all unit-tests with code coverage
+        # Run all unit-tests with code coverage
       - name: Run unit tests
         run: flutter test --coverage
         working-directory: ${{env.source-directory}}
@@ -85,3 +73,13 @@ jobs:
           file: ${{env.source-directory}}/coverage/lcov.info # optional
           flags: unittests # optional
           name: permission_handler # optional
+
+      # Build Android version of the example App
+      - name: Run Android build
+        run: flutter build apk --release
+        working-directory: ${{env.example-directory}}
+
+      # Build iOS version of the example App
+      - name: Run iOS build
+        run: flutter build ios --release --no-codesign
+        working-directory: ${{env.example-directory}}

.github/workflows/permission_handler_android.yaml

@@ -6,15 +6,15 @@ name: permission_handler_android
 # events but only for the main branch
 on:
   push:
-    branches: [ main ]
+    branches: [main]
     paths:
-    - 'permission_handler_android/**'
-    - '.github/workflows/permission_handler_android.yaml'
+      - "permission_handler_android/**"
+      - ".github/workflows/permission_handler_android.yaml"
   pull_request:
-    branches: [ main ]
+    branches: [main]
     paths:
-    - 'permission_handler_android/**'
-    - '.github/workflows/permission_handler_android.yaml'
+      - "permission_handler_android/**"
+      - ".github/workflows/permission_handler_android.yaml"
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
@@ -26,7 +26,7 @@ jobs:
 
     env:
       source-directory: ./permission_handler_android
-      example-directory: ./permission_handler_android/example 
+      example-directory: ./permission_handler_android/example
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
@@ -36,13 +36,12 @@ jobs:
       # Make sure JAVA version 17 is installed on build agent.
       - uses: actions/setup-java@v3
         with:
-          distribution: 'temurin' # See 'Supported distributions' for available options
-          java-version: '17'
-
+          distribution: "temurin" # See 'Supported distributions' for available options
+          java-version: "17"
       # Make sure the stable version of Flutter is available
       - uses: subosito/flutter-action@v2
         with:
-          channel: 'stable'
+          channel: "stable"
 
       # Download all Flutter packages
       - name: Download dependencies
@@ -63,4 +62,3 @@ jobs:
       - name: Run Android build
         run: flutter build apk --release
         working-directory: ${{env.example-directory}}
-

.github/workflows/permission_handler_apple.yaml

@@ -57,7 +57,153 @@ jobs:
         run: flutter analyze
         working-directory: ${{env.source-directory}}
 
-      # Build iOS version of the example App
+      # Build iOS version of the example App.
+      #
+      # The example resolves this plugin as a Swift package (the Podfile only
+      # covers its remaining CocoaPods dependencies), so the "Verify
+      # permission_handler flavor" build phase is active and `strict: true`
+      # demands a selection before a Release build can run. `select` also
+      # generates ios/Flutter/permission_handler.resolved.json from
+      # permission_handler.yaml — neither it nor the selection file is
+      # committed, so every CI run has to make its own.
       - name: Run iOS build
-        run: flutter build ios --no-codesign --release
         working-directory: ${{env.example-directory}}
+        run: |
+          set -euo pipefail
+          dart run permission_handler_apple:select release
+          flutter build ios --no-codesign --release
+
+      # Guard the Swift Package Manager permission resolution.
+      #
+      # Package.swift turns the usage description keys of the host app's
+      # Info.plist into PERMISSION_* macros. When that breaks, every macro
+      # silently falls back to 0 and all permissions are compiled out, so assert
+      # on the resolved manifest rather than on the build succeeding.
+      #
+      # The example declares two flavors over two Info.plist files that differ by
+      # exactly one key: `debug` (Info-Debug.plist, the build-configuration
+      # specific layout reported in issue #1548) has no contacts entry,
+      # `release` (Info.plist) does. That single difference is what proves both
+      # that a flavor cannot inherit another flavor's permissions and, on the
+      # legacy path, that both plists were discovered and merged.
+      - name: Verify SPM permission resolution
+        working-directory: ${{env.example-directory}}
+        run: |
+          set -euo pipefail
+          flutter config --enable-swift-package-manager
+          flutter build ios --config-only --debug --no-codesign
+
+          # Resolve the manifest under a given environment, capturing the macros
+          # (stdout) and the PERMISSION_HANDLER_VERBOSE diagnostics (stderr).
+          resolve() { # <name> <VAR=value>...
+            local name="$1"; shift
+            rm -rf ~/Library/Caches/org.swift.swiftpm/manifests
+            env PERMISSION_HANDLER_VERBOSE=1 "$@" swift package --manifest-cache none \
+              --package-path ios/Flutter/ephemeral/Packages/.packages/permission_handler_apple \
+              dump-package > "${RUNNER_TEMP}/${name}.json" 2> "${RUNNER_TEMP}/${name}.log"
+            echo "--- ${name} ---"
+            cat "${RUNNER_TEMP}/${name}.log"
+          }
+
+          expect() { # <name> <macro=value>...
+            local name="$1"; shift
+            for macro in "$@"; do
+              grep -qF "${macro}" "${RUNNER_TEMP}/${name}.json" || {
+                echo "::error::[${name}] expected ${macro} in the resolved manifest"
+                grep -o 'PERMISSION_[A-Z_]*=[01]' "${RUNNER_TEMP}/${name}.json" | sort -u
+                exit 1
+              }
+            done
+          }
+
+          expect_log() { # <name> <fixed string> <message>
+            grep -qF "$2" "${RUNNER_TEMP}/$1.log" || { echo "::error::[$1] $3"; exit 1; }
+          }
+
+          # Without a permission_handler.yaml the pre-flavor behaviour has to be
+          # unchanged: discover every Info.plist and merge them. PERMISSION_CONTACTS
+          # can only be 1 if both plists were found, which is what makes this
+          # assert on the discovery rather than on the example's default plist.
+          resolve legacy PERMISSION_HANDLER_CONFIG=/nonexistent/permission_handler.yaml
+          expect_log legacy 'Runner/Info.plist' \
+            'ios/Runner/Info.plist was not discovered'
+          expect_log legacy 'Runner/Info-Debug.plist' \
+            'ios/Runner/Info-Debug.plist was not discovered — INFOPLIST_FILE parsing is broken'
+          expect_log legacy 'NSContactsUsageDescription' \
+            'the divergence warning did not fire — the plists were not merged'
+          expect legacy PERMISSION_CONTACTS=1 PERMISSION_CAMERA=1 PERMISSION_MICROPHONE=1 \
+            PERMISSION_PHOTOS=1 PERMISSION_LOCATION=1
+
+          # The debug flavor must not see the release flavor's contacts entry.
+          resolve debug PERMISSION_HANDLER_FLAVOR=debug
+          expect debug PERMISSION_CONTACTS=0 PERMISSION_CAMERA=1 PERMISSION_MICROPHONE=1
+
+          # ...and the release flavor must see it.
+          resolve release PERMISSION_HANDLER_FLAVOR=release
+          expect release PERMISSION_CONTACTS=1 PERMISSION_CAMERA=1 PERMISSION_MICROPHONE=1
+
+          # With `strict: true` an unresolved flavor compiles nothing in,
+          # rather than falling back to the union of every flavor. The earlier
+          # build step recorded a selection, so drop it first — otherwise the
+          # manifest resolves that flavor and this asserts nothing. The
+          # generated resolved.json stays; only the selection is missing.
+          rm -f ios/Flutter/permission_handler.selected
+          resolve strict
+          expect strict PERMISSION_CONTACTS=0 PERMISSION_CAMERA=0 PERMISSION_MICROPHONE=0
+
+          # Editing permission_handler.yaml without re-running `select` must not
+          # build with the stale translation: everything compiles out and the
+          # manifest says to re-run select.
+          touch permission_handler.yaml
+          resolve stale PERMISSION_HANDLER_FLAVOR=release
+          expect stale PERMISSION_CONTACTS=0 PERMISSION_CAMERA=0 PERMISSION_MICROPHONE=0
+          expect_log stale 'modified after its generated translation' \
+            'the staleness guard did not fire'
+
+      # An app target whose INFOPLIST_FILE is built from a variable this manifest
+      # does not expand, next to an extension carrying Xcode's stock
+      # `GENERATE_INFOPLIST_FILE = YES`. Neither yields a usable path, so the
+      # scan of `ios/` has to take over; a settings hit that resolves to nothing
+      # must not suppress it. Built here rather than committed, because it is a
+      # project layout the example cannot also be.
+      - name: Verify SPM detection falls back to scanning
+        run: |
+          set -euo pipefail
+          app="${RUNNER_TEMP}/fallback-app"
+          rm -rf "${app}"
+          mkdir -p "${app}/ios/Extension.xcodeproj" "${app}/ios/Runner"
+          touch "${app}/pubspec.yaml"
+          cp "${{env.example-directory}}/ios/Runner/Info.plist" "${app}/ios/Runner/Info.plist"
+          printf 'GENERATE_INFOPLIST_FILE = YES;\nINFOPLIST_FILE = "$(TARGET_NAME)/Info.plist";\n' \
+            > "${app}/ios/Extension.xcodeproj/project.pbxproj"
+
+          cd "${app}"
+          rm -rf ~/Library/Caches/org.swift.swiftpm/manifests
+          PERMISSION_HANDLER_VERBOSE=1 swift package --manifest-cache none \
+            --package-path "${GITHUB_WORKSPACE}/permission_handler_apple/ios/permission_handler_apple" \
+            dump-package > "${RUNNER_TEMP}/fallback.json" 2> "${RUNNER_TEMP}/fallback.log"
+          cat "${RUNNER_TEMP}/fallback.log"
+
+          grep -qF 'PERMISSION_CAMERA=1' "${RUNNER_TEMP}/fallback.json" || {
+            echo "::error::the scan fallback did not run — an unresolvable INFOPLIST_FILE suppressed it"
+            exit 1
+          }
+
+      # The build phase that catches a stale selection is the only check that
+      # runs on every build, so make sure it actually fails.
+      - name: Verify flavor mismatch fails the build
+        working-directory: ${{env.example-directory}}
+        run: |
+          set -euo pipefail
+          dart run permission_handler_apple:select release
+          if xcodebuild -workspace ios/Runner.xcworkspace -scheme Runner \
+               -configuration Debug -sdk iphonesimulator \
+               -derivedDataPath "${RUNNER_TEMP}/dd" build > "${RUNNER_TEMP}/mismatch.log" 2>&1; then
+            echo "::error::a Debug build with the release flavor selected should have failed"
+            exit 1
+          fi
+          grep -q 'needs the "debug" permission flavor' "${RUNNER_TEMP}/mismatch.log" || {
+            echo "::error::build failed, but not with the flavor mismatch error"
+            tail -40 "${RUNNER_TEMP}/mismatch.log"
+            exit 1
+          }

.github/workflows/permission_handler_platform_interface.yaml

@@ -6,15 +6,15 @@ name: permission_handler_platform_interface
 # events but only for the main branch
 on:
   push:
-    branches: [ main ]
+    branches: [main]
     paths:
-    - 'permission_handler_platform_interface/**'
-    - '.github/workflows/permission_handler_platform_interface.yaml'
+      - "permission_handler_platform_interface/**"
+      - ".github/workflows/permission_handler_platform_interface.yaml"
   pull_request:
-    branches: [ main ]
+    branches: [main]
     paths:
-    - 'permission_handler_platform_interface/**'
-    - '.github/workflows/permission_handler_platform_interface.yaml'
+      - "permission_handler_platform_interface/**"
+      - ".github/workflows/permission_handler_platform_interface.yaml"
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
@@ -25,17 +25,17 @@ jobs:
     runs-on: ubuntu-latest
 
     env:
-      source-directory: ./permission_handler_platform_interface 
+      source-directory: ./permission_handler_platform_interface
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
       - uses: actions/checkout@v3
-      
+
       # Make sure the stable version of Flutter is available
       - uses: subosito/flutter-action@v2
         with:
-          channel: 'stable'
+          channel: "stable"
 
       # Download all Flutter packages
       - name: Download dependencies
@@ -46,20 +46,21 @@ jobs:
       - name: Run Dart Format
         run: dart format --set-exit-if-changed .
         working-directory: ${{env.source-directory}}
-   
+
       # Run Flutter Analyzer
       - name: Run Flutter Analyzer
         run: flutter analyze
         working-directory: ${{env.source-directory}}
-      
+
       # Run all unit-tests with code coverage
       - name: Run unit tests
         run: flutter test --coverage
         working-directory: ${{env.source-directory}}
 
       # Upload code coverage information
-      - uses: codecov/codecov-action@v1
+      - uses: codecov/codecov-action@v3
         with:
+          token: ${{ secrets.CODECOV_TOKEN }}
           file: ${{env.source-directory}}/coverage/lcov.info # optional
           name: permission_handler_platform_interface (Platform Interface Package) # optional
-          fail_ci_if_error: true
+          flags: unittests

.gitignore

@@ -11,6 +11,8 @@
 .project
 .svn/
 bin/
+# ...except packages that ship an executable, which pub requires to live in bin/.
+!permission_handler_apple/bin/
 migrate_working_dir/
 
 # IntelliJ related