fix: remove full-screen intent permission

Author: jjoonleo

android/app/src/main/AndroidManifest.xml

@@ -2,7 +2,6 @@
     <!-- Android 13(API 33) 이상 알림 권한 -->
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS"/>
     <uses-permission android:name="android.permission.SCHEDULE_EXACT_ALARM"/>
-    <uses-permission android:name="android.permission.USE_FULL_SCREEN_INTENT"/>
     <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
     <uses-permission android:name="android.permission.VIBRATE"/>
 

android/app/src/main/kotlin/club/devkor/ontime/NativeAlarmReceiver.kt

@@ -14,7 +14,7 @@ import android.os.Build
 class NativeAlarmReceiver : BroadcastReceiver() {
     companion object {
         private const val TAG = "OnTimeNativeAlarm"
-        private const val ALARM_CHANNEL_ID = "on_time_alarm_full_screen"
+        private const val ALARM_CHANNEL_ID = "on_time_alarm"
         private const val ALARM_CHANNEL_NAME = "OnTime alarms"
         private const val NOTIFICATION_ID_OFFSET = 730000
 
@@ -223,7 +223,7 @@ class NativeAlarmReceiver : BroadcastReceiver() {
             "Native alarm broadcast fired requestCode=$requestCode " +
                 "scheduleId=${extras["scheduleId"]} alarmTime=${extras["alarmTime"]}",
         )
-        postFullScreenAlarmNotification(context, requestCode, extras)
+        postAlarmNotification(context, requestCode, extras)
     }
 
     private fun handleDismissAlarm(context: Context, intent: Intent) {
@@ -246,7 +246,7 @@ class NativeAlarmReceiver : BroadcastReceiver() {
         )
     }
 
-    private fun postFullScreenAlarmNotification(
+    private fun postAlarmNotification(
         context: Context,
         requestCode: Int,
         extras: Map<String, String>,
@@ -265,7 +265,7 @@ class NativeAlarmReceiver : BroadcastReceiver() {
             return
         }
         ensureAlarmChannel(manager)
-        val fullScreenIntent = activityPendingIntentForExtras(
+        val contentIntent = activityPendingIntentForExtras(
             context,
             requestCode,
             extras,
@@ -294,8 +294,7 @@ class NativeAlarmReceiver : BroadcastReceiver() {
             .setVisibility(Notification.VISIBILITY_PUBLIC)
             .setOngoing(true)
             .setAutoCancel(false)
-            .setFullScreenIntent(fullScreenIntent, true)
-            .setContentIntent(fullScreenIntent)
+            .setContentIntent(contentIntent)
             .addAction(
                 Notification.Action.Builder(
                     context.applicationInfo.icon,
@@ -307,7 +306,7 @@ class NativeAlarmReceiver : BroadcastReceiver() {
         manager.notify(notificationId(requestCode), notification)
         NativeLog.d(
             TAG,
-            "Full-screen alarm notification posted requestCode=$requestCode " +
+            "Alarm notification posted requestCode=$requestCode " +
                 "scheduleId=${extras["scheduleId"]}",
         )
     }
@@ -324,7 +323,7 @@ class NativeAlarmReceiver : BroadcastReceiver() {
             ALARM_CHANNEL_NAME,
             NotificationManager.IMPORTANCE_HIGH,
         ).apply {
-            description = "Full-screen OnTime schedule alarms."
+            description = "OnTime schedule alarm alerts."
             lockscreenVisibility = Notification.VISIBILITY_PUBLIC
             setBypassDnd(true)
         }

android/settings.gradle

@@ -22,7 +22,7 @@ plugins {
     // START: FlutterFire Configuration
     id "com.google.gms.google-services" version "4.4.2" apply false
     // END: FlutterFire Configuration
-    id "org.jetbrains.kotlin.android" version "2.0.20" apply false
+    id "org.jetbrains.kotlin.android" version "2.2.0" apply false
 }
 
 include ":app"

docs/Android-Alarm-Notification-QA.md

@@ -8,8 +8,8 @@ signed release AAB or release-equivalent Android build.
 Do not mark #457 complete until these are satisfied:
 
 - #452 provides a signed release AAB or release-equivalent install path.
-- #445 full-screen intent declaration material is reviewed or submitted by a
-  human with Play Console access, per the parent track order.
+- The Play-bound Android build removes `USE_FULL_SCREEN_INTENT` and replaces
+  version code 52 in every affected Play track.
 - QA has access to an Android device or emulator with Google Play services, a
   backend environment with alarm APIs enabled, and a test account that can create
   schedules.
@@ -34,7 +34,7 @@ Minimum recommended coverage:
 
 - Android 13 or newer for `POST_NOTIFICATIONS`.
 - Android 12 or newer for exact alarm special access.
-- One physical device for boot restore and full-screen alarm behavior.
+- One physical device for boot restore and alarm notification behavior.
 
 ## Permission Setup
 
@@ -137,18 +137,19 @@ show fallback behavior instead of native exact alarm scheduling.
 Expected result: no native alarm or fallback notification is armed; the app
 surfaces permission recovery instead of silently claiming alarm coverage.
 
-### 6. Full-Screen Alarm UI
+### 6. Alarm Notification Tap-Through
 
 1. Allow exact alarm special access and notification permission.
 2. Create a near-future schedule.
 3. Lock the device or put the app in the background.
 4. Wait for the alarm.
-5. Use the full-screen alarm action to start preparing.
+5. Tap the alarm notification to start preparing.
 6. Repeat once and dismiss/cancel the ringing alarm instead of starting.
 
-Expected result: `AlarmRingingActivity` appears only for the user-scheduled
-alarm moment, the start action routes into schedule preparation, and dismissal
-stops ringing/vibration and removes the alarm notification.
+Expected result: an alarm notification appears for the user-scheduled alarm
+moment, tapping it opens `AlarmRingingActivity`, the start action routes into
+schedule preparation, and dismissal stops ringing/vibration and removes the
+alarm notification.
 
 ### 7. Cancellation
 

docs/Android-Manifest-Permissions.md

@@ -17,13 +17,18 @@ reload.
 
 | Permission | Status | Justification |
 | --- | --- | --- |
-| `android.permission.POST_NOTIFICATIONS` | Keep | Required on Android 13+ for OnTime reminder, preparation-step, and alarm notifications. Native alarm fallback also checks this permission before posting the full-screen alarm notification. |
+| `android.permission.POST_NOTIFICATIONS` | Keep | Required on Android 13+ for OnTime reminder, preparation-step, and alarm notifications. Native alarm handling also checks this permission before posting alarm notifications. |
 | `android.permission.SCHEDULE_EXACT_ALARM` | Keep | Required on Android 12+ for user-scheduled schedule alarms that must fire at the selected time. Native alarm scheduling checks `AlarmManager.canScheduleExactAlarms()` before using `setAlarmClock`. |
-| `android.permission.USE_FULL_SCREEN_INTENT` | Keep | Required for the user-scheduled alarm ringing notification to present `AlarmRingingActivity` as a full-screen alarm experience. Usage is tied to alarm-category notifications, not generic or promotional notifications. |
 | `android.permission.RECEIVE_BOOT_COMPLETED` | Keep | Required for `NativeAlarmBootReceiver` to restore persisted future native alarms after device restart. The receiver is not exported. |
 | `android.permission.VIBRATE` | Keep | Required so alarm and notification channels can use vibration behavior for time-sensitive reminders and alarms. |
 
-No unused app-owned release permission was found during the audit.
+No unused app-owned release permission remains in the manifest.
+
+## Removed Permission
+
+| Permission | Status | Reason |
+| --- | --- | --- |
+| `android.permission.USE_FULL_SCREEN_INTENT` | Removed | Google Play rejected OnTime's declaration for version code 52 and instructed the team to remove this permission from all submitted version codes. OnTime must not declare this permission or call `setFullScreenIntent(...)` in Play-bound builds. |
 
 ## Manifest Merge Notes
 
@@ -63,9 +68,9 @@ Debug and profile merged manifests may additionally contain their variant-owned
 
 - `MainActivity` checks exact alarm and notification permission state before
   scheduling native alarms.
-- `NativeAlarmReceiver` posts alarm-category full-screen notifications and
-  skips posting when notification permission is denied.
+- `NativeAlarmReceiver` posts alarm-category notifications and skips posting
+  when notification permission is denied.
 - `NativeAlarmBootReceiver` handles boot completion and exact-alarm permission
   state changes to restore persisted native alarms.
-- `AlarmRingingActivity` is the full-screen alarm UI launched only from the
-  alarm notification path.
+- `AlarmRingingActivity` is the tap-through alarm UI launched from the alarm
+  notification content intent.

docs/Google-Play-Data-Safety.md

@@ -72,7 +72,7 @@ deletion support must be approved by the release owner.
 | Alarm device registration | Current device registration sends app-generated device id, platform, app version, OS version, native alarm support, and alarm providers. | Device or other identifiers, app info and performance | Source-backed, backend retention pending |
 | Alarm status reporting | Alarm status reports send device id, reconciliation timestamps, schedule window, coverage window, alarm provider, status, permission issue, armed schedule ids, skipped count, and failures. | App info and performance, diagnostics, device or other identifiers | Source-backed, backend retention pending |
 | Local alarm registry | Scheduled alarm records are stored locally with schedule id, alarm time, preparation start time, fingerprint, notification ids, provider, schedule title, and payload. | On-device storage; disclose only if transmitted or shared elsewhere | Source-backed |
-| Android permissions | Release manifest includes notification, exact alarm, full-screen intent, boot restore, vibration, and dependency-owned network/Firebase/sign-in permissions. It does not include location, contacts, camera, microphone, phone, SMS, storage, calendar, nearby-device, or Bluetooth permissions. | Permission/API evidence for form consistency | Source-backed by #442 |
+| Android permissions | Release manifest includes notification, exact alarm, boot restore, vibration, and dependency-owned network/Firebase/sign-in permissions. It does not include full-screen intent, location, contacts, camera, microphone, phone, SMS, storage, calendar, nearby-device, or Bluetooth permissions. | Permission/API evidence for form consistency | Source-backed by #442 |
 | Firebase Cloud Messaging SDK | The app uses `firebase_core` and `firebase_messaging`. Firebase documentation says Cloud Messaging collects app version automatically and depends on Firebase Installations; FID and Firebase user agent handling must be considered. | SDK-collected data, device or other identifiers, app info and performance | Source-backed dependency, final SDK review pending |
 | Firebase Analytics Product Usage Events | Planned analytics release uses Firebase Analytics for workflow milestone events only, with Help Improve OnTime opt-out, pseudonymous analytics identifiers, schema-versioned event names, app version, platform, workflow result, stable error categories, and coarse counts or durations. The event catalog forbids raw schedule names, notes, place names, preparation step names, email, OAuth identifiers, FCM token, raw exceptions, request bodies, response bodies, and free text. | App activity, app info and performance, device or other identifiers; purposes include Analytics, app functionality, debugging and operations, and non-personalized experiments | Planned; not present in current `pubspec.yaml` until `firebase_analytics` is added |
 | Google Play services core SDKs | Google Play services base/basement/tasks may be present through dependencies. Google's disclosure page says the listed core SDKs do not collect end-user data, but app owners remain responsible for the overall disclosure. | SDK review | Dependency review pending |