Add local network permission prompt on android 17 (#57291)

Summary:
Android 17 (SDK 37) introduces Local Network Protection. Reaching any local-network address now requires the runtime `ACCESS_LOCAL_NETWORK` permission. This is how the dev server is reached, so on an Android 17 device the dev bundle download is blocked

This adds a debug-only path that requests `ACCESS_LOCAL_NETWORK` before the first bundle load and defers `loadApp` until the user answers, so a slow response can't cause an error

cc zoontek

## Changelog:
[Android] [Fixed] - Request `ACCESS_LOCAL_NETWORK` so the dev server stays reachable on Android 17 (SDK 37)[Android] [Added] - Add `ACCESS_LOCAL_NETWORK` to `PermissionsAndroid`

Pull Request resolved: #57291

Test Plan:
Validated on an Android 17 emulator and physical device.
- **targetSdk 36 and 37**
   launch → prompt appears → grant → bundle loads.
   Deny → app starts and shows the normal red-box connection error.
- **API 36 / older devices:** no prompt, behavior unchanged.
- **USB device via `adb reverse`:** no prompt (loopback is exempt).

Reviewed By: cortinico, Abbondanzo

Differential Revision: D109160057

Pulled By: fabriziocucci

fbshipit-source-id: 4bbd9a3e97e5d12b8add635ed0daa15f6fe90ce0

Author: alanjhughes

packages/react-native/Libraries/PermissionsAndroid/PermissionsAndroid.d.ts

@@ -58,7 +58,8 @@ export type Permission =
   | 'android.permission.READ_PHONE_NUMBERS'
   | 'android.permission.UWB_RANGING'
   | 'android.permission.POST_NOTIFICATIONS'
-  | 'android.permission.NEARBY_WIFI_DEVICES';
+  | 'android.permission.NEARBY_WIFI_DEVICES'
+  | 'android.permission.ACCESS_LOCAL_NETWORK';
 
 export type PermissionStatus = 'granted' | 'denied' | 'never_ask_again';
 
@@ -116,7 +117,8 @@ export interface PermissionsAndroidStatic {
       | 'READ_PHONE_NUMBERS'
       | 'UWB_RANGING'
       | 'POST_NOTIFICATIONS'
-      | 'NEARBY_WIFI_DEVICES']: Permission;
+      | 'NEARBY_WIFI_DEVICES'
+      | 'ACCESS_LOCAL_NETWORK']: Permission;
   };
   new (): PermissionsAndroidStatic;
   /**

packages/react-native/Libraries/PermissionsAndroid/PermissionsAndroid.js

@@ -75,6 +75,7 @@ type PermissionsType = Readonly<{
   UWB_RANGING: 'android.permission.UWB_RANGING',
   POST_NOTIFICATIONS: 'android.permission.POST_NOTIFICATIONS',
   NEARBY_WIFI_DEVICES: 'android.permission.NEARBY_WIFI_DEVICES',
+  ACCESS_LOCAL_NETWORK: 'android.permission.ACCESS_LOCAL_NETWORK',
 }>;
 
 export type PermissionStatus = 'granted' | 'denied' | 'never_ask_again';
@@ -125,6 +126,7 @@ const PERMISSIONS = Object.freeze({
   UWB_RANGING: 'android.permission.UWB_RANGING',
   POST_NOTIFICATIONS: 'android.permission.POST_NOTIFICATIONS',
   NEARBY_WIFI_DEVICES: 'android.permission.NEARBY_WIFI_DEVICES',
+  ACCESS_LOCAL_NETWORK: 'android.permission.ACCESS_LOCAL_NETWORK',
 }) as PermissionsType;
 
 /**

packages/react-native/ReactAndroid/src/debug/AndroidManifest.xml

@@ -7,6 +7,12 @@
    -->
   <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>
 
+  <!--
+    On Android 17 (SDK 37) devices, apps that declare this must hold ACCESS_LOCAL_NETWORK
+    to reach the dev server over the local network. Loopback via `adb reverse` is exempt.
+   -->
+  <uses-permission android:name="android.permission.ACCESS_LOCAL_NETWORK"/>
+
   <application>
     <activity android:name="com.facebook.react.devsupport.DevSettingsActivity"
               android:exported="false" />

packages/react-native/ReactAndroid/src/main/java/com/facebook/react/ReactActivityDelegate.java

@@ -22,6 +22,7 @@
 import com.facebook.react.bridge.Callback;
 import com.facebook.react.bridge.ReactContext;
 import com.facebook.react.common.LifecycleState;
+import com.facebook.react.devsupport.LocalNetworkPermissionUtil;
 import com.facebook.react.interfaces.fabric.ReactSurface;
 import com.facebook.react.internal.featureflags.ReactNativeNewArchitectureFeatureFlags;
 import com.facebook.react.modules.core.PermissionListener;
@@ -168,7 +169,8 @@ protected ReactRootView createRootView() {
                 };
           }
           if (mainComponentName != null) {
-            loadApp(mainComponentName);
+            LocalNetworkPermissionUtil.requestLocalNetworkAccessIfNeeded(
+                getPlainActivity(), () -> loadApp(mainComponentName));
           }
         });
   }

packages/react-native/ReactAndroid/src/main/java/com/facebook/react/devsupport/LocalNetworkPermissionUtil.kt

@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+
+package com.facebook.react.devsupport
+
+import android.app.Activity
+import android.content.pm.PackageManager
+import android.os.Build
+import com.facebook.react.common.build.ReactBuildConfig
+import com.facebook.react.modules.core.PermissionAwareActivity
+import com.facebook.react.util.AndroidVersion
+
+/**
+ * Debug-only helper to request the runtime `ACCESS_LOCAL_NETWORK` permission needed to reach Metro
+ * on Android 17 (SDK 37) devices, which gate local-network addresses (the emulator's `10.0.2.2`
+ * alias, a device's Wi-Fi/LAN IP). Requested only in debuggable builds, and always (like iOS),
+ * since the dev-server host can change at runtime (e.g. switching from `adb reverse` to a LAN IP).
+ */
+internal object LocalNetworkPermissionUtil {
+  private const val PERMISSION = "android.permission.ACCESS_LOCAL_NETWORK"
+  private const val PERMISSION_REQUEST_CODE = 1
+
+  /**
+   * Invokes [onResolved] once it is safe to connect to Metro: immediately when no permission is
+   * needed, or after the user answers the `ACCESS_LOCAL_NETWORK` prompt otherwise.
+   */
+  @JvmStatic
+  fun requestLocalNetworkAccessIfNeeded(activity: Activity, onResolved: Runnable) {
+    if (activity is PermissionAwareActivity && needsLocalNetworkPrompt(activity)) {
+      activity.requestPermissions(arrayOf(PERMISSION), PERMISSION_REQUEST_CODE) { _, _, _ ->
+        onResolved.run()
+        true
+      }
+    } else {
+      onResolved.run()
+    }
+  }
+
+  /** Whether the `ACCESS_LOCAL_NETWORK` prompt must be shown before reaching the dev server. */
+  private fun needsLocalNetworkPrompt(activity: Activity): Boolean {
+    if (!ReactBuildConfig.DEBUG) return false // dev-server only; never prompt in release builds
+    if (Build.VERSION.SDK_INT < AndroidVersion.VERSION_CODE_CINNAMON_BUN) return false
+    return activity.checkSelfPermission(PERMISSION) != PackageManager.PERMISSION_GRANTED
+  }
+}

packages/react-native/ReactAndroid/src/main/java/com/facebook/react/util/AndroidVersion.kt

@@ -27,6 +27,13 @@ internal object AndroidVersion {
    */
   internal const val VERSION_CODE_BAKLAVA: Int = 36
 
+  /**
+   * This is the version code for Android 17 (SDK Level 37). Internally at Meta this code is also
+   * compiled against SDK 34, so we need to retain this constant instead of using
+   * [Build.VERSION_CODES.CINNAMON_BUN] directly.
+   */
+  internal const val VERSION_CODE_CINNAMON_BUN: Int = 37
+
   /**
    * android.R.attr.windowOptOutEdgeToEdgeEnforcement added in API 35. Internally at Meta this code
    * is compiled against an SDK that may not have this attribute defined.

packages/react-native/ReactNativeApi.d.ts

@@ -4,7 +4,7 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  *
- * @generated SignedSource<<6fd7172a54686bbab8a03359976ef63d>>
+ * @generated SignedSource<<b039d3ad12debfc2af81bc7dc85fb584>>
  *
  * This file was generated by scripts/js-api/build-types/index.js.
  */
@@ -3548,6 +3548,7 @@ declare type PermissionsType = {
   readonly ACCESS_BACKGROUND_LOCATION: "android.permission.ACCESS_BACKGROUND_LOCATION"
   readonly ACCESS_COARSE_LOCATION: "android.permission.ACCESS_COARSE_LOCATION"
   readonly ACCESS_FINE_LOCATION: "android.permission.ACCESS_FINE_LOCATION"
+  readonly ACCESS_LOCAL_NETWORK: "android.permission.ACCESS_LOCAL_NETWORK"
   readonly ACCESS_MEDIA_LOCATION: "android.permission.ACCESS_MEDIA_LOCATION"
   readonly ACTIVITY_RECOGNITION: "android.permission.ACTIVITY_RECOGNITION"
   readonly ADD_VOICEMAIL: "com.android.voicemail.permission.ADD_VOICEMAIL"
@@ -6053,9 +6054,9 @@ export {
   PanResponderCallbacks, // 6d63e7be
   PanResponderGestureState, // 54baf558
   PanResponderInstance, // 69cebbe8
-  Permission, // 06473f4f
+  Permission, // 08f1c82f
   PermissionStatus, // 4b7de97b
-  PermissionsAndroid, // db2a401e
+  PermissionsAndroid, // 8a0bc8d8
   PixelRatio, // 10d9e32d
   Platform, // b73caa89
   PlatformColor, // 8297ec62