Permissions & Device Features: Hardware & Security

The Android OS secures sensitive device resources, user privacy, and hardware peripherals through a multi-tiered permission subsystem. Permissions fall into three fundamental protection levels:

• Normal Permissions: Minimal risk to user privacy or system operation (e.g. INTERNET, ACCESS_NETWORK_STATE, SET_WALLPAPER). Granted automatically by the OS at install time without prompting the user.
• Dangerous (Runtime) Permissions: Provide access to private user data or sensitive hardware peripherals (e.g. CAMERA, ACCESS_FINE_LOCATION, RECORD_AUDIO, READ_CONTACTS). Since Android 6.0 (API 23), apps must request these permissions at runtime when the feature is needed.
• Special / Signature Permissions: System-level permissions requiring user intervention in system settings (e.g. SYSTEM_ALERT_WINDOW for draw-over-other-apps, MANAGE_EXTERNAL_STORAGE for all-files access, or signature-matched OEM OEM permissions).

The original android.hardware.Camera API was deprecated for its rigid architecture, while the lower-level Camera2 API introduced in Android 5.0 (Lollipop) required hundreds of lines of boilerplate to manage sensor streams, surface configurations, and hardware quirks across thousands of fragmented OEM devices.

Jetpack CameraX: Google's modern, opinionated, lifecycle-aware camera abstraction layer that sits on top of Camera2. CameraX eliminates OEM-specific edge cases (such as aspect ratio stretching, rotation quirks, and HDR crashes) through internal Google-tested device compatibility databases.

• Preview Use Case: Streams live sensor feed directly to an on-screen Compose AndroidView(PreviewView).
• ImageCapture Use Case: Captures high-resolution JPEG photos to memory or file storage with hardware flash, auto-focus, and rotation handling.
• ImageAnalysis Use Case: Provides a continuous buffer of non-blocking frames (YUV_420_888 format) for real-time ML Kit processing (e.g. barcode/QR code scanning, face detection, OCR).

Accessing raw GPS hardware chips directly via Android's legacy LocationManager is notoriously battery-expensive and slow (often requiring up to 30 seconds for a cold GPS satellite lock). Google Play Services provides the FusedLocationProviderClient, which seamlessly combines signals from:

• GPS Satellites: Precise outdoor triangulation (accuracy < 5 meters, high power).
• Wi-Fi Access Points: SSID signal RSSI mapping (indoor & urban accuracy 10–50m, low power).
• Cellular Base Stations: Cell tower ID triangulation (accuracy 500–2000m, negligible power).
• Inertial Device Sensors: Accelerometers and gyroscopes for dead-reckoning between GPS fixes.

In Android 13 (API 33), Google eliminated READ_EXTERNAL_STORAGE and replaced it with granular media permissions:

• android.permission.READ_MEDIA_IMAGES (Photos, screenshots, diagrams)
• android.permission.READ_MEDIA_VIDEO (Recorded camera footage, downloaded MP4s)
• android.permission.READ_MEDIA_AUDIO (Podcasts, voice notes, songs)

The Revolutionary Android Photo Picker: Introduced via Google Play System updates for Android 11+ (and backported to Android 4.4+ via Google Play Services), the Photo Picker lets users select specific photos or videos to share with an app without granting ANY storage or media permissions whatsoever!

@Composable
fun ProfileAvatarPicker(onImageSelected: (Uri) -> Unit) {
    // ZERO PERMISSIONS REQUIRED! Works out of the box on Android 11+
    val pickerLauncher = rememberLauncherForActivityResult(
        contract = ActivityResultContracts.PickVisualMedia()
    ) { uri: Uri? ->
        uri?.let(onImageSelected)
    }

    Button(onClick = {
        pickerLauncher.launch(
            PickVisualMediaRequest(ActivityResultContracts.PickVisualMedia.ImageOnly)
        )
    }) {
        Text("Select Profile Photo (Zero Permission)")
    }
}

Android devices pack an array of micro-electro-mechanical (MEMS) sensors to measure motion, orientation, and ambient environmental conditions. The architecture centers around:

• SensorManager: System service used to discover available sensors, register listeners, and configure sampling delays.
• Sensor: Representation of a specific hardware sensor (e.g. TYPE_ACCELEROMETER, TYPE_GYROSCOPE, TYPE_LIGHT, TYPE_PROXIMITY).
• SensorEventListener: Callback interface that receives SensorEvent objects containing raw floating-point sensor values (e.g. m/s² acceleration across X, Y, Z axes).

Critical Battery Rule: Sensor chips consume significant battery and keep the CPU awake. Applications MUST register sensor listeners in onResume() and always unregister them in onPause() to prevent severe background battery drain.

class ShakeDetector(
    context: Context,
    private val onShake: () -> Unit
) : SensorEventListener {

    private val sensorManager = context.getSystemService(Context.SENSOR_SERVICE) as SensorManager
    private val accelerometer = sensorManager.getDefaultSensor(Sensor.TYPE_ACCELEROMETER)

    fun start() {
        accelerometer?.let {
            sensorManager.registerListener(this, it, SensorManager.SENSOR_DELAY_UI)
        }
    }

    fun stop() {
        sensorManager.unregisterListener(this) // Mandatory to stop battery drain!
    }

    override fun onSensorChanged(event: SensorEvent?) {
        event?.let {
            val x = it.values[0]
            val y = it.values[1]
            val z = it.values[2]
            val acceleration = Math.sqrt((x * x + y * y + z * z).toDouble()) - SensorManager.GRAVITY_EARTH
            if (acceleration > 12.0) {
                onShake()
            }
        }
    }

    override fun onAccuracyChanged(sensor: Sensor?, accuracy: Int) {}
}

Instead of reinventing custom SMS or telephony engines, Android encourages Intent-based delegation to established system applications:

• Content Sharing (Intent.ACTION_SEND): Invokes the native Android Sharesheet via Intent.createChooser(), allowing users to send text, URLs, or file URIs (via FileProvider) to WhatsApp, Slack, Gmail, or Telegram seamlessly.
• Phone Calls (Intent.ACTION_DIAL): Opens the system phone dialer with a pre-filled telephone number (e.g. tel:+1234567890). Requires NO permissions because the user must explicitly press the call button. (Contrasts with ACTION_CALL, which places the call directly and requires dangerous CALL_PHONE permission).
• SMS Messaging (Intent.ACTION_SENDTO): Opens the messaging app with the recipient number and pre-drafted message using the smsto: URI scheme without requiring SEND_SMS permission.

object DeviceIntentHelper {
    fun shareText(context: Context, text: String) {
        val sendIntent = Intent().apply {
            action = Intent.ACTION_SEND
            putExtra(Intent.EXTRA_TEXT, text)
            type = "text/plain"
        }
        context.startActivity(Intent.createChooser(sendIntent, "Share DevAscent Notes Via:"))
    }

    fun openDialer(context: Context, phoneNumber: String) {
        val dialIntent = Intent(Intent.ACTION_DIAL).apply {
            data = Uri.parse("tel:$phoneNumber")
        }
        context.startActivity(dialIntent)
    }
}