Develop

app.config.ts

@@ -50,7 +50,8 @@ export default ({ config }: ConfigContext): ExpoConfig => ({
       UIBackgroundModes: ['remote-notification', 'audio', 'bluetooth-central', 'voip'],
       ITSAppUsesNonExemptEncryption: false,
       UIViewControllerBasedStatusBarAppearance: false,
-      NSBluetoothAlwaysUsageDescription: 'Allow Resgrid Dispatch to connect to bluetooth devices for PTT.',
+      NSBluetoothAlwaysUsageDescription:
+        'Resgrid Dispatch uses Bluetooth to connect to wireless headsets and speaker-microphone accessories for Push-to-Talk audio. For example, when you pair a Bluetooth speaker-mic, pressing its talk button transmits your voice to your department audio channel.',
       LSApplicationQueriesSchemes: [Env.SCHEME, 'https', 'http'],
     },
     entitlements: {
@@ -97,9 +98,11 @@ export default ({ config }: ConfigContext): ExpoConfig => ({
       'android.permission.POST_NOTIFICATIONS',
       'android.permission.FOREGROUND_SERVICE',
       'android.permission.FOREGROUND_SERVICE_MICROPHONE',
-      'android.permission.FOREGROUND_SERVICE_CONNECTED_DEVICE',
-      'android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK',
     ],
+    // FOREGROUND_SERVICE_CONNECTED_DEVICE is blocked, not merely absent: Bluetooth PTT handsets
+    // route through the microphone FGS session, so the type is unused, and Play rejects any
+    // declared foreground-service type whose use case cannot be demonstrated in the app.
+    blockedPermissions: ['android.permission.FOREGROUND_SERVICE_CONNECTED_DEVICE'],
   },
   web: {
     favicon: './assets/favicon.png',
@@ -215,9 +218,12 @@ export default ({ config }: ConfigContext): ExpoConfig => ({
     [
       'expo-location',
       {
-        locationWhenInUsePermission: 'Allow Resgrid Dispatch to show current location on map.',
-        locationAlwaysAndWhenInUsePermission: 'Allow Resgrid Dispatch to use your location for department updates.',
-        locationAlwaysPermission: 'Resgrid Dispatch needs to track your location for department AVL.',
+        locationWhenInUsePermission:
+          'Resgrid Dispatch uses your location while you use the app to center the department map on you and to attach your coordinates when you dispatch or update a call. For example, when you create a call from the field, your location can be used as the incident address.',
+        locationAlwaysAndWhenInUsePermission:
+          'Resgrid Dispatch uses your location, including in the background, to keep the department map updated with your position. For example, while you are working a call away from the console, your location is periodically sent so other dispatchers and responders can see where you are, even when the app is not on screen.',
+        locationAlwaysPermission:
+          'Resgrid Dispatch uses your location in the background to keep the department map updated with your position. For example, while you are working a call away from the console, your location is periodically sent so other dispatchers and responders can see where you are, even when the app is not on screen.',
         isIosBackgroundLocationEnabled: true,
         isAndroidBackgroundLocationEnabled: true,
         isAndroidForegroundServiceEnabled: true,
@@ -277,6 +283,15 @@ export default ({ config }: ConfigContext): ExpoConfig => ({
         iCloudContainerEnvironment: 'Production',
       },
     ],
+    [
+      'expo-image-picker',
+      {
+        photosPermission:
+          'Resgrid Dispatch uses your photo library so you can attach existing photos to calls and chat messages. For example, you can select a saved photo of an incident scene and attach it to an active call to share it with responders.',
+        cameraPermission:
+          'Resgrid Dispatch uses the camera to take photos that you attach to calls. For example, you can photograph an incident scene or document and attach the image to the active call for responders and other dispatchers to see.',
+      },
+    ],
     [
       '@sentry/react-native/expo',
       {
@@ -296,12 +311,21 @@ export default ({ config }: ConfigContext): ExpoConfig => ({
     [
       'expo-audio',
       {
-        microphonePermission: 'Allow Resgrid Dispatch to access the microphone for audio input used in PTT and calls.',
+        microphonePermission:
+          'Resgrid Dispatch uses the microphone to capture your voice for Push-to-Talk and voice calls with your department. For example, when you press and hold the talk button in the dispatch console, your voice is transmitted live to responders on the audio channel.',
       },
     ],
     'react-native-ble-manager',
     '@livekit/react-native-expo-plugin',
-    '@config-plugins/react-native-webrtc',
+    [
+      '@config-plugins/react-native-webrtc',
+      {
+        // Set explicitly so the plugin's vague 'Allow $(PRODUCT_NAME) to access your camera'
+        // default can never end up in the built Info.plist.
+        cameraPermission:
+          'Resgrid Dispatch uses the camera to take photos that you attach to calls. For example, you can photograph an incident scene or document and attach the image to the active call for responders and other dispatchers to see.',
+      },
+    ],
     '@config-plugins/react-native-callkeep',
     'expo-web-browser',
     './customGradle.plugin.js',

customManifest.plugin.js

@@ -1,5 +1,7 @@
 const { withAndroidManifest, AndroidConfig } = require('@expo/config-plugins');
 
+const SERVICE_NAME = 'app.notifee.core.ForegroundService';
+
 const withForegroundService = (config) => {
   return withAndroidManifest(config, async (config) => {
     const manifest = config.modResults;
@@ -11,13 +13,23 @@ const withForegroundService = (config) => {
     const mainApplication = AndroidConfig.Manifest.getMainApplicationOrThrow(manifest);
 
     mainApplication['service'] = mainApplication['service'] || [];
-    mainApplication['service'].push({
+
+    // Idempotent: a prebuild that reuses an existing android/ dir already has this service in
+    // the base manifest — and non-clean prebuilds have already accumulated duplicates there — so
+    // drop every copy before adding the canonical one.
+    const serviceEntry = {
       $: {
-        'android:name': 'app.notifee.core.ForegroundService',
-        'android:foregroundServiceType': 'microphone|mediaPlayback|connectedDevice',
+        'android:name': SERVICE_NAME,
+        // microphone only. mediaPlayback and connectedDevice are intentionally absent: this
+        // service backs PTT capture, expo-audio owns its own mediaPlayback service for stream
+        // playback, and Bluetooth PTT handsets run on the same microphone session. Play rejects
+        // foreground-service types whose use case cannot be demonstrated in the app.
+        'android:foregroundServiceType': 'microphone',
         'tools:replace': 'android:foregroundServiceType',
       },
-    });
+    };
+    mainApplication['service'] = mainApplication['service'].filter((service) => service?.$?.['android:name'] !== SERVICE_NAME);
+    mainApplication['service'].push(serviceEntry);
     return config;
   });
 };

src/api/calls/callFiles.ts

@@ -1,8 +1,10 @@
 import axios, { type AxiosProgressEvent, type AxiosRequestConfig, type AxiosResponse } from 'axios';
 
 import { createApiEndpoint } from '@/api/common/client';
+import { getBaseApiUrl } from '@/lib/storage/app';
 import { type CallFilesResult } from '@/models/v4/callFiles/callFilesResult';
 import { type SaveCallFileResult } from '@/models/v4/callFiles/saveCallFileResult';
+import useAuthStore from '@/stores/auth/store';
 
 // Event types for the download process
 export type DownloadEventType = 'start' | 'progress' | 'complete' | 'error';
@@ -29,6 +31,25 @@ const getCallFilesApi = createApiEndpoint('/CallFiles/GetFilesForCall');
 const saveCallFileApi = createApiEndpoint('/CallFiles/SaveCallFile');
 
 // Function to download a file with progress reporting
+/**
+ * Whether `url` points at the department's own Resgrid API.
+ *
+ * Attachment URLs arrive inside the server payload, and not all of them are ours: a department on
+ * external blob storage gets a pre-signed CDN link back. Those links carry their own credential in
+ * the query string and need no bearer, so sending one would hand this member's access token to a
+ * third-party host for nothing.
+ */
+const isApiOrigin = (url: string): boolean => {
+  try {
+    const target = new URL(url, getBaseApiUrl());
+    const api = new URL(getBaseApiUrl());
+    return target.origin === api.origin;
+  } catch {
+    // An unparseable URL is not a host we can vouch for.
+    return false;
+  }
+};
+
 export const getCallAttachmentFile = async (url: string, options: DownloadOptions = {}): Promise<Blob> => {
   const { onEvent, headers = {}, timeout = 30000 } = options;
 
@@ -38,9 +59,16 @@ export const getCallAttachmentFile = async (url: string, options: DownloadOption
       type: 'start',
     });
 
+    // Attach the signed-in bearer, but only for our own API origin: authenticated file routes
+    // require it, the anonymous signed-link route simply ignores it, and an external storage or
+    // CDN host must never see it. Caller-supplied headers win on conflict.
+    const token = isApiOrigin(url) ? useAuthStore.getState().accessToken : null;
     const config: AxiosRequestConfig = {
       responseType: 'blob',
-      headers,
+      headers: {
+        ...(token ? { Authorization: `Bearer ${token}` } : {}),
+        ...headers,
+      },
       timeout,
       onDownloadProgress: (progressEvent: AxiosProgressEvent) => {
         if (progressEvent.total) {

src/api/chat/chat.ts

@@ -223,8 +223,11 @@ export const getChatAttachmentThumbnailUrl = (attachmentId: string): string => `
  * Image source (with bearer auth header) suitable for expo-image / RN Image
  * when rendering a chat attachment.
  */
-export const getChatAttachmentImageSource = (attachmentId: string) => {
-  const token = useAuthStore.getState().accessToken;
+export const getChatAttachmentImageSource = (attachmentId: string, accessToken?: string | null) => {
+  // `accessToken` lets a component pass the token it is subscribed to. Reading it from the store
+  // here is a one-shot snapshot, so a component that does not subscribe would keep rendering the
+  // pre-refresh bearer after a token rotation and the image request would 401.
+  const token = accessToken !== undefined ? accessToken : useAuthStore.getState().accessToken;
   return {
     uri: getChatAttachmentUrl(attachmentId),
     headers: token ? { Authorization: `Bearer ${token}` } : undefined,

src/api/common/client.tsx

@@ -1,6 +1,7 @@
 import axios, { type AxiosError, type AxiosInstance, type InternalAxiosRequestConfig } from 'axios';
 
 import { performTokenRefresh } from '@/lib/auth/token-refresh';
+import { readProtectedGrantHeaders } from '@/lib/data-protection/grant-provider';
 import { logger } from '@/lib/logging';
 import { getBaseApiUrl } from '@/lib/storage/app';
 import useAuthStore from '@/stores/auth/store';
@@ -60,6 +61,21 @@ axiosInstance.interceptors.request.use(
     }
 
     config.headers.Authorization = `Bearer ${accessToken}`;
+
+    // Advanced Data Protection: while the member holds a live grant, every read through this
+    // instance carries it, so a protected value comes back decrypted instead of REDACTED.
+    //
+    // Attached centrally on purpose. The alternative - each screen remembering to add the header -
+    // is the failure mode that already shipped twice on the web side, and it fails SILENTLY: the
+    // page looks fine and simply shows placeholders. The grant only ever goes to Resgrid's own API
+    // (this instance's baseURL), is short-lived, and is bound to this member, department and policy
+    // epoch, so the server is the only thing that can act on it.
+    if (config.headers) {
+      for (const [name, value] of Object.entries(readProtectedGrantHeaders())) {
+        config.headers.set(name, value);
+      }
+    }
+
     return config;
   },
   (error: AxiosError) => {

src/api/data-protection/data-protection.ts

@@ -0,0 +1,71 @@
+import { api } from '../common/client';
+
+const DATA_PROTECTION = '/DataProtection';
+
+// ---------------------------------------------------------------------------
+// Advanced Data Protection (ADP) — capability report, MFA step-up, and the
+// exemption path.
+//
+// The step-up window is ABSOLUTE: the server returns its expiry once and never
+// slides it. Clients conceal protected values at expiry and ask again on the
+// next reveal.
+// ---------------------------------------------------------------------------
+
+export interface DataProtectionCapabilitiesData {
+  State: number;
+  StateName?: string | null;
+  IsProtectionEnabled: boolean;
+  CatalogVersion: number;
+  CurrentCatalogVersion: number;
+  PolicyEpoch: number;
+  StepUpWindowMinutes: number;
+  IsDepartmentLocked: boolean;
+  LockReason?: string | null;
+  LockProjectedEndUtc?: string | null;
+}
+
+export interface DataProtectionCapabilitiesResult {
+  Data?: DataProtectionCapabilitiesData;
+}
+
+export interface StepUpResult {
+  /** Grant id (jti) for display/audit correlation; null when grants are not configured. */
+  GrantId?: string | null;
+  /** Signed Protected Data Grant. MEMORY ONLY — never persisted, never logged. */
+  GrantToken?: string | null;
+  /** Absolute UTC expiry of the step-up window (ISO 8601). */
+  StepUpExpiresOnUtc?: string | null;
+  StepUpWindowMinutes?: number;
+}
+
+/** Value-free ADP capability report for the caller's department. */
+export const getDataProtectionCapabilities = async (signal?: AbortSignal) => {
+  const response = await api.get<DataProtectionCapabilitiesResult>(`${DATA_PROTECTION}/Capabilities`, { signal });
+  return response.data;
+};
+
+/**
+ * Asks for a grant WITHOUT a second factor.
+ *
+ * A department may release named apps from the step-up prompt (ADP plan 3.3) — a dispatcher on a
+ * live incident cannot stop to read a code off a phone. The server answers with a grant when this
+ * department has exempted THIS app, and with `step_up_required` otherwise. The client never makes
+ * that decision; it only asks and reacts.
+ *
+ * Nothing is weakened by asking: the caller is still authenticated, and the grant that comes back
+ * is still tenant-bound, epoch-bound, short-lived and audited on every read it authorizes.
+ */
+export const requestProtectedGrant = async () => {
+  const response = await api.post<StepUpResult>(`${DATA_PROTECTION}/RequestGrant`, {});
+  return response.data;
+};
+
+/**
+ * Verifies the user's authenticator (TOTP) code for the ADP step-up.
+ * Server problem types: invalid_totp (400/401), mfa_not_enrolled (409),
+ * too_many_attempts (429). The code is never logged anywhere.
+ */
+export const verifyStepUp = async (code: string) => {
+  const response = await api.post<StepUpResult>(`${DATA_PROTECTION}/VerifyStepUp`, { Code: code });
+  return response.data;
+};

src/app/(app)/_layout.tsx

@@ -10,6 +10,7 @@ import { useTranslation } from 'react-i18next';
 import { ActivityIndicator, Platform, StyleSheet, Text as RNText, TouchableOpacity, View as RNView } from 'react-native';
 import { useSafeAreaInsets } from 'react-native-safe-area-context';
 
+import { StepUpPromptHost } from '@/components/data-protection/step-up-prompt-host';
 import { DashboardViewToggles } from '@/components/dispatch-console';
 import { NotificationButton } from '@/components/notifications/NotificationButton';
 import { NotificationInbox } from '@/components/notifications/NotificationInbox';
@@ -35,6 +36,7 @@ import { useLiveKitStore } from '@/stores/app/livekit-store';
 import { useCallsStore } from '@/stores/calls/store';
 import { useChatStore } from '@/stores/chat/store';
 import { useCheckInStore } from '@/stores/checkIn/store';
+import { dataProtectionStore } from '@/stores/data-protection/store';
 import { FeatureFlagKeys, featureFlagsStore } from '@/stores/feature-flags/store';
 import useLockscreenStore from '@/stores/lockscreen/store';
 import { useRolesStore } from '@/stores/roles/store';
@@ -216,7 +218,7 @@ export default function TabLayout() {
           context: { platform: Platform.OS },
         });
 
-        await featureFlagsStore.getState().fetchFlags();
+        await featureFlagsStore.getState().fetchFlags(), dataProtectionStore.getState().fetchCapabilities();
 
         logger.info({
           message: 'Feature flags fetched, connecting SignalR',
@@ -612,7 +614,14 @@ export default function TabLayout() {
     logger.info({
       message: 'Rendering app layout for web platform (Novu disabled)',
     });
-    return content;
+    // The app's single Advanced Data Protection prompt: any screen triggers it through the store,
+    // so no screen carries a modal of its own and two prompts can never stack.
+    return (
+      <>
+        <StepUpPromptHost />
+        {content}
+      </>
+    );
   }
 
   return (
@@ -621,6 +630,7 @@ export default function TabLayout() {
         <NovuProvider subscriberId={`${rights?.DepartmentCode}_User_${userId}`} applicationIdentifier={config.NovuApplicationId} backendUrl={config.NovuBackendApiUrl} socketUrl={config.NovuSocketUrl}>
           {/* NotificationInbox at the root level */}
           <NotificationInbox isOpen={isNotificationsOpen} onClose={() => setIsNotificationsOpen(false)} />
+          <StepUpPromptHost />
           {content}
         </NovuProvider>
       ) : (

src/app/(app)/contacts.tsx

@@ -7,6 +7,7 @@ import { Loading } from '@/components/common/loading';
 import ZeroState from '@/components/common/zero-state';
 import { ContactCard } from '@/components/contacts/contact-card';
 import { ContactDetailsSheet } from '@/components/contacts/contact-details-sheet';
+import { ProtectedRevealBar } from '@/components/data-protection/protected-reveal-bar';
 import { FocusAwareStatusBar } from '@/components/ui';
 import { Box } from '@/components/ui/box';
 import { FlatList } from '@/components/ui/flat-list';
@@ -69,6 +70,13 @@ export default function Contacts() {
     <View className="flex-1 bg-gray-50 dark:bg-gray-900">
       <FocusAwareStatusBar />
       <Box className="flex-1 px-4 pt-4">
+        {/*
+          Contacts are heavily cataloged - names, phone numbers, email, government identifiers and
+          location. They arrive REDACTED and only come back decrypted on a request carrying a grant,
+          so revealing has to re-read the list. Renders nothing without the addon.
+        */}
+        <ProtectedRevealBar onRefresh={() => fetchContacts(true)} />
+
         <Input className="mb-4 rounded-lg bg-white dark:bg-gray-800" size="md" variant="outline">
           <InputSlot className="pl-3">
             <InputIcon as={Search} />