Greptile Summary

This PR fixes a fatal SecurityException crash on the Map screen that occurred when a user granted location permission, backgrounded the app, revoked permission in Android Settings, and then returned — leaving the ViewModel with a stale hasLocationPermission=true while MapLibre internally called LocationManager.getLastKnownLocation().

The fix introduces three complementary layers of defence:

• A pre-onResume permission re-check in the DisposableEffect lifecycle observer that disables the MapLibre location component and notifies the ViewModel before view.onResume() can restart the location engine.
• try/catch blocks around locationComponent.apply { … } in both onMapStyleLoaded and the LaunchedEffect(state.hasLocationPermission, mapLibreMap) handler, each correctly calling viewModel.onPermissionResult(false) on catch.

Key observations:

• The fix is logically sound for the primary crash path (MapLibre location component / platform LocationManager).
• The ON_RESUME handler cleans up the non-GMS platformLocationListener, but the FusedLocationProviderClient locationCallback registered in startLocationUpdates() is a local variable with no stored reference, so it cannot be removed in the same revocation path. This is a pre-existing architectural gap that the PR doesn't address (see inline comment).
• Code formatting changes (ScreenToLatLng and contactMarkers.find multi-line lambda reformatting) are style-only with no logic impact.

Confidence Score: 4/5

• Safe to merge — the crash fix is correct and all SecurityException catch sites now correctly sync ViewModel state; one minor cleanup gap for the GMS FusedLocationProviderClient callback exists but does not cause crashes.
• Both SecurityException catch sites call viewModel.onPermissionResult(false) consistently, and the pre-resume permission gate correctly disables the location component before MapLibre can restart it. The only identified gap (GMS LocationCallback not removable) is a pre-existing architectural issue that is unlikely to cause crashes since FusedLocationProviderClient handles revoked permissions gracefully internally.
• app/src/main/java/com/lxmf/messenger/ui/screens/MapScreen.kt — specifically the ON_RESUME revocation block and the startLocationUpdates helper regarding GMS callback lifecycle.

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant User
    participant Android as Android Settings
    participant Lifecycle as LifecycleObserver (ON_RESUME)
    participant LPM as LocationPermissionManager
    participant LC as MapLibre LocationComponent
    participant VM as MapViewModel
    participant View as MapView

    User->>Android: Revoke location permission
    User->>Lifecycle: Return to app (ON_RESUME fires)
    Lifecycle->>LPM: hasPermission(context)
    LPM-->>Lifecycle: false
    Lifecycle->>LC: isLocationComponentEnabled = false
    Lifecycle->>VM: onPermissionResult(false)
    Lifecycle->>View: view.onResume() (safe — component already disabled)

    note over LC,VM: LaunchedEffect(hasLocationPermission) fires on state change — no-op since false
    note over LC: If onMapStyleLoaded or LaunchedEffect fires with stale true,<br/>SecurityException is caught → onPermissionResult(false)

_{Last reviewed commit: bf724bc}

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@greptileai