What Permissions Does the QuranApp Android Application Request? A Complete Manifest Analysis

The alfaazplus/quranapp Android application declares ten essential permissions in app/src/main/AndroidManifest.xml, ranging from network access and notification delivery to background audio playback and exact alarm scheduling.

Understanding what permissions an Android app requests is crucial for both user privacy and security auditing. The alfaazplus/quranapp repository implements a Quran reading application that requires specific system capabilities to deliver offline content, audio recitations, and daily reminders. All permissions are centrally declared in app/src/main/AndroidManifest.xml and consumed across key classes like MainActivity.kt and RecitationService.kt.

Complete Permission Manifest

The QuranApp declares permissions across four functional categories, each targeting specific system capabilities required for the app's core features.

Network and Connectivity Permissions

• android.permission.INTERNET (AndroidManifest.xml line 6): Allows the app to open network sockets, enabling it to fetch Quran data, audio files, and other resources from the internet.
• android.permission.ACCESS_NETWORK_STATE (AndroidManifest.xml line 7): Lets the app check the state of network connectivity (Wi-Fi or mobile data) before attempting downloads or API calls.

Notification and Scheduling Permissions

• android.permission.POST_NOTIFICATIONS (AndroidManifest.xml line 8): Required for Android 13+ (API 33) to post user-visible notifications, such as reminders to read or new verse alerts.
• android.permission.SCHEDULE_EXACT_ALARM (AndroidManifest.xml line 9): Enables the app to schedule precise alarms for recurring tasks such as daily verse notifications or recitation reminders.
• android.permission.RECEIVE_BOOT_COMPLETED (AndroidManifest.xml line 12): Lets the app react when the device finishes booting, allowing it to re-schedule alarms or restore services.

Background Service Permissions

• android.permission.FOREGROUND_SERVICE (AndroidManifest.xml line 13): Required for any long-running service that must stay alive while the app is in the background, such as audio playback services.
• android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK (AndroidManifest.xml line 14): Specifically declares that the foreground service will be used for media playback, improving system handling of audio streams.
• android.permission.FOREGROUND_SERVICE_DATA_SYNC (AndroidManifest.xml line 15): Indicates that a foreground service will be used for data synchronization tasks, such as downloading recitation files.
• android.permission.WAKE_LOCK (AndroidManifest.xml line 10): Keeps the CPU running when the screen is off, which is essential for background audio playback of recitations.

Hardware Interaction

• android.permission.VIBRATE (AndroidManifest.xml line 11): Allows the app to trigger device vibration for haptic feedback on button taps.

Runtime Permission Implementation

While most permissions are declared in the manifest, modern Android versions require runtime requests for sensitive operations. The following implementations demonstrate how QuranApp handles these requirements in Kotlin.

Requesting Notification Permission on Android 13+

For devices running Android 13 (API 33) or higher, POST_NOTIFICATIONS becomes a runtime permission. The check typically occurs in MainActivity.kt:

if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
    if (ContextCompat.checkSelfPermission(this, Manifest.permission.POST_NOTIFICATIONS)
        != PackageManager.PERMISSION_GRANTED) {
        ActivityCompat.requestPermissions(
            this,
            arrayOf(Manifest.permission.POST_NOTIFICATIONS),
            REQUEST_NOTIFICATION_PERMISSION
        )
    }
}

Starting Foreground Media Playback

The RecitationService.kt utilizes FOREGROUND_SERVICE_MEDIA_PLAYBACK to maintain audio playback when the app moves to the background:

val intent = Intent(this, RecitationService::class.java).apply {
    action = RecitationService.ACTION_START
    putExtra(RecitationService.EXTRA_SURAH_ID, 1)
}
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
    startForegroundService(intent)
} else {
    startService(intent)
}

Scheduling Exact Alarms for Daily Verses

The VotdReceiver.kt component relies on SCHEDULE_EXACT_ALARM to trigger precise daily notifications:

val alarmManager = getSystemService(Context.ALARM_SERVICE) as AlarmManager
val intent = Intent(this, VotdReceiver::class.java)
val pendingIntent = PendingIntent.getBroadcast(
    this, 0, intent, PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE
)

// Schedule for 8:00 AM every day
val calendar = Calendar.getInstance().apply {
    timeInMillis = System.currentTimeMillis()
    set(Calendar.HOUR_OF_DAY, 8)
    set(Calendar.MINUTE, 0)
    set(Calendar.SECOND, 0)
}
alarmManager.setExactAndAllowWhileIdle(
    AlarmManager.RTC_WAKEUP,
    calendar.timeInMillis,
    pendingIntent
)

Verifying Network Connectivity

Before attempting downloads, the app leverages ACCESS_NETWORK_STATE to check connectivity:

val connectivity = getSystemService(Context.CONNECTIVITY_SERVICE) as ConnectivityManager
val activeNetwork = connectivity.activeNetworkInfo
if (activeNetwork?.isConnected == true) {
    // Proceed with download using OkHttp/Retrofit, etc.
} else {
    Toast.makeText(this, "No network connection", Toast.LENGTH_SHORT).show()
}

Core Implementation Files

The declared permissions are consumed across these key source files in the alfaazplus/quranapp repository:

• app/src/main/AndroidManifest.xml: Central declaration of all ten permissions and application components (activities, services, receivers).
• app/src/main/java/com/quranapp/android/activities/MainActivity.kt: Entry point where runtime permission checks for notifications are performed.
• app/src/main/java/com/quranapp/android/utils/services/RecitationService.kt: Foreground service implementation utilizing FOREGROUND_SERVICE_MEDIA_PLAYBACK for continuous audio playback.
• app/src/main/java/com/quranapp/android/utils/receivers/VotdReceiver.kt: Broadcast receiver handling daily verse notifications through POST_NOTIFICATIONS and SCHEDULE_EXACT_ALARM.
• app/src/main/res/xml/provider_paths.xml: Configures the FileProvider used for sharing downloaded audio files securely.

Summary

• The alfaazplus/quranapp declares ten permissions in AndroidManifest.xml covering network operations, notifications, background services, and hardware control.
• Network permissions (INTERNET, ACCESS_NETWORK_STATE) enable content fetching and connectivity validation before downloads.
• Notification and alarm permissions (POST_NOTIFICATIONS, SCHEDULE_EXACT_ALARM, RECEIVE_BOOT_COMPLETED) support daily verse reminders and ensure alarm persistence across reboots.
• Foreground service permissions (FOREGROUND_SERVICE, FOREGROUND_SERVICE_MEDIA_PLAYBACK, FOREGROUND_SERVICE_DATA_SYNC, WAKE_LOCK) facilitate uninterrupted audio recitation playback and data synchronization.
• Runtime permission checks are implemented for Android 13+ notification requirements in MainActivity.kt.

Frequently Asked Questions

Does QuranApp request storage permissions to save audio files?

No, the alfaazplus/quranapp repository does not declare READ_EXTERNAL_STORAGE or WRITE_EXTERNAL_STORAGE in its manifest. Instead, the application uses Android's scoped storage and the FileProvider configured in provider_paths.xml to manage downloaded recitation files securely without requiring broad storage access.

Why does QuranApp require exact alarm permissions?

The SCHEDULE_EXACT_ALARM permission enables the VotdReceiver component to deliver "Verse of the Day" notifications at precise times set by the user, such as 8:00 AM daily. Without this permission, Android's Doze mode and App Standby Buckets could delay these reminders, reducing reliability for time-sensitive religious observances.

Are all QuranApp permissions requested at runtime?

No, only POST_NOTIFICATIONS requires explicit runtime consent on Android 13 and higher. The other nine permissions are install-time permissions granted automatically upon installation. However, starting with Android 14 (API 34), SCHEDULE_EXACT_ALARM requires additional user confirmation through system settings.

How does QuranApp handle permission denials?

If the user denies POST_NOTIFICATIONS, the app gracefully degrades functionality by disabling daily verse reminders while maintaining core Quran reading capabilities. The MainActivity.kt implementation checks shouldShowRequestPermissionRationale() to determine whether to display an educational UI explaining why notifications enhance the user experience before requesting again.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}