Flutter Permission Validator 🔍 #

A powerful CLI tool that analyzes your Flutter project to detect unused permissions in AndroidManifest.xml and Info.plist. Stop asking for permissions you don't use and avoid App Store rejections!

🎯 Why Use This? #

Mobile app stores have become increasingly strict about permission declarations:

• Avoid App Store Rejections: Apple and Google routinely reject apps that declare permissions they don't actually use. This is one of the most common reasons for app rejection.
• Privacy Compliance: Modern privacy regulations (GDPR, CCPA, App Store guidelines) require data minimization - only collecting data you actually need.
• Better User Trust: Users are more likely to trust apps that request fewer permissions. Excessive permissions can lead to bad reviews and low install rates.
• Reduce App Bloat: Clean up your manifest files and reduce technical debt.
• CI/CD Integration: Catch permission issues before they reach production with automated checks.

🚀 Installation #

Option 1: Activate Globally (Recommended) #

This makes the perm_check command available system-wide:

# Activate the package globally
dart pub global activate flutter_permission_validator

# Verify installation
perm_check --help

Note: Make sure your PATH is set up correctly for global Dart tools:

• macOS/Linux: Add ~/.pub-cache/bin to your PATH
• Windows: Add %LOCALAPPDATA%\Pub\Cache\bin to your PATH

Option 2: Use Locally in a Project #

Add to your pubspec.yaml:

dev_dependencies:
  flutter_permission_validator: ^0.2.0

Then run:

dart pub get

📖 Usage #

Basic Usage #

# Navigate to your Flutter project
cd my_flutter_app

# Run the validator (analyzes current directory)
perm_check

# Or specify a path
perm_check /path/to/flutter/project

# If using local installation
dart run flutter_permission_validator
dart run flutter_permission_validator /path/to/project

What Gets Analyzed #

The tool scans:

1. Android Permissions: android/app/src/main/AndroidManifest.xml

   • Detects <uses-permission> tags
   • Identifies 60+ Android permission types

2. iOS Permissions: ios/Runner/Info.plist

   • Detects NS*UsageDescription keys
   • Identifies 35+ iOS permission types

3. Web Permissions: No manifest file needed

   • Detects browser permission usage in code
   • Identifies 6 Web permission types

4. Dart Code: All files in lib/ directory

   • API calls related to permissions
   • Plugin imports and usage
   • Package dependencies in pubspec.yaml

Exit Codes #

• 0: No issues found (all permissions are properly used)
• 1: Issues found (unused or missing permissions detected)

This makes it perfect for CI/CD pipelines - the build will fail if permission issues are detected.

📊 Output Example #

🔍 Flutter Permission Validator
📁 Project: /Users/dev/my_app

📱 Analyzing Flutter permissions...

✅ Android: 5 permissions declared
   📄 /Users/dev/my_app/android/app/src/main/AndroidManifest.xml

✅ iOS: 3 permissions declared
   📄 /Users/dev/my_app/ios/Runner/Info.plist

🔍 Scanning 42 Dart files...
✅ Code scan: 2 Android permissions potentially used
✅ Code scan: 2 iOS permissions potentially used


============================================================
📊 PERMISSION ANALYSIS RESULTS
============================================================

📱 Android - Unused permissions:
  ❌ android.permission.ACCESS_FINE_LOCATION
  ❌ android.permission.RECORD_AUDIO
  ❌ android.permission.READ_CONTACTS

📱 iOS - Unused permissions:
  ❌ NSMicrophoneUsageDescription

============================================================

Clean, simple output - Only shows unused permissions that can be safely removed from your manifests.

🔬 How It Works #

The analysis process involves four main steps:

1. Parse Manifest Files

   • Locates AndroidManifest.xml in standard Flutter Android paths
   • Locates Info.plist in standard Flutter iOS paths
   • Extracts all declared permissions

2. Scan Dart Code

   • Recursively scans all .dart files in lib/
   • Searches for permission-related patterns using regex
   • Identifies API calls, imports, and class usages

3. Analyze Dependencies

   • Reads pubspec.yaml for package dependencies
   • Maps common packages to their required permissions
   • Example: geolocator package → location permissions

4. Compare and Report

   • Matches declared permissions against detected usage
   • Identifies unused permissions (declared but not used)
   • Identifies missing permissions (used but not declared)
   • Generates detailed report with actionable recommendations

🎨 Features #

Comprehensive Permission Detection #

Smart Package Detection #

The tool automatically detects permissions required by popular Flutter packages:

• geolocator → Location permissions
• camera → Camera permissions
• image_picker → Camera/Photo Library permissions
• flutter_contacts → Contacts permissions
• flutter_sound → Audio recording permissions
• flutter_blue / flutter_reactive_ble → Bluetooth permissions
• flutter_local_notifications → Notification permissions
• shared_preferences → No permissions needed
• device_info_plus → Device info permissions
• connectivity_plus → Network state permissions
• path_provider → Storage access permissions
• And 60+ more packages...

📦 Supported Permission Patterns #

The tool uses sophisticated pattern matching to detect permission usage in your code:

Android Permissions (60+) #

Camera & Media

• CAMERA - CameraController, ImagePicker, takePicture(), pickImage()

Location

• ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION, ACCESS_BACKGROUND_LOCATION - Geolocator, getCurrentPosition(), getLocation()

Storage

• READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE - FilePicker, Directory, File, path_provider
• READ_MEDIA_IMAGES, READ_MEDIA_VIDEO, READ_MEDIA_AUDIO - PhotoManager, image_picker
• MANAGE_EXTERNAL_STORAGE - File system management

Microphone & Audio

• RECORD_AUDIO - AudioRecorder, record(), flutter_sound, audioplayers

Contacts & Accounts

• READ_CONTACTS, WRITE_CONTACTS - Contacts, flutter_contacts
• GET_ACCOUNTS - google_sign_in, firebase_auth

Phone & SMS

• READ_PHONE_STATE, READ_PHONE_NUMBERS, CALL_PHONE - device_info_plus, url_launcher
• READ_CALL_LOG, ANSWER_PHONE_CALLS - Phone call management
• SEND_SMS, READ_SMS, RECEIVE_SMS, RECEIVE_MMS - SMS handling

Calendar

• READ_CALENDAR, WRITE_CALENDAR - Calendar, table_calendar

Bluetooth

• BLUETOOTH, BLUETOOTH_ADMIN, BLUETOOTH_SCAN - flutter_blue, flutter_reactive_ble
• BLUETOOTH_CONNECT, BLUETOOTH_ADVERTISE - BLE operations

WiFi & Network

• ACCESS_WIFI_STATE, CHANGE_WIFI_STATE - wifi_iot, network_info_plus
• NEARBY_WIFI_DEVICES - Nearby devices API
• INTERNET, ACCESS_NETWORK_STATE - HTTP requests, connectivity checks

Sensors & Body

• BODY_SENSORS, USE_SENSORS - Sensors, health, fitness, pedometer
• ACTIVITY_RECOGNITION - Activity detection, step counting

Notifications

• POST_NOTIFICATIONS - flutter_local_notifications, awesome_notifications

Alarms & Background

• SCHEDULE_EXACT_ALARM, USE_EXACT_ALARM - android_alarm_manager
• RECEIVE_BOOT_COMPLETED - Auto-start on boot
• FOREGROUND_SERVICE, FOREGROUND_SERVICE_CAMERA, FOREGROUND_SERVICE_MICROPHONE, FOREGROUND_SERVICE_LOCATION - Background services

System & Hardware

• VIBRATE - flutter_vibrate
• FLASHLIGHT - torch_light
• USE_BIOMETRIC, USE_FINGERPRINT - local_auth, biometric authentication
• SYSTEM_ALERT_WINDOW - overlay_support, system overlays
• REQUEST_INSTALL_PACKAGES, REQUEST_DELETE_PACKAGES - Package installation
• PACKAGE_USAGE_STATS - App usage tracking
• PROCESS_OUTGOING_CALLS - Call monitoring
• WRITE_SETTINGS - System settings

iOS Permissions (35+) #

Camera & Photos

• NSCameraUsageDescription - CameraController, ImagePicker
• NSPhotoLibraryUsageDescription - ImagePicker, PhotoManager
• NSPhotoLibraryAddUsageDescription - Saving photos to library

Location

• NSLocationWhenInUseUsageDescription - Geolocator, getCurrentPosition()
• NSLocationAlwaysAndWhenInUseUsageDescription - Background location
• NSLocationAlwaysUsageDescription - Always-on location

Audio & Speech

• NSMicrophoneUsageDescription - AudioRecorder, record(), flutter_sound
• NSSpeechRecognitionUsageDescription - Speech-to-text, voice recognition

Contacts & Calendar

• NSContactsUsageDescription - Contacts, flutter_contacts
• NSCalendarsUsageDescription - Calendar events, table_calendar
• NSRemindersUsageDescription - Reminders access

Bluetooth

• NSBluetoothAlwaysUsageDescription - flutter_blue, BLE operations
• NSBluetoothPeripheralUsageDescription - Bluetooth peripheral mode

Biometrics

• NSFaceIDUsageDescription - local_auth, Face ID, Touch ID

Health & Fitness

• NSMotionUsageDescription - Sensors, pedometer, accelerometer, gyroscope
• NSHealthShareUsageDescription - Health data, fitness tracking
• NSHealthUpdateUsageDescription - Writing health data
• NSHealthClinicalHealthRecordsShareUsageDescription - Clinical records

Home & Media

• NSHomeKitUsageDescription - HomeKit integration
• NSAppleMusicUsageDescription - Apple Music, audio playback

File Access

• NSDocumentsFolderUsageDescription - Documents folder
• NSDesktopFolderUsageDescription - Desktop folder
• NSDownloadsFolderUsageDescription - Downloads folder

System Features

• NSSiriUsageDescription - Siri integration
• NSUserTrackingUsageDescription - App tracking transparency
• NSFocusStatusUsageDescription - Focus status detection
• NSCriticalAlertsUsageDescription - Critical alerts (bypass Do Not Disturb)
• NSPaymentsUsageDescription - Apple Pay integration
• NSKeyboardExtensionUsageDescription - Custom keyboard extensions

Web Permissions (6+) #

Media

• camera - CameraController, ImagePicker, getUserMedia()
• microphone - AudioRecorder, record(), getUserMedia()

Location & Storage

• geolocation - Geolocator, getCurrentPosition(), navigator.geolocation
• storage - File system access, Quota API, IndexedDB
• clipboard - Clipboard read/write, navigator.clipboard

System

• notifications - Push notifications, Notification API
• background-sync - Background synchronization, Service Workers

📄 License #

This project is licensed under the MIT License - see the LICENSE file for details.

📚 Additional Resources #

• Android Permissions Guide
• iOS App Privacy Guide
• Flutter Plugin Development
• Web Permissions API

🆘 Troubleshooting #

"Command not found: perm_check" #

Make sure you've added Dart's global bin directory to your PATH:

• macOS/Linux: export PATH="$PATH:$HOME/.pub-cache/bin"
• Windows: Add %LOCALAPPDATA%\Pub\Cache\bin to PATH

False Positives #

The tool uses pattern matching which may occasionally produce false positives:

• Review detected permissions before removing
• Check if dependencies require permissions indirectly
• Test your app after removing permissions

Missing File Warnings #

If you see warnings about missing manifest files:

• Ensure you're running from a valid Flutter project directory
• Check that android/ and ios/ folders exist
• Verify AndroidManifest.xml and Info.plist are in standard locations

Made with ❤️ for the Flutter community

⬆ Back to top