Permission status checking implemented before API calls

Assuming a permission granted at app install remains in effect for the lifetime of the app is incorrect on both iOS and Android. Users can revoke permissions at any time in system Settings — the next API call after revocation will fail with an authorization error. OWASP A01 (Broken Access Control) includes improper assumption of access grants as a sub-class. CWE-272 (Least Privilege Violation) applies when code accesses hardware without verifying current authorization state. Beyond correctness, skip-the-check patterns are fragile across OS upgrades: iOS 15 introduced 'last week you used' notifications that prompt users to reconsider permissions, and Android 11 introduced auto-reset for apps unused for months — both of which silently revoke permissions that code was assuming were permanent.

Call check() before every protected API access — not just before the initial request. Cache the result for the duration of a single user interaction, not across sessions.

import { check, request, PERMISSIONS, RESULTS } from 'react-native-permissions'

async function getContacts(): Promise<Contact[]> {
  // Check current status — do not assume granted from a previous session
  let status = await check(PERMISSIONS.IOS.CONTACTS)

  if (status === RESULTS.DENIED) {
    status = await request(PERMISSIONS.IOS.CONTACTS)
  }

  if (status !== RESULTS.GRANTED) {
    return [] // Degrade gracefully — empty list, not a crash
  }

  return ContactsModule.getAll()
}

For frequent calls (e.g., GPS polling), check permission status at the start of each polling cycle rather than assuming it is still valid from the previous one. On Android, permission revocation takes effect at the process level — the app does not need to restart for the revocation to apply.