Waseel: driver capture, chat/calls, dispatch, and session fixes

Driver onboarding now photographs the licence, ID card and vehicle
registration and reads the credential fields off them, plus a camera-only
profile selfie riders check the arriving driver against. Adds in-app chat
and WebRTC calls, push-backed ride offers, ratings, cancellation and
payment sheets, settlement, and the owner dashboard endpoints behind them.

Camera permission on Android:
  - Declare CAMERA and READ_MEDIA_IMAGES in the manifest. expo-image-picker's
    own plugin never declares CAMERA, and Android denies a request for an
    undeclared permission instantly and silently — no dialog is ever shown,
    which is indistinguishable from the app not asking at all.
  - Handle canAskAgain: once Android stops showing the dialog, repeating why
    we need it is a dead end, so offer Open Settings instead (lib/capture-
    permission.ts), matching what the location flow already did.

Session: a 401 on a request that carried a token now ends the session
instead of being reinterpreted per-screen — driver-home had been reading it
as "this user has no driver profile" and showing an onboarding form to an
already-onboarded driver. Requests without a token are exempt so a failed
sign-in doesn't sign you out, and the notification is latched per token so
concurrent polls tear the session down once. (root) gains the auth guard
that turns that into the sign-in screen; app/index.tsx only guarded the way
in, leaving a session that ended mid-screen with nowhere to go.

Also ignore .uploads/ — it holds driver licence, ID and vehicle scans plus
profile photos, which are personal data and must not be committed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app.config.js

@@ -63,6 +63,62 @@ const withOverlayPermission = (config) =>
     return cfg;
   });
 
+// In-app WebRTC audio calls need the microphone. react-native-webrtc ships no
+// Expo config plugin, so both platforms' mic permissions are declared here:
+// the iOS Info.plist usage string lives in `ios.infoPlist` below, and the
+// Android RECORD_AUDIO / MODIFY_AUDIO_SETTINGS permissions are added to the
+// manifest at prebuild time — the grant itself is requested at runtime from
+// the call screen.
+const withMicPermission = (config) =>
+  withAndroidManifest(config, (cfg) => {
+    const manifest = cfg.modResults.manifest;
+    manifest["uses-permission"] = manifest["uses-permission"] || [];
+
+    const needed = [
+      "android.permission.RECORD_AUDIO",
+      "android.permission.MODIFY_AUDIO_SETTINGS",
+    ];
+
+    for (const name of needed) {
+      const exists = manifest["uses-permission"].some(
+        (entry) => entry.$ && entry.$["android:name"] === name,
+      );
+      if (!exists) {
+        manifest["uses-permission"].push({ $: { "android:name": name } });
+      }
+    }
+
+    return cfg;
+  });
+
+// expo-image-picker's own plugin never declares CAMERA on Android — it only
+// blocks permissions when you ask it to. Without the declaration,
+// requestCameraPermissionsAsync() is auto-denied by the system and the driver
+// hits "allow camera access" with no way to allow it. READ_MEDIA_IMAGES is the
+// Android 13+ replacement for READ_EXTERNAL_STORAGE, needed for the gallery
+// option on the document scanners.
+const withCapturePermissions = (config) =>
+  withAndroidManifest(config, (cfg) => {
+    const manifest = cfg.modResults.manifest;
+    manifest["uses-permission"] = manifest["uses-permission"] || [];
+
+    const needed = [
+      "android.permission.CAMERA",
+      "android.permission.READ_MEDIA_IMAGES",
+    ];
+
+    for (const name of needed) {
+      const exists = manifest["uses-permission"].some(
+        (entry) => entry.$ && entry.$["android:name"] === name,
+      );
+      if (!exists) {
+        manifest["uses-permission"].push({ $: { "android:name": name } });
+      }
+    }
+
+    return cfg;
+  });
+
 module.exports = ({ config }) => ({
   ...config,
   name: "Waseel",
@@ -82,6 +138,10 @@ module.exports = ({ config }) => ({
   ios: {
     supportsTablet: true,
     bundleIdentifier: "com.waseel.app",
+    infoPlist: {
+      NSMicrophoneUsageDescription:
+        "Waseel uses the microphone for in-app calls with your driver.",
+    },
   },
   android: {
     adaptiveIcon: {
@@ -89,6 +149,12 @@ module.exports = ({ config }) => ({
       backgroundColor: "#ffffff",
     },
     package: "com.waseel.app",
+    // NOTE: minSdkVersion is NOT set here. `android.minSdkVersion` is not a
+    // field Expo's config schema recognises, so prebuild silently ignored it
+    // and generated a project defaulting to 23 — which the manifest merger
+    // then rejected against react-native-webrtc's minSdk 24. It lives in the
+    // expo-build-properties plugin below, which is the supported way to set
+    // it and the only way it survives `prebuild --clean`.
     config: {
       googleMaps: {
         apiKey: googleMapsApiKey ?? "",
@@ -101,13 +167,74 @@ module.exports = ({ config }) => ({
     favicon: "./assets/images/favicon.png",
   },
   plugins: [
+    // react-native-webrtc declares minSdk 24, and the Android manifest merger
+    // refuses to build an app that declares less than a library it links.
+    // Expo's generated project defaults to 23, so this has to be raised
+    // explicitly — and it has to be raised *here*, because a value written
+    // into android/build.gradle or gradle.properties by hand is destroyed by
+    // the next `prebuild --clean`.
+    [
+      "expo-build-properties",
+      {
+        android: {
+          minSdkVersion: 24,
+        },
+      },
+    ],
     [
       "expo-router",
       {
         origin: serverOrigin,
       },
     ],
+    // Drivers are tracked while they're online, and that has to survive the
+    // screen going off — dispatch drops anyone whose last ping is over 60s
+    // old. The foreground service is what keeps the updates flowing on
+    // Android, and it declares the FOREGROUND_SERVICE_LOCATION permission and
+    // the `location` service type that Android 14 requires. It also puts a
+    // persistent notification in the shade, which is the honest way to run
+    // background GPS: the driver can always see that it's on.
+    [
+      "expo-location",
+      {
+        locationAlwaysAndWhenInUsePermission:
+          "Waseel uses your location while you're online to match you with nearby riders and show them your car on the map.",
+        isAndroidBackgroundLocationEnabled: true,
+        isAndroidForegroundServiceEnabled: true,
+      },
+    ],
+    // Ride-offer alerts. The tint colour matches the app's primary so the
+    // small status-bar icon isn't rendered in Android's default grey.
+    [
+      "expo-notifications",
+      {
+        color: "#0286FF",
+      },
+    ],
+    // Driver onboarding photographs the licence, ID card and vehicle
+    // registration so the details can be read off them and a reviewer can see
+    // the document itself. The gallery is offered alongside the camera for
+    // documents because drivers often already have a photo of their papers;
+    // the profile selfie is camera-only and enforced in the component.
+    //
+    // Do NOT add `microphonePermission: false` here. It reads as "this picker
+    // doesn't need the mic", but the plugin implements it as
+    // withBlockedPermissions — which stamps tools:node="remove" on
+    // RECORD_AUDIO and strips it from the *merged* manifest, taking
+    // react-native-webrtc's in-app calls down with it. Leaving it unset lets
+    // the picker declare RECORD_AUDIO harmlessly alongside the calls flow.
+    [
+      "expo-image-picker",
+      {
+        cameraPermission:
+          "Waseel uses the camera to take your driver photo and scan your licence and vehicle papers.",
+        photosPermission:
+          "Waseel needs your photo library so you can upload a picture of your driving licence and vehicle papers.",
+      },
+    ],
     withOverlayPermission,
+    withMicPermission,
+    withCapturePermissions,
     withCleartextTraffic,
   ],
   experiments: {