Audio playback failed against the prod HTTPS server with
"Cleartext HTTP traffic to 127.0.0.1 not permitted". Diagnostic
logging confirmed _baseUrl was correctly set to the prod URL — the
127.0.0.1 wasn't coming from the server or our URL construction.
Root cause: just_audio + audio_service spin up a local HTTP proxy on
loopback to inject the Authorization header, because Android's
MediaSession API can't pass headers down to ExoPlayer directly.
ExoPlayer connects to http://127.0.0.1:<random-port>; the proxy adds
the Bearer header and forwards to the real upstream HTTPS URL.
Loopback traffic doesn't leave the device.
This is the documented just_audio happy path — see
https://pub.dev/packages/just_audio#a-note-on-android-cleartext-traffic
— not a workaround for a plugin bug.
Adds network_security_config.xml that scopes cleartext permission to
127.0.0.1 ONLY. The base config keeps cleartextTrafficPermitted=false
so any actual remote endpoint must still be HTTPS.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two related Android setup gaps caught when running on a clean Pixel 6
emulator:
1. MainActivity extended FlutterActivity, but the audio_service
plugin requires AudioServiceActivity. AudioService.init() threw
PlatformException("The Activity class declared in your
AndroidManifest.xml is wrong"), and the partial-engine-reinit that
followed cascaded into a flutter_cache_manager SQLite EXCLUSIVE
lock crash. Both errors clear with the correct base class.
2. The main manifest was missing two production permissions:
- POST_NOTIFICATIONS — Android 13+ runtime requirement for the
media notification (now-playing tile in the system tray).
audio_service auto-prompts at init() time once declared.
- ACCESS_NETWORK_STATE — used by ConnectionErrorBanner +
flutter_cache_manager for connectivity awareness.
Note for future contributors: src/main/AndroidManifest.xml IS the
production manifest. The src/debug and src/profile variants only add
dev-only entries (e.g. INTERNET re-declared in debug for hot-reload).
There is no separate "release" manifest in Flutter's convention.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
audio_service runs the handler in a background isolate; UI watches
playbackState/mediaItem/queue streams through Riverpod. AndroidManifest
gets the foreground-service media-playback permission; Info.plist gets
UIBackgroundModes=audio. Bearer token attached to stream URLs via
just_audio's per-source headers.
iOS + Android targets only; desktop disabled (per spec, Tauri-wrapped
SvelteKit handles desktop in v1.1). Riverpod + dio + just_audio +
audio_service + go_router pinned in pubspec. Smoke test confirms the
ProviderScope wiring boots a Material app.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
bvandeusen