temp+fix: Android In-App Browser Crash (#22212)

<!--
Please submit this PR as a draft initially.
Do not mark it as "Ready for review" until the template has been
completely filled out, and PR status checks have passed at least once.
-->

## **Description**
The app crashes on Android when users grant **camera + microphone**
permissions through the in-app browser (e.g., visiting
https://permission.site/).

Root Cause:
The WebView permission handling code had a fundamental architectural
flaw when multiple permissions (camera + microphone) were requested
simultaneously:
Old behavior: Showed separate dialogs for each permission (one for
camera, one for microphone)
Each dialog's "Allow" button independently called request.grant()
Android's WebView API only allows calling grant() or deny() once per
permission request
When the user clicked "Allow" on the second dialog → CRASH: "Either
grant() or deny() has been already called"

Solution: 
Rewrote the permission handling logic in RNCWebChromeClient.java:
Changed permission handling to show ONE dialog for all permissions:
- "Allow example.com to use your camera and microphone?"
- Call grant() only once with all permissions together
- Added error handling to prevent crashes in edge cases

Android build for this PR:
https://app.bitrise.io/build/560c02e8-611e-4bfd-a24c-34e69751c86b?tab=artifacts

PR to browser:
MetaMask/react-native-webview-mm#72

## **Changelog**

<!--
If this PR is not End-User-Facing and should not show up in the
CHANGELOG, you can choose to either:
1. Write `CHANGELOG entry: null`
2. Label with `no-changelog`

If this PR is End-User-Facing, please write a short User-Facing
description in the past tense like:
`CHANGELOG entry: Added a new tab for users to see their NFTs`
`CHANGELOG entry: Fixed a bug that was causing some NFTs to flicker`

(This helps the Release Engineer do their job more quickly and
accurately)
-->

CHANGELOG entry:null

## **Related issues**

Fixes: #22162 

## **Manual testing steps**

```gherkin
Feature: Fix Android double permission bug on webview

  Scenario: App does not crash when user grant/deny camera + microphone permission
    Given user navigates to website https://permission.site in website

    When user select Camera + Microphone 
    Then user is able give/deny permission to Camera and Microphone without app crashing
```

## **Screenshots/Recordings**

<!-- If applicable, add screenshots and/or recordings to visualize the
before and after of your change. -->

### **Before**
Android Before 
![Android
Before](https://github.com/user-attachments/assets/8e4ab52e-9464-47b6-90d5-2edc5fbfca2a)

### **After**
Android After
![Android
After](https://github.com/user-attachments/assets/f0b28c3a-24cb-447e-bcff-585104109d47)


<!-- [screenshots/recordings] -->

## **Pre-merge author checklist**

- [x] I’ve followed [MetaMask Contributor
Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile
Coding
Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md).
- [x] I've completed the PR template to the best of my ability
- [x] I’ve included tests if applicable
- [x] I’ve documented my code using [JSDoc](https://jsdoc.app/) format
if applicable
- [x] I’ve applied the right labels on the PR (see [labeling
guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)).
Not required for external contributors.

## **Pre-merge reviewer checklist**

- [x] I've manually tested the PR (e.g. pull and build branch, run the
app, test code being changed).
- [x] I confirm that this PR addresses all acceptance criteria described
in the ticket it closes and includes the necessary testing evidence such
as recordings and or screenshots.


<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Consolidates Android WebView permission flow into a single dialog with
a single grant call for multiple resources, adds error handling, and
delivers via a Yarn patch of @metamask/react-native-webview.
> 
> - **Android WebView (`RNCWebChromeClient.java`)**:
> - Show a single confirmation dialog for multiple already-OS-granted
permissions with a combined message.
> - Aggregate requested resources and call `request.grant()` once; map
`CAMERA` → `RESOURCE_VIDEO_CAPTURE`, `RECORD_AUDIO` →
`RESOURCE_AUDIO_CAPTURE`, handle `RESOURCE_PROTECTED_MEDIA_ID`.
> - Reset state before handling requests; manage
`permissionRequest`/`grantedPermissions` lifecycle; only set
`permissionRequest` when system permissions must be requested.
> - Wrap `grant()` with `try/catch` to ignore `IllegalStateException`
and prevent duplicate grant/deny errors.
> - Minor UX: delay enabling the "Allow" button to avoid accidental
taps.
> - **Dependencies**:
> - Use Yarn patch for `@metamask/react-native-webview@14.5.0` via
`.yarn/patches/...`; update `package.json` and `yarn.lock`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
7396b7f. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: metamaskbot <metamaskbot@users.noreply.github.com>

Author: runway-github[bot]

.cursor/rules/BUGBOT.md

@@ -32,7 +32,7 @@ ComponentName/
 
 **Core**: `/docs/readme/` (architecture, testing, debugging, performance, environment, expo-environment, storybook, troubleshooting, expo-e2e-testing, reassure, release-build-profiler)
 
-**Features**: `/docs/` (deeplinks, animations, tailwind, confirmations, confirmation-refactoring) • `app/component-library/README.md` • `e2e/MOCKING.md` • `CHANGELOG.md` • `app/core/{Analytics,Engine}/README.md`
+**Features**: `/docs/` (deeplinks, animations, tailwind, confirmations, confirmation-refactoring) • `app/component-library/README.md` • `e2e/MOCKING.md` • `CHANGELOG.md` • `app/core/{Analytics,Engine}/README.md` • `ppom/README.md`
 
 **External**: [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) • [TypeScript Guidelines](https://github.com/MetaMask/contributor-docs/blob/main/docs/typescript.md) • [Unit Testing](https://github.com/MetaMask/contributor-docs/blob/main/docs/testing/unit-testing.md)
 
@@ -44,4 +44,4 @@ ComponentName/
 
 **Testing**: see .claude/commands/unit-test.md
 
-**Forbidden**: ❌ npm/npx commands
+**Forbidden**: ❌ npm/npx commands

.cursor/rules/general-coding-guidelines.mdc

@@ -185,92 +185,6 @@ jest.setSystemTime(new Date('2024-01-01'));
 
 - Avoid relying on global state or hardcoded values (e.g., dates) or mock it.
 
-## Async Testing and act() - CRITICAL
-
-**ALWAYS use `act()` when testing async operations that trigger React state updates.**
-
-### When to Use act()
-
-Use `act()` when you:
-- Call async functions via component props (e.g., `onRefresh`, `onPress` with async handlers)
-- Invoke functions that perform state updates asynchronously
-- Test pull-to-refresh or other async interactions
-
-### Symptoms of Missing act()
-
-Tests fail intermittently with:
-- `TypeError: terminated`
-- `SocketError: other side closed`
-- Warnings about state updates not being wrapped in act()
-
-### Examples
-
-```ts
-// ❌ WRONG - Causes flaky tests
-it('calls Logger.error when handleOnRefresh fails', async () => {
-  const mockLoggerError = jest.spyOn(Logger, 'error');
-  render(BankDetails);
-
-  // Async function called without act() - causes race condition
-  screen
-    .getByTestId('refresh-control-scrollview')
-    .props.refreshControl.props.onRefresh();
-
-  await waitFor(() => {
-    expect(mockLoggerError).toHaveBeenCalled();
-  });
-});
-
-// ✅ CORRECT - Properly handles async state updates
-it('calls Logger.error when handleOnRefresh fails', async () => {
-  const mockLoggerError = jest.spyOn(Logger, 'error');
-  render(BankDetails);
-
-  // Wrap async operation in act()
-  await act(async () => {
-    await screen
-      .getByTestId('refresh-control-scrollview')
-      .props.refreshControl.props.onRefresh();
-  });
-
-  await waitFor(() => {
-    expect(mockLoggerError).toHaveBeenCalled();
-  });
-});
-```
-
-### Common Patterns Requiring act()
-
-```ts
-// RefreshControl callbacks
-await act(async () => {
-  await refreshControl.props.onRefresh();
-});
-
-// Async button press handlers
-await act(async () => {
-  await button.props.onPress();
-});
-
-// Any async callback that updates state
-await act(async () => {
-  await component.props.onSomeAsyncAction();
-});
-```
-
-### Why This Matters
-
-Without `act()`:
-1. Async function starts executing
-2. Test continues and waits only for specific assertion
-3. Jest cleanup/termination happens while promises are still pending
-4. Results in "terminated" or "other side closed" errors
-
-With `act()`:
-1. React Testing Library waits for all state updates
-2. All promises resolve before test proceeds
-3. Clean, deterministic test execution
-
 # Reviewer Responsibilities
 
 - Validate that tests fail when the code is broken (test the test).
@@ -301,7 +215,6 @@ Before submitting any test file, verify:
 - [ ] **Assertions are specific**
 - [ ] **Test names are descriptive**
 - [ ] **No test duplication**
-- [ ] **Async operations wrapped in act()** when they trigger state updates
 
 # Common Mistakes to AVOID - CRITICAL
 
@@ -313,7 +226,6 @@ Before submitting any test file, verify:
 - ❌ **Not following AAA pattern** - Always Arrange, Act, Assert
 - ❌ **Not testing edge cases** - Test null, undefined, empty values
 - ❌ **Using weak matchers** - Use specific assertions like `toBe()`, `toEqual()`
-- ❌ **Not wrapping async state updates in act()** - Causes flaky "terminated" errors
 
 # Anti-patterns to Avoid
 

.cursor/rules/unit-testing-guidelines.mdc

@@ -22,8 +22,6 @@ ignores:
   - 'reflect-metadata'
   # Husky is used for pre-commit hooks
   - 'husky'
-  # Auto changelog tooling used in release scripts
-  - '@metamask/auto-changelog'
   # Remove this once it's used in the project
   - 'rive-react-native'
   # Appwright will be used in a follow up PR. We will remove once PR is ready
@@ -70,7 +68,6 @@ ignores:
   - 'prettier-plugin-gherkin'
   - 'react-native-svg-asset-plugin'
   - 'regenerator-runtime'
-  - 'prettier-2'
 
   ## Unused devDependencies to investigate
   - '@metamask/swappable-obj-proxy'

.depcheckrc.yml

@@ -65,12 +65,8 @@ module.exports = {
     },
     'ios.sim.main.ci': {
       device: 'ios.simulator',
-      app: 'ios.main.release',
-    },
-    'ios.sim.flask.ci': {
-      device: 'ios.simulator',
-      app: 'ios.flask.release',
-    },
+      app: 'ios.debug',
+    }
   },
   devices: {
     'ios.simulator': {
@@ -114,44 +110,42 @@ module.exports = {
     'ios.main.release': {
       type: 'ios.app',
       binaryPath:
-        process.env.PREBUILT_IOS_APP_PATH || 'ios/build/Build/Products/Release-iphonesimulator/MetaMask.app',
-      build: `export CONFIGURATION="Release" && yarn build:ios:main:e2e`,
+        'ios/build/Build/Products/Release-iphonesimulator/MetaMask.app',
+      build: `yarn build:ios:main:e2e`,
     },
     'ios.flask.debug': {
       type: 'ios.app',
       binaryPath:
-        process.env.PREBUILT_IOS_APP_PATH || 'ios/build/Build/Products/Debug-iphonesimulator/MetaMask-Flask.app',
-        build: 'export CONFIGURATION="Debug" && yarn build:ios:flask:e2e',
+        'ios/build/Build/Products/Debug-iphonesimulator/MetaMask-Flask.app',
+      build: 'yarn start:ios:e2e:flask',
     },
     'ios.flask.release': {
       type: 'ios.app',
       binaryPath:
-        process.env.PREBUILT_IOS_APP_PATH || 'ios/build/Build/Products/Release-iphonesimulator/MetaMask-Flask.app',
-      build: `export CONFIGURATION="Release" && yarn build:ios:flask:e2e`,
+        'ios/build/Build/Products/Release-iphonesimulator/MetaMask-Flask.app',
+      build: `yarn build:ios:flask:e2e`,
     },
     'android.debug': {
       type: 'android.apk',
       binaryPath: process.env.PREBUILT_ANDROID_APK_PATH || 'android/app/build/outputs/apk/prod/debug/app-prod-debug.apk',
       testBinaryPath: process.env.PREBUILT_ANDROID_TEST_APK_PATH,
-      build: 'export CONFIGURATION="Debug" && yarn build:android:main:e2e',
+      build: 'yarn start:android:e2e',
     },
-    'android.release': {
+    'android.flask.debug': {
       type: 'android.apk',
-      binaryPath: process.env.PREBUILT_ANDROID_APK_PATH || 'android/app/build/outputs/apk/prod/release/app-prod-release.apk',
-      testBinaryPath: process.env.PREBUILT_ANDROID_TEST_APK_PATH,
-      build: `export CONFIGURATION="Release" && yarn build:android:main:e2e`,
+      binaryPath: 'android/app/build/outputs/apk/flask/debug/app-flask-debug.apk',
+      testBinaryPath: 'android/app/build/outputs/apk/androidTest/flask/debug/app-flask-debug-androidTest.apk',
+      build: 'yarn start:android:e2e:flask',
     },
-    'android.flask.debug': {
+    'android.release': {
       type: 'android.apk',
-      binaryPath: process.env.PREBUILT_ANDROID_APK_PATH || 'android/app/build/outputs/apk/flask/debug/app-flask-debug.apk',
-      testBinaryPath: process.env.PREBUILT_ANDROID_TEST_APK_PATH,
-      build: 'export CONFIGURATION="Debug" && yarn build:android:flask:e2e',
+      binaryPath: 'android/app/build/outputs/apk/prod/release/app-prod-release.apk',
+      build: `yarn build:android:main:e2e`,
     },
     'android.flask.release': {
       type: 'android.apk',
-      binaryPath: process.env.PREBUILT_ANDROID_APK_PATH || 'android/app/build/outputs/apk/flask/release/app-flask-release.apk',
-      testBinaryPath: process.env.PREBUILT_ANDROID_TEST_APK_PATH,
-      build: `export CONFIGURATION="Release" && yarn build:android:flask:e2e`,
+      binaryPath: 'android/app/build/outputs/apk/flask/release/app-flask-release.apk',
+      build: `yarn build:android:flask:e2e`,
     },
   },
 };