android-notifications-pushlisted

# Android Notifications and Push (FCM) ## Core Principles - Create notification channels once at app startup, never lazily on first use. - Every notification must belong to a channel — the system ignores notifications without one on API 26+. - Request POST_NOTIFICATIONS permission before showing any notification on Android 13+ (API 33+). - Keep FirebaseMessagingService thin: parse the message payload, delegate to a use case or repository. - Data-only FCM messages always arrive in onMessageReceived; notification messages only arrive there when the app is in the foreground. - Deep-link destinations on tap must be validated exactly as external deep links — they are untrusted input. --- ## Project Setup ### Gradle dependencies ```kotlin // build.gradle.kts (app module) dependencies { implementation(platform("com.google.firebase:firebase-bom:33.1.0")) implementation("com.google.firebase:firebase-messaging-ktx") implementation("androidx.core:core-ktx:1.13.1") // NotificationCompat implementation("androidx.navigation:navigation-compose:2.7.7") } ``` Add `google-services.json` to the `app/` directory and apply the plugin: ```kotlin // app/build.gradle.kts plugins { id("com.google.gms.google-services") } ``` ```kotlin // root build.gradle.kts plugins { id("com.google.gms.google-services") version "4.4.2" apply false } ``` --- ## Notification Channels Create channels once in `Application.onCreate()` — creating an existing channel is a no-op