I have a somewhat unique situation, and while I understand what the problem is, I'm not quite sure what the best workaround may be so I thought I would consult the hive mind. :)
Scenario:
I am working on an application (OS X) that is document based and uses Quicktime. When a new document is created, the user selects a movie to view within the document window. The user can then save this document. When the user later attempts to open the document, nothing happens. It just doesn't open.
What I know so far:
The problem is with the way Sandbox operates, and my limited experience working with it (my first attempt.) I have enabled Sandbox and have the app permissions set to allow any user initiated file operations, and also added permissions for the app to access the Movies folder.
When the user loads a document and the Movie is in the Movies folder, it opens and works correctly. However, if the Movie is anywhere else on the users drive, it does NOT work and performs as described above.
I realized this is because while the user can open the document (user initiated), sandbox is blocking the application when it attempts to then open the linked movie automatically (NOT user initiated) unless the movie is located within the Movies folder.
Since the application is designed to work with large files, it seems like a big limitation to force users to copy the files into their movie folder and leave them there.
(I have not yet tried working with a movie located on an external drive, but suspect that it would work as it's not a system drive.)
Question:
Is there a way to work around this, since the user initiated the task of opening the movie originally?
If not, is there perhaps a way to have the application ask the user to confirm that the movie should be loaded... perhaps like presenting an OPEN dialog box with the movie already selected so they can just click OK? This might be the best solution.
Another option might be to automatically copy the movie into the Movies folder when the user initially selects it, but again it's not really idea for my situation...
Any thoughts would be appreciated!
As you describe it, your App has privileges to access files within its own container and in the Movies folder. To access arbitrary movie files you have to:
Let the user initiate the access to a file, i.e. when a new document is created the user has to use a file chooser to access a movie file. The privileges of your sandbox are then extended to allow access to the selected file.
Those access rights are temporarily. To persist them over App restarts you have to save and restore the access right via security scoped bookmarks.
Refer to Apples documentation on PowerBox and on Security Scoped Bookmarks
Also Session 710 from WWDC 2013 might be helpful.