If you've ever wondered how apps manage to rummage through your folders without the operating system throwing up a security alert every two seconds, the answer lies in storage access frameworks. Basically, it's about putting a intelligent intermediary between the application and your private data so that no one messes around where they shouldn't without your explicit permission.
In this sense, there are different approaches depending on whether we're talking about an Android app, a modern website, or a program developed in .NET. What they all have in common is that they seek balancing functionality with privacy protection, preventing the software from having total and uncontrolled access to the device's hard drive.
The SAF ecosystem on Android
Since the arrival of Android 4.4, the Storage Access Framework (SAF) has become the standard for managing documents. The goal is for users to be able to navigate their files easily. standard and simpleregardless of whether the file is in internal memory, on an SD card, or in the cloud like Google Drive.
For this to work, the SAF relies on three fundamental pillars: Document provider, which is the one that exposes the files (as a subclass of DocumentsProvider); the Client appwhich is the one that requests the file through actions such as ACTION_OPEN_DOCUMENT; and the Selector, which is that system interface where we, as users, choose which file we want to open.
A key point is that the SAF organizes everything as a traditional file hierarchyEach provider reports unique roots and each document has an ID that does not change, allowing the application to maintain a persistent access In the long term, if the user allows it. This is vital for apps that need to constantly edit and save changes without prompting each time, similar to how apps work. apps for managing files and folders on Android.
Technical challenges and the transition to modern APIs
It's not all smooth sailing. Some developers have had quite a scare migrating to Android API 30. The problem arises because the SAF returns a URI (a link) and not a Java.IO.File object. This implies a headache When using external libraries, such as Mapsforge, which need the physical file path to process large data (such as 2GB maps) without having to copy all the content and fill the memory of the device, a common problem that leads to Clean Android memory without deleting files.
The File System Access API Revolution on the Web
On the other hand, web applications have taken a giant leap forward. Now there's the File System Access API, which allows an IDE or a photo editor in the browser to read and save changes. directly on the local diskThis is no longer a simple file download, but a real interaction with the user's file system.
To achieve this, methods such as showOpenFilePicker() to read and showSaveFilePicker() to save. The most important thing here is that these actions must stem from a user gesture (like a click) and run in a secure context (HTTPS). If the developer wants to ensure the user doesn't get lost, they can suggest a default filename or start the search in folders known as 'downloads' or 'pictures'.
Furthermore, this API allows managing entire directories through showDirectoryPicker()allowing you to list files, create new folders, or even delete items recursively. To optimize performance, especially in WebWorkers, synchronous access handlers can be used, which make reading and writing faster. much faster.
Security and permissions in the .NET Framework environment
Switching gears to .NET, access control is handled by the class FileIOPermissionHere things change because there are the partial trust environments, such as areas of the Internet, where by default access to files is not allowed to prevent malicious programs from stealing private data.
When a .NET app does not have full permissions, the solution is to ask the user to specify the file using OpenFileDialog o SaveFileDialogIn this way, user interaction validate access and the application can only read or write to that specific stream, hiding the actual file path to add an extra layer of security.
If the application needs to save settings without disturbing the user, the following comes into play: isolated storage (Isolated Storage). It's like a watertight compartment where the app can store its data without needing FileIO permissions, since the system allocates it its own space and separated from the rest of the system, similar to the functionality of hide sensitive files with secure folders.
Permissions and persistence management
Both on the web and on Android, permission management is dynamic. On the web, for example, even if you've saved a file, the permission might be lost when you reload the page. That's why it's essential to use queryPermission() to check the status and requestPermission() to order it again if necessary.
To improve the experience, many developers store file identifiers in indexedDBThus, the application can remember the last edited documents and offer quick access, as long as the user reauthorize access upon logging in. Share the information so that other users know about the topic.