How to check if user selected file(s) my Sandboxed app has permission to write?

Question

I'm enabling sandboxing in my OS X app to resubmit to the app store and I'm trying to find the most elegant way to make sure the user can only select resources my app has permissions to change.

Stripped down scenario:

1. user selects a picture on the file system via an NSOpenPanel
2. user clicks the Process Picture button on the app
3. app retrieves information from the internet
4. app alters the picture's metadata.

After the user is done selecting the pictures, I want to make sure each one is located under the Pictures folder otherwise my write to the physical file will simply silently fail.

Apple recommends the following to determine the Pictures folder's location:

The Pictures directory contains the user’s images and photos. To get the path to this directory use the NSPicturesDirectory search path key with the NSUserDomainMask domain.

Implementing the above gives me a path that looks like this: /Users/thomas/Library/Containers/com.blazingfrog.latipics/Data/Pictures/picture1.jpg

But when I want to see what pictures the user selected,[myOpenPanel URLs] returns /Users/thomas/Pictures/picture1.jpg

These two paths are logically identical but look very different. How can I compare them in way that works every time?

In case it helps, to prepare my app for sandboxing I did the following

• enabled Entitlements in XCode
• enabled App Sandboxing
• enabled File System (Read)
• enabled allowing Incoming/Outgoing Network Connections
• enabled Pictures Folder access (Read/Write)

Answer 1

1. You should almost never fail silently. If something goes wrong, report it to the user, as best you can. This is exactly what NSError is designed for.

2. You should almost never attempt to figure out if an operation will succeed before trying it. Doing so leaves you open to race conditions. Instead go ahead and try the operation; if it fails, handle that gracefully.

3. It sounds like you actually want the com.apple.security.files.user-selected.read-write entitlement. This will give you write access to any files the user selects using an open panel.