Hongmeng File Access Framework: User file access and permission control📂

Hongmeng Next's File Access Framework (File Access Framework, FAF) provides applications with secure and controllable user file access capabilities.This article analyzes its core functions, permission configuration and practical usage~

1. FAF core: a safe and convenient file access bridge 🔗

FAF is a user file management framework provided by Hongmeng. It is implemented based on ExtensionAbility and has three major features:

• Security Isolation: Limit file access scope through permission control
• Unified Interface: Standardized file selection/save/management process
• Span-device support: Compatible with multi-terminal file systems (mobile phone/tablet/car machine)

2. Permission configuration: "key" to access user files🔑

1. Declare file operation permissions (module.json5)

{  
  "abilities": [  
    {  
      "skills": [  
        {  
"actions": ["ohos.arkui.intent.action.CHOOSE"], // File selection
          "uris": [{ "scheme": "file", "host": "*", "path": "/storage/*" }]  
        },  
        {  
"actions": ["ohos.arkui.intent.action.SAVE"], // File saving
          "uris": [{ "scheme": "file", "host": "*", "path": "/storage/*" }]  
        }  
      ]  
    }  
  ]  
}  

2. Runtime authorization mechanism

• When the user triggers file selection/save, the system pops up the authorization pop-up window
• Applications can only access the file path authorized by the user, prohibiting over-authorization operations

3. Core interface and practical examples🚀

1. File selection (taking picture as an example)

import { fileAccess, wantAgent } from '@ohos.fileAccess';  

// Call the system file selector
const chooseFile = () => {  
  const intent = {  
    action: 'ohos.arkui.intent.action.CHOOSE',  
type: 'image/*', // Limited selection of image types
    entities: ['image/*']  
  };  
  const want = wantAgent.createWant(intent);  
  this.context.startAbility(want, (result) => {  
    if (result && want.response.result) {  
      const fileUri = want.response.result;  
// Get file information (such as size/type)
      fileAccess.getFileInfo(fileUri, (err, info) => {  
console.log('Select image:', info.fileName);
      });  
    }  
  });  
};  

2. File saving (text file example)

const saveTextFile = () => {  
  const saveIntent = {  
    action: 'ohos.arkui.intent.action.SAVE',  
type: 'text/plain', // Specify the save type as plain text
extra: { fileName: 'note.txt' } // Preset file name
  };  
  const saveWant = wantAgent.createWant(saveIntent);  
  this.context.startAbility(saveWant, (result) => {  
    if (result) {  
      const saveUri = want.response.result;  
// Write file contents
fileAccess.saveFile(saveUri, 'Hongmeng Development Notes', (err) => {
if (!err) console.log('Save successfully');
      });  
    }  
  });  
};  

3. File management operations

// Create a directory
fileAccess.createDir('/storage/emulated/0/app/newFolder', (err) => {  
if (!err) console.log('Directory creation successfully');
});  

// Delete the file
fileAccess.deleteFile('/storage/emulated/0/app/temp.log', (err) => {  
if (!err) console.log('File deletion successfully');
});  

4. Security design: the "protective wall" of user data 🛡️

1. Access restrictions outside the sandbox

• By default, the application can only access its own sandbox files (/data/el2/files/)
• Access to external storage (such as album/download directory) must pass through the FAF unified interface, and direct path operation is prohibited

2. Principle of Minimization

• Each file operation requires separate authorization (if you can only access the file after selecting the picture)
• Authorization is only valid for this operation and no permanent access is granted

3. Cross-device security policy

• In distributed scenarios, file access needs to be authenticated by device
• Sensitive files (such as privacy images) are prohibited from being transferred across devices

Summary: 3 steps to achieve secure file access

1. Declare permissions: Declare operation permissions such as CHOOSE/SAVE in the configuration file
2. Calling interface: Initiate file operations through the unified interface provided by FAF
3. Compliance processing: Follow the process of "User Authorization → Limited Access → Timely Release"