QLPreviewView can not show the quicklook preview in sandbox

I use QLPreviewView to show the quicklook preview in the app. Without sandbox, this works well, but once change the app to sandbox, the preview can not show up.

I found the error in Console: QuickLookUIHelpe(20786) deny file-read-data XXX.

I have used the security-scoped bookmarks & com.apple.security.files.user-selected.read-write to grant access the user home dir, then:

[allowedURL startAccessingSecurityScopedResource];
self.myPreiviewItem.myURL = fileURL;
self.myQLPreviewView.previewItem = self.myPreiviewItem;
[self.myQLPreviewView refreshPreviewItem];
[allowedURL stopAccessingSecurityScopedResource];

with these, I can delete files of user home dir, but the QLPreviewView can not work. I do not know what is the difference between these 2 scenes, does QLPreviewView need more for sandbox?

If I add com.apple.security.files.downloads.read-only into the entitlement, the files in "Downloads" can be previewed, but other files of user home dir can not be previewed.

Finally I have found the solution!

refreshPreviewItem is an async call, so before Mac finishes loading the preview, the following api stopAccessingSecurityScopedResource immediately shutdown the access, as a result, Mac failed to load the preview successfully.

so the solution is: do NOT call stopAccessingSecurityScopedResource here, keep the allowedURL's access right until you do not need the QL preview function, and then call stopAccessingSecurityScopedResource there, such as when closing the window.

I encountered this, or at least a similar, issue a while back (in Mavericks).

This is why I started asking users for access to parent folders of files they wish to Quick Look. Feel free to look at how I do it in this app of mine, version 1.1 at the time of this writing. Just go into Chikoo → Preferences… → Folder Access. Here are two screenshots: