Content
Provider_

<!-- Provider registration: claims the authority system-wide -->
<provider
    android:name=".MyContentProvider"
    android:authorities="com.example.myapp.provider"
    android:exported="true"
    android:readPermission="com.example.READ_DATA"
    android:writePermission="com.example.WRITE_DATA"
    android:grantUriPermissions="true" />

class MyContentProvider : ContentProvider() {

    companion object {
        private const val ITEMS       = 1   // content://authority/items
        private const val ITEM_BY_ID  = 2   // content://authority/items/42

        private val uriMatcher = UriMatcher(UriMatcher.NO_MATCH).apply {
            addURI("com.example.provider", "items",    ITEMS)
            addURI("com.example.provider", "items/#",  ITEM_BY_ID) // # = number wildcard
        }
    }

    // Called on first access — NOT on app start. Lazy initialization.
    override fun onCreate(): Boolean {
        db = MyDatabaseHelper(context).writableDatabase
        return true
    }

    override fun query(
        uri: Uri, projection: Array<String>?, selection: String?,
        selectionArgs: Array<String>?, sortOrder: String?
    ): Cursor? {
        val table = when (uriMatcher.match(uri)) {
            ITEMS      -> "items"
            ITEM_BY_ID -> "items"  // + WHERE _id = ${uri.lastPathSegment}
            else       -> throw IllegalArgumentException("Unknown URI: $uri")
        }
        val cursor = db.query(table, projection, selection, selectionArgs, null, null, sortOrder)
        cursor.setNotificationUri(context!!.contentResolver, uri) // enable change notifications
        return cursor
    }

    override fun insert(uri: Uri, values: ContentValues?): Uri? { ... }
    override fun update(uri: Uri, values: ContentValues?, ...): Int { ... }
    override fun delete(uri: Uri, selection: String?, ...): Int { ... }

    // Returns MIME type — important for Intent resolution and type safety
    override fun getType(uri: Uri): String = when (uriMatcher.match(uri)) {
        ITEMS      -> "vnd.android.cursor.dir/vnd.com.example.item"
        ITEM_BY_ID -> "vnd.android.cursor.item/vnd.com.example.item"
        else       -> throw IllegalArgumentException("Unknown URI")
    }
}

override fun query(uri: Uri, ...): Cursor? {
    // Binder driver guarantees this UID — callers cannot forge it
    val callingUid = Binder.getCallingUid()
    val callingPkg = context!!.packageManager
        .getNameForUid(callingUid) ?: throw SecurityException("Unknown caller")

    // Optional: allowlist specific packages for sensitive paths
    if (uri.path?.startsWith("/sensitive") == true) {
        check(callingPkg in TRUSTED_PACKAGES) {
            "Access denied for: $callingPkg"
        }
    }
    // ... rest of query
}

// In the PROVIDER: signal that data has changed
override fun insert(uri: Uri, values: ContentValues?): Uri? {
    val id = db.insert("items", null, values)
    val newUri = ContentUris.withAppendedId(CONTENT_URI, id)
    // Notify ALL registered observers for this URI
    context!!.contentResolver.notifyChange(newUri, null)
    return newUri
}

// In the CLIENT: register an observer
val observer = object : ContentObserver(Handler(mainLooper)) {
    override fun onChange(selfChange: Boolean, uri: Uri?) {
        // Fired on main thread when provider data changes
        viewModel.refresh()
    }
}
contentResolver.registerContentObserver(
    MY_CONTENT_URI, /* notifyForDescendants= */ true, observer
)

// Always unregister to avoid leaks
override fun onDestroy() {
    contentResolver.unregisterContentObserver(observer)
    super.onDestroy()
}