Security hardening, multi-site portability, and a documentation and API-surface sweep

plugins/employees/api/routes.py

@@ -13,7 +13,7 @@ import io
 import logging
 import os
 
-from flask import Blueprint, request, current_app, send_from_directory
+from flask import Blueprint, request, current_app
 from flask_jwt_extended import jwt_required
 from werkzeug.utils import secure_filename
 
@@ -26,6 +26,7 @@ from shopdb.api import (
     require_role,
 )
 from shopdb.api import Setting
+from shopdb.api import send_upload
 
 from ..models import DirectoryEmployee
 
@@ -612,7 +613,7 @@ def upload_employee_photo(sso):
 @employees_bp.route('/photo/<path:filename>', methods=['GET'])
 def serve_employee_photo(filename):
     """Serve an uploaded employee photo (public - kiosk cards read it)."""
-    return send_from_directory(_employeephoto_dir(), filename)
+    return send_upload(_employeephoto_dir(), filename)
 
 
 @employees_bp.route('/<int:sso>/photo', methods=['DELETE'])