Security hardening, multi-site portability, and a documentation and API-surface sweep

plugins/printedparts/api/routes.py

@@ -236,8 +236,7 @@ def upload_item_image(item_id: int):
 @printedparts_bp.route('/image/<path:filename>', methods=['GET'])
 def serve_item_image(filename):
     """Serve an uploaded item image (public - kiosk and list read it)."""
-    from flask import send_from_directory
-    return send_from_directory(_imagedir(), filename)
+    return send_upload(_imagedir(), filename)
 
 
 @printedparts_bp.route('/items/<int:item_id>/image', methods=['DELETE'])
@@ -643,6 +642,7 @@ def report_by_person():
 # --- print files: append-only revisions per item ------------------------------
 
 from flask_jwt_extended import get_jwt_identity
+from shopdb.api import send_upload
 
 from ..models import PrintedItemFile
 
@@ -737,12 +737,11 @@ def upload_item_file(item_id: int):
 @jwt_required(optional=True)
 def download_item_file(file_id: int):
     """Download a revision under its original filename."""
-    from flask import send_from_directory
     record = db.session.get(PrintedItemFile, file_id)
     if not record:
         return error_response(ErrorCodes.NOT_FOUND, 'File not found',
                               http_code=404)
-    return send_from_directory(_filedir(), record.storedfilename,
+    return send_upload(_filedir(), record.storedfilename,
                                as_attachment=True,
                                download_name=record.filename)