Security hardening, multi-site portability, and a documentation and API-surface sweep

plugins/warranty/api/routes.py

@@ -9,11 +9,12 @@ import glob
 import os
 from datetime import date, datetime, timedelta, timezone
 
-from flask import Blueprint, request, current_app, send_from_directory
+from flask import Blueprint, request, current_app
 from flask_jwt_extended import jwt_required
 from sqlalchemy.orm import joinedload
 from werkzeug.utils import secure_filename
 
+from shopdb.api import send_upload
 from shopdb.api import (
     db, Asset,
     success_response, error_response, ErrorCodes,
@@ -559,7 +560,7 @@ def serve_proof(filename):
         Warranty.proofurl == f'{PROOF_URL_PREFIX}{filename}').first()
     downloadname = (warranty.prooffilename if warranty and warranty.prooffilename
                     else filename)
-    return send_from_directory(_proof_dir(), filename, as_attachment=True,
+    return send_upload(_proof_dir(), filename, as_attachment=True,
                                download_name=downloadname)