Security hardening, multi-site portability, and a documentation and API-surface sweep

shopdb/api/__init__.py

@@ -77,6 +77,11 @@ from shopdb.utils.apitoken_auth import (
     service_token_authorized, authorized_service_token,
 )
 
+# Serving an uploaded file safely. A plugin that serves user-supplied bytes must
+# not have to remember the headers that keep an SVG or an HTML file from running
+# as script in this origin - see shopdb/utils/uploads.py.
+from shopdb.utils.uploads import send_upload, harden_upload_response
+
 # Import-mode helpers: preserve legacy timestamps during a bulk data import
 from shopdb.utils.import_mode import (
     apply_import_timestamps,
@@ -283,6 +288,9 @@ __all__ = [
     'service_token_authorized',
     'authorized_service_token',
     'SupportTeam',
+    # Serving uploads
+    'send_upload',
+    'harden_upload_response',
     # Import-mode helpers
     'apply_import_timestamps',
     'import_mode_active',