Security hardening, multi-site portability, and a documentation and API-surface sweep

shopdb/core/api/models.py

@@ -3,7 +3,7 @@
 import glob
 import os
 
-from flask import Blueprint, request, current_app, send_from_directory
+from flask import Blueprint, request, current_app
 from flask_jwt_extended import jwt_required
 from werkzeug.utils import secure_filename
 
@@ -19,6 +19,7 @@ from shopdb.utils.pagination import get_pagination_params, paginate_query
 
 from shopdb.utils.authz import require_role
 from shopdb.utils.import_mode import apply_import_timestamps
+from shopdb.utils.uploads import send_upload
 
 models_bp = Blueprint('models', __name__)
 
@@ -228,7 +229,7 @@ def upload_model_image(model_id: int):
 @models_bp.route('/image/<path:filename>', methods=['GET'])
 def serve_model_image(filename):
     """Serve an uploaded model image (public - asset detail pages read it)."""
-    return send_from_directory(_modelimage_dir(), filename)
+    return send_upload(_modelimage_dir(), filename)
 
 
 @models_bp.route('/<int:model_id>/image', methods=['DELETE'])