Do we need to re-select the node here? Can't we alter the node parameter directly?

Why can't we use dir_info['checksums']['sha1'] anymore?

This name and route are too generic. I suggest to use something like _directory_resolve_content_path and directory/resolve/content-path. Or _directory_content_path_to_hash/_directory_path_to_content_hash

Yes, this is needed as the node passed as parameter is not the one that ends up inserted in the DOM.

I supposed this is how DOMPurify works or it might be related that we are making an asynchronous call
to fetch here.

Well seen, will update accordingly

I would go for directory/resolve/content-path/ and _directory_path_to_content_hash.

I think also adding the content checksums to the returned JSON result would better honored
that renaming.

JSONPurify's example does change the given node: https://github.com/cure53/DOMPurify/blob/master/demos/hooks-mentaljs-demo.html#L56

Note that you need to return it.

and I think you can drop the new endpoint.

Considering the only external data loaded are image bytes (all sensible stuffs like scripts are removed by DOMPurify) , I do not know if we want to bother the users to explicitly authorize their loading. They will likely end up to always authorize the images loading as some README rendering will look really sad without them.

Nevertheless, I can start documenting myself on how to implement that.

In fact, I have retested and this piece of code is not needed after all.
Whether there is a leading slash or not, if the image is stored in the archive,
it will be found in both cases. So I will remove it.

I will give it a try again but I am worried about the asynchronous call to fetch.

Ack

I prefer to keep the new endpoint and let this one returns a 404 error when providing a path pointing to a file (as only directories and sub-ones should be handled by that endpoint).