download completed ttl

app/controllers/submissions_download_controller.rb

@@ -4,8 +4,10 @@ class SubmissionsDownloadController < ApplicationController
   skip_before_action :authenticate_user!
   skip_authorization_check
 
+  TTL = 20.minutes
+
   def index
-    submitter = Submitter.find_by(slug: params[:submitter_slug])
+    submitter = Submitter.find_by!(slug: params[:submitter_slug])
 
     Submissions::EnsureResultGenerated.call(submitter)
 
@@ -13,6 +15,15 @@ class SubmissionsDownloadController < ApplicationController
 
     Submissions::EnsureResultGenerated.call(last_submitter)
 
+    return head :not_found unless last_submitter.completed_at?
+
+    if last_submitter.completed_at < TTL.ago &&
+       (current_user.nil? || !current_user.account.submitters.exists?(id: last_submitter.id))
+      Rollbar.info("TTL: #{last_submitter.id}") if defined?(Rollbar)
+
+      return head :not_found
+    end
+
     urls =
       Submitters.select_attachments_for_download(last_submitter).map do |attachment|
         ActiveStorage::Blob.proxy_url(attachment.blob)

app/controllers/submissions_preview_controller.rb

@@ -6,9 +6,21 @@ class SubmissionsPreviewController < ApplicationController
 
   PRELOAD_ALL_PAGES_AMOUNT = 200
 
+  TTL = 20.minutes
+
   def show
     @submission = Submission.find_by!(slug: params[:slug])
 
+    if !@submission.submitters.all?(&:completed_at?) && current_user.blank?
+      raise ActionController::RoutingError, 'Not Found'
+    end
+
+    unless submission_valid_ttl?(@submission)
+      Rollbar.info("TTL: #{@submission.id}") if defined?(Rollbar)
+
+      return redirect_to submissions_preview_completed_path(@submission.slug)
+    end
+
     ActiveRecord::Associations::Preloader.new(
       records: [@submission],
       associations: [:template, { template_schema_documents: :blob }]
@@ -26,4 +38,20 @@ class SubmissionsPreviewController < ApplicationController
 
     render 'submissions/show', layout: 'plain'
   end
+
+  def completed
+    @submission = Submission.find_by!(slug: params[:submissions_preview_slug])
+
+    render :completed, layout: 'plain'
+  end
+
+  private
+
+  def submission_valid_ttl?(submission)
+    return true if current_user && current_user.account.submissions.exists?(id: submission.id)
+
+    last_submitter = submission.submitters.select(&:completed_at?).max_by(&:completed_at)
+
+    last_submitter && last_submitter.completed_at > TTL.ago
+  end
 end