download completed ttl

app/controllers/submissions_download_controller.rb

@@ -4,8 +4,10 @@ class SubmissionsDownloadController < ApplicationController
   skip_before_action :authenticate_user!
   skip_authorization_check
 
+  TTL = 20.minutes
+
   def index
-    submitter = Submitter.find_by(slug: params[:submitter_slug])
+    submitter = Submitter.find_by!(slug: params[:submitter_slug])
 
     Submissions::EnsureResultGenerated.call(submitter)
 
@@ -13,6 +15,15 @@ class SubmissionsDownloadController < ApplicationController
 
     Submissions::EnsureResultGenerated.call(last_submitter)
 
+    return head :not_found unless last_submitter.completed_at?
+
+    if last_submitter.completed_at < TTL.ago &&
+       (current_user.nil? || !current_user.account.submitters.exists?(id: last_submitter.id))
+      Rollbar.info("TTL: #{last_submitter.id}") if defined?(Rollbar)
+
+      return head :not_found
+    end
+
     urls =
       Submitters.select_attachments_for_download(last_submitter).map do |attachment|
         ActiveStorage::Blob.proxy_url(attachment.blob)