The timeline's Download: a form post of file ids, answered with a ZIP of the originals as they
are read. A host mounts it in a pipeline with the session, CSRF protection and the current
scope, and tells the timeline where (download_path):
post "/photos/download", PhoenixKitPhotos.Web.Download, []Every id is checked for the person asking (Bulk.plan/4, :download). Someone who may not
read a file gets it left out, not told it exists. Visitors of a public library may download
from it too, up to 200 files at a time and 10 times an hour for an address: if they may
see a photo they may have it, but a site's bandwidth is not theirs to use up.
A visitor is anyone the site does not admit as signed in (Libraries.authenticated_reader?/1:
active, email confirmed). A session alone is not that, since one is minted for an account
nobody confirmed, and an address typed into the sign-up form would otherwise lift the limits.
The status of a streamed answer is sent before the first file is read, so a file that cannot
be read later is reported inside the archive, in Not included.txt. A failure halfway through
a file ends the answer without the archive's directory: broken, and visibly so, rather than
quietly short.