async fn download(
__arg0: State<Arc<AppState>>,
__arg1: Path<(String, String, String)>,
headers: HeaderMap,
) -> Result<Response, AppError>Expand description
The status never reveals what a protected directory holds: an impossible key is 404, a protected directory without a live key is 401 whether or not the package exists, and a missing grant answers the same 404 as a missing package. Public packages never touch the auth database, so a database outage cannot take the free catalogue down.