Function package_actor 

pub async fn package_actor(
    pool: &PgPool,
    actor: &Actor,
    root_project: Option<Uuid>,
) -> AppResult<Actor>

For downloads of a whole structure: the root item’s group must allow packages (403, the actor reads it anyway), and the returned actor does not see the items of groups that do not, so they are left out like restricted items of non-members.