code: private void checkIfArtifactIsAssignedToTarget(final DmfTenantSecurityToken secruityToken, final String sha1Hash) {
  
          if (secruityToken.getControllerId() != null) {
              checkByControllerId(sha1Hash, secruityToken.getControllerId());
          } else if (secruityToken.getTargetId() != null) {
              checkByTargetId(sha1Hash, secruityToken.getTargetId());
          } else {
              LOG.info("anonymous download no authentication check for artifact {}", sha1Hash);
          }
  
      }
docs: check action for this download purposes, the method will throw an
  EntityNotFoundException in case the controller is not allowed to download
  this file because it's not assigned to an action and not assigned to this
  controller. Otherwise no controllerId is set = anonymous download
  
  @param secruityToken
  the security token which holds the target ID to check on
  @param sha1Hash
  of the artifact to verify if the given target is allowed to
  download it