lfsapi: respect ssh response ExpiresAt in the ssh cache

lfsapi/ssh.go

@@ -7,6 +7,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/git-lfs/git-lfs/tools"
 	"github.com/rubyist/tracerx"
@@ -34,7 +35,7 @@ func (c *sshCache) Resolve(e Endpoint, method string) (sshAuthResponse, error) {
 	}
 
 	key := strings.Join([]string{e.SshUserAndHost, e.SshPort, e.SshPath, method}, "//")
-	if res, ok := c.endpoints[key]; ok {
+	if res, ok := c.endpoints[key]; ok && (res.ExpiresAt.IsZero() || res.ExpiresAt.After(time.Now().Add(5*time.Second))) {
 		tracerx.Printf("ssh cache: %s git-lfs-authenticate %s %s",
 			e.SshUserAndHost, e.SshPath, endpointOperation(e, method))
 		return *res, nil
@@ -51,7 +52,7 @@ type sshAuthResponse struct {
 	Message   string            `json:"-"`
 	Href      string            `json:"href"`
 	Header    map[string]string `json:"header"`
-	ExpiresAt string            `json:"expires_at"`
+	ExpiresAt time.Time         `json:"expires_at"`
 }
 
 type sshAuthClient struct {

lfsapi/ssh_test.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -15,6 +16,7 @@ func TestSSHCacheResolveFromCache(t *testing.T) {
 	cache.endpoints["userandhost//1//path//post"] = &sshAuthResponse{
 		Href: "cache",
 	}
+	ssh.responses["userandhost"] = sshAuthResponse{Href: "real"}
 
 	e := Endpoint{
 		SshUserAndHost: "userandhost",
@@ -27,6 +29,46 @@ func TestSSHCacheResolveFromCache(t *testing.T) {
 	assert.Equal(t, "cache", res.Href)
 }
 
+func TestSSHCacheResolveFromCacheWithFutureExpiresAt(t *testing.T) {
+	ssh := newFakeResolver()
+	cache := withSSHCache(ssh).(*sshCache)
+	cache.endpoints["userandhost//1//path//post"] = &sshAuthResponse{
+		Href:      "cache",
+		ExpiresAt: time.Now().Add(time.Duration(1) * time.Hour),
+	}
+	ssh.responses["userandhost"] = sshAuthResponse{Href: "real"}
+
+	e := Endpoint{
+		SshUserAndHost: "userandhost",
+		SshPort:        "1",
+		SshPath:        "path",
+	}
+
+	res, err := cache.Resolve(e, "post")
+	assert.Nil(t, err)
+	assert.Equal(t, "cache", res.Href)
+}
+
+func TestSSHCacheResolveFromCacheWithPastExpiresAt(t *testing.T) {
+	ssh := newFakeResolver()
+	cache := withSSHCache(ssh).(*sshCache)
+	cache.endpoints["userandhost//1//path//post"] = &sshAuthResponse{
+		Href:      "cache",
+		ExpiresAt: time.Now().Add(time.Duration(-1) * time.Hour),
+	}
+	ssh.responses["userandhost"] = sshAuthResponse{Href: "real"}
+
+	e := Endpoint{
+		SshUserAndHost: "userandhost",
+		SshPort:        "1",
+		SshPath:        "path",
+	}
+
+	res, err := cache.Resolve(e, "post")
+	assert.Nil(t, err)
+	assert.Equal(t, "real", res.Href)
+}
+
 func TestSSHCacheResolveWithoutError(t *testing.T) {
 	ssh := newFakeResolver()
 	cache := withSSHCache(ssh).(*sshCache)