Interesting approach, but I think a better approach would be wrapping the credential and ssh code with a write-through caching layer. For example, there's already a CredentialHelper interface that's used for tests. That way, the interfaces to making HTTP requests doesn't have to change everywhere. What do you think about that?

Also, the SSH auth cache doesn't take expires_at into account. So it's possible that requests made after the expiration would be stuck using a bad token.

Also, the SSH auth cache doesn't take expires_at into account. So it's possible that requests made after the expiration would be stuck using a bad token.

It not a problem: expire_at is useless, because nobody guaranty time syncronization between client and lfs-server hosts.
On expired token usage, server should return 401 error and client reinvoke git-lfs-authenticate command for new token.

Interesting approach, but I think a better approach would be wrapping the credential and ssh code with a write-through caching layer. For example, there's already a CredentialHelper interface that's used for tests. That way, the interfaces to making HTTP requests doesn't have to change everywhere. What do you think about that?

I wanted to use CredentialHelper, but git-lfs-authenticate returns not credentional, but request URL and headers. And there are no stable paths in git-lfs-authenticate response. It can change any information.

Also, the SSH auth cache doesn't take expires_at into account. So it's possible that requests made after the expiration would be stuck using a bad token.

It not a problem: expire_at is useless, because nobody guaranty time syncronization between client and lfs-server hosts.

LFS exhibits this behavior in other places where it will retry requests that have actions that are already expired instead of receiving a 401 and retrying the request later down the pipeline. If the client and server have drastically different times, the request retry budget will be exceeded and the request will fail.

I think it would be worthwhile to keep that behavior consistent here and respect the expires_at property.

I wanted to use CredentialHelper, but git-lfs-authenticate returns not credentional, but request URL and headers.

I think it would be fine to also return credentials from this function, but I would love to hear @technoweenie's thoughts on this.

I think the ssh auth can have its own custom interface that returns a (cached) href + header + expires_at. It doesn't have to use the credential helper interface.

Closing since we merged #2080.