Fix cache duration computation in CredentialCacheExpiry.

Also use the supplied current time instead of calling Instant.now().

I don't know how to meaningfully test this; there's so little going on that the test would essentially mirror the implementation.

Fixes bazelbuild#23429.

PiperOrigin-RevId: 668351088
Change-Id: I12f1575e5280330c61361e4cf1b7d9f9231f16eb

src/main/java/com/google/devtools/build/lib/authandtls/credentialhelper/CredentialCacheExpiry.java

@@ -32,24 +32,23 @@ public void setDefaultCacheDuration(Duration duration) {
     this.defaultCacheDuration = Preconditions.checkNotNull(duration);
   }
 
-  private Duration getExpirationTime(GetCredentialsResponse response) {
+  private Duration getExpirationTime(GetCredentialsResponse response, Instant currentTime) {
     Preconditions.checkNotNull(response);
 
     var expires = response.getExpires();
     if (expires.isEmpty()) {
       return defaultCacheDuration;
     }
 
-    var now = Instant.now();
-    return Duration.between(expires.get(), now);
+    return Duration.between(currentTime, expires.get());
   }
 
   @Override
   public long expireAfterCreate(URI uri, GetCredentialsResponse response, long currentTime) {
     Preconditions.checkNotNull(uri);
     Preconditions.checkNotNull(response);
 
-    return getExpirationTime(response).toNanos();
+    return getExpirationTime(response, Instant.ofEpochMilli(nanoToMilli(currentTime))).toNanos();
   }
 
   @Override
@@ -58,7 +57,7 @@ public long expireAfterUpdate(
     Preconditions.checkNotNull(uri);
     Preconditions.checkNotNull(response);
 
-    return getExpirationTime(response).toNanos();
+    return getExpirationTime(response, Instant.ofEpochMilli(nanoToMilli(currentTime))).toNanos();
   }
 
   @CanIgnoreReturnValue
@@ -71,4 +70,8 @@ public long expireAfterRead(
     // We don't extend the duration on access.
     return currentDuration;
   }
+
+  private static final long nanoToMilli(long nano) {
+    return Duration.ofNanos(nano).toMillis();
+  }
 }