add object Authenticated property

[technoweenie]

This lets servers set an Authenticated property on objects, that the client uses to determine if it needs to call git-credential or not. This is a forward compatible API change, and won't affect existing implementations.

When a client hits the batch api, it sends a payload like this:

{
  "operation": "download",
  "objects": [{"oid": "SOMEOID", "size": 123}]
}

A typical server response returns a URL to transfer the object with any values for the HTTP request header.

{"objects": [{
  "oid": "SOMEOID",
  "size": 123,
  "actions": {
    "download": {
      "href": "https://download-this-object",
      "header": {
        "Authorization": "Basic ..."
      }
    }
  }
}

Git LFS will use git-credential to find the user and pass for that download unless the Authorization header is set. What if the service uses a non-standard header, or what if the file requires no authentication? This is where the authenticated property comes in:

{"objects": [{
  "oid": "SOMEOID",
  "size": 123,
  "authenticated": false,
  "actions": {
    "download": {
      "href": "https://download-this-object",
      "header": {
        "Custom-Token": "Basic ..."
      }
    }
  }
}

[ttaylorr]

Is omitempty behavior that we want? In the case of bools, we would only require having the authenticated property if the value were true.

[technoweenie]

That's fine, since the default is false. Apparently omitempty is good enough for oid too

[ttaylorr]

Pending my one comment, looks great 👍

[ttaylorr]

🚢