code: def _test_expiring_token(outdir):
      url = (
          "s3://datalad-test0-versioned/1version-removed-recreated.txt"
      )
      outpath = op.join(outdir, "output")
      providers = get_test_providers(url, reload=True)
      downloader = providers.get_provider(url).get_downloader(url)
  
      from time import (
          sleep,
          time,
      )
  
      from datalad.downloaders.credentials import (
          AWS_S3,
          CompositeCredential,
          UserPassword,
      )
      from datalad.support.keyring_ import MemoryKeyring
      from datalad.tests.utils_pytest import ok_file_has_content
  
      credential = downloader.credential  # AWS_S3('datalad-test-s3')
  
      # We will replace credential with a CompositeCredential which will
      # mint new token after expiration
      # crap -- duration must be no shorter than 900, i.e. 15 minutes --
      # too long to wait for a test!
      duration = 900
  
      generated = []
  
      def _gen_session_token(_, key_id=None, secret_id=None):
          from boto.sts.connection import STSConnection
  
          sts = STSConnection(
              aws_access_key_id=key_id, aws_secret_access_key=secret_id
          )
          # Note: without force_new=True it will not re-request a token and would
          # just return old one if not expired yet.  Testing below might fail
          # if not entirely new
          token = sts.get_session_token(
              duration=duration, force_new=True
          )
          generated.append(token)
          return dict(
              key_id=token.access_key,
              secret_id=token.secret_key,
              session=token.session_token,
              expiration=token.expiration,
          )
  
      class CustomS3(CompositeCredential):
          _CREDENTIAL_CLASSES = (UserPassword, AWS_S3)
          _CREDENTIAL_ADAPTERS = (_gen_session_token,)
  
      keyring = MemoryKeyring()
      downloader.credential = new_credential = CustomS3(
          "testexpire", keyring=keyring
      )
      # but reuse our existing credential for the first part:
      downloader.credential._credentials[0] = credential
  
      # now downloader must use the token generator
      assert not generated  # since we have not called it yet
  
      # do it twice so we reuse session and test that we do not
      # re-mint a new token
      t0 = time()  # not exactly when we generated, might be a bit racy?
      for i in range(2):
          downloader.download(url, outpath)
          ok_file_has_content(outpath, "version1")
          os.unlink(outpath)
      # but we should have asked for a new token only once
      assert len(generated) == 1
      assert (
          downloader.credential is new_credential
      )  # we did not reset it
  
      # sleep for a while and now do a number of downloads during which
      # token should get refreshed etc
  
      # -3 since we have offset -2 hardcoded to refresh a bit ahead of time
      to_sleep = duration - (time() - t0) - 3
      print(
          "Sleeping for %d seconds. Token should expire at %s"
          % (to_sleep, generated[0].expiration)
      )
      sleep(to_sleep)
  
      for i in range(5):
          # should have not been regenerated yet
          # -2 is our hardcoded buffer
          if time() - t0 < duration - 2:
              assert len(generated) == 1
          downloader.download(url, outpath)
          ok_file_has_content(outpath, "version1")
          os.unlink(outpath)
          sleep(1)
      assert len(generated) == 2
  
imports: import os
  from unittest.mock import patch
  import pytest
  from ...downloaders.base import DownloadError
  from ...support import path
  from ...support.exceptions import AccessDeniedError
  from ...tests.utils_pytest import SkipTest, assert_equal, assert_raises, integration, skip_if_no_module, skip_if_no_network, swallow_outputs, turtle, use_cassette, with_tempfile, with_testsui
  from ...utils import md5sum
  from ..providers import Providers
  from ..s3 import S3Authenticator, S3Downloader
  from .test_http import check_download_external_url
  from .utils import get_test_providers
label_desc: Use image node_id 10 for calling a global function with example usage: _test_expiring_token(outdir) and returns: dict