Struct Auth 

pub struct Auth { /* private fields */ }

Authentication manager for IG Markets API

Handles all authentication operations including:

• Login with API v2 or v3
• Automatic OAuth token refresh
• Account switching
• Session management
• Rate limiting for API requests

Implementations

impl Auth

pub fn try_new(config: Arc<Config>) -> Result<Self, AppError>

Creates a new Auth instance, returning an error if the HTTP client cannot be constructed.

This is the sole constructor for Auth: it surfaces a TLS / client-builder failure as a typed AppError instead of panicking, so callers can handle a broken TLS backend gracefully.

Arguments

• config - Configuration containing credentials and API settings

Errors

Returns AppError::Network if the underlying reqwest client cannot be built (e.g. the system TLS backend fails to initialize).

pub async fn ws_info(&self) -> Result<WebsocketInfo, AppError>

Gets WebSocket connection information for Lightstreamer, reusing the cached session.

This calls Auth::get_session, which returns the cached session when it is still valid and only logs in (storing the new session) when none exists or it has expired. The configured API version is honoured — no per-call v2 re-login is performed.

Returns

• Ok(WebsocketInfo) - Endpoint and authentication tokens for the current session.
• Err(AppError) - If session retrieval (login / refresh) fails.

Errors

Returns AppError when the session cannot be retrieved (login or token refresh failure).

pub async fn get_ws_info(&self) -> WebsocketInfo

👎Deprecated:

use ws_info() which reuses the cached session and returns a typed error instead of a default-on-error WebsocketInfo

Gets the WebSocket password for Lightstreamer authentication

Returns

• WebSocket password in format “CST-{cst}|XST-{token}” or empty string if session is not available

pub async fn get_session(&self) -> Result<Session, AppError>

Gets the current session, ensuring tokens are valid

This method automatically refreshes expired OAuth tokens or re-authenticates if needed.

Returns

• Ok(Session) - Valid session with fresh tokens
• Err(AppError) - If authentication fails

pub async fn login(&self) -> Result<Session, AppError>

Performs initial login to IG Markets API

Automatically detects API version from config and uses appropriate authentication method.

Returns

• Ok(Session) - Authenticated session
• Err(AppError) - If login fails

pub async fn refresh_token(&self) -> Result<Session, AppError>

Proactively refreshes the session when it is within its refresh margin.

This is the proactive path (driven by the local clock). It re-checks the cached session against the same margin get_session used to decide a refresh was due, so the two stay consistent and the refresh actually fires when the session is close to expiry. If the session is still comfortably valid it is returned unchanged; otherwise a full login is performed.

For the reactive 401 / server-side-invalidation path — where the local clock still considers the token valid but IG has already rejected it — use force_refresh, which re-authenticates unconditionally.

Returns

• Ok(Session) - A valid session (refreshed if it was within margin).
• Err(AppError) - If re-authentication fails.

Errors

Returns AppError when a required login fails (network, credentials, or rate limiting).

pub async fn force_refresh(&self) -> Result<Session, AppError>

Forces a fresh re-authentication regardless of local expiry state.

This is the reactive 401 / server-side-invalidation path. When IG rejects a token that the local clock still considers valid (server-side invalidation, a concurrent login elsewhere, or clock skew), a proactive refresh_token would see a “valid” session and hand back the same stale token, so the replayed request would fail again. force_refresh ignores local expiry and performs a full login, which fetches and stores a brand-new session.

It cannot loop back through the 401 handler: login issues its HTTP requests through make_http_request directly, not through the HttpClient refresh-and-replay path, so a 401 encountered during login surfaces as a typed error rather than recursing into force_refresh.

Returns

• Ok(Session) - A freshly authenticated session with new tokens.
• Err(AppError) - If re-authentication fails.

Errors

Returns AppError when the login request fails (network, credentials, or rate limiting).

pub async fn switch_account( &self, account_id: &str, default_account: Option<bool>, ) -> Result<Session, AppError>

Switches to a different trading account

Arguments

• account_id - The account ID to switch to
• default_account - Whether to set as default account

Returns

• Ok(Session) - New session for the switched account
• Err(AppError) - If account switch fails

pub async fn logout(&self) -> Result<(), AppError>

Logs out and clears the current session.

Before clearing local state, this issues DELETE /session (IG API Version 1) with the current authentication headers. For a v2 session (CST / X-SECURITY-TOKEN) this invalidates the session server-side. For a v3 / OAuth session there is no IG token-revocation endpoint and the short-lived access token has usually already expired, so DELETE /session is best-effort: logout clears local state and the OAuth tokens lapse on their own expiry rather than being actively revoked. A 401 Unauthorized (or an already-invalid OAuth token) is treated as already-logged-out and reported as success.

The local session is always cleared, even when the server-side call fails, so the client is never wedged in an authenticated-but-unusable state; the underlying failure is still returned as a typed error.

Errors

Returns AppError when the server-side logout request fails for a reason other than an already-invalid session (401). The local session is cleared regardless.