Skip to main content Module auth Copy item path Source pub use repull::ERROR_CODE_NO_VALID_CID ;pub use repull::repull_auth_code ;pub use repull::repull_auth_code_with_client_type ;commconfig CommConfig transaction actor and atomically published last-good snapshot. conn_points Platform 通道后端连接点，按 UserAttribution 分池。 redact v1.4.84 SEC-001 fix: Auth credential redaction for debug log output. repull v1.4.93 G2 (CLAUDE.md C4 audit): RepullAuthCode broker auth_code self-heal.
Triggered when broker auth_code expires (typical 30-day window) or
kAuthNoValidCid (20029); avoids requiring a daemon restart.
v1.4.93 G2 (CLAUDE.md C4 audit): 实装 POST /authority/repull_auth_code，
对齐 C++ FTLogin auth_impl.cpp:715-754 RepullAuthCode +
auth_impl.cpp:3308-3376 ParseRepullAuthCodeResponse。 AuthChallengeWork AuthConfig v1.4.19：ZeroizeOnDrop 让 AuthConfig drop 时自动把 password 字段的
堆内存清零，减少进程 core dump / /proc/<pid>/mem 读到明文的窗口。
其他字段（auth_server / account / device_id）不是秘密，#[zeroize(skip)]
跳过。注意 Clone 每次复制都会产生新堆分配，drop 时各自 zeroize。 AuthResult AuthSession Initial authentication result plus the pre-login site-config runtime state
that must be handed to the authenticated Gateway lifecycle exactly once. BrokerAuth broker_auth HTTP 响应里提取出的 broker-specific 凭据。 BrokerAuthCode auth_code_list 响应条目——每个 broker 一项。
对齐 C++ FTLogin/Src/ftlogin/auth/impl/auth_impl.cpp:3504（ParseAuthCodeList）BrokerAuthRequest 向 broker auth 域名发 /broker_auth/client_auth POST 请求，换取
broker_client_sig + broker_client_key。 BrokerAuthRouteCache C++ FTAuthImpl 的 broker-auth 成功阶段缓存。 BrokerConfig 单个 broker 通道的配置 —— broker_id → (名字 / conn_identity / broker auth HTTP 域名) CredentialTicketStatus Cached credentials ticket age summary for daemon diagnostics. RefreshCredentialsReport v1.4.34: daemon-reload 升级（A’ 方案）的产出。 AuthRefreshReason Runtime reason for refreshing the persisted platform credentials. DeviceStoreError UserAttribution User attribution returned by the primary-auth salt response. WebSigPersistenceError Fail-closed errors returned while updating an existing credential record. AUTH_SERVER_PROD 默认认证服务器——CN / HK 归属地账号用这个。
海外账号（US/SG/AU/JP）实际请求时会按 UserAttribution::auth_domain() 切换。 REFRESH_TIMEOUT Existing authority refresh network budget, moved verbatim from the retired
auth/refresh.rs owner. This is an operational bound rather than a protocol
constant: networks taking longer than 10s fail this attempt and rely on the
caller’s existing backoff; replace it when authority timeout config becomes
server-driven. TGTGT_VALIDITY_SECS v1.4.71: TGTGT 票据有效期（30 天），对齐 C++ auth_cryptor.cpp:135
CreateNewTgtgt 里 InvalidTime = RefreshTime + 30 * 24 * 3600。 AuthChallengePort authenticate 完整密码鉴权（优先用保存的凭据跳过验证码） authenticate_with_callback 完整密码鉴权（带自定义验证码回调） authenticate_with_challenge_port broker_auth broker_config broker_id → BrokerConfig 映射，对齐 C++ broker_config.cpp:9-18 中
auth_domain 非空、Rust 可建立 broker-auth 通道的子集。
未知 / 当前不可建通道的 broker_id 返回 None（路由时 skip）。 build_http_client credential_ticket_status Return non-sensitive metadata about the cached auth ticket for diagnostics. forget_cached_credentials Remove only the persisted remember-login ticket for account while keeping
the stable device identity. Interactive login uses this after a successful
one-shot session when the operator answers “do not remember”. install_default_rustls_crypto_provider rustls 0.23 requires an explicit process-level crypto provider when more
than one provider feature is present. WebTCP uses rustls directly, so do
this before the first ClientConfig::builder() call. is_cpp_known_broker_id C++ broker_config.cpp:9-18 静态表里的 broker_id。 persist_broker_websig Persist one Broker ticket returned by CMD20203 while preserving tickets
owned by other broker channels. persist_platform_websigs Persist the Platform tickets returned by CMD1013 without replacing the
rest of the account credential record. read_or_generate_device_id 读取 device_id；文件不存在则生成新的 16-hex 随机值并持久化。 refresh_credentials_on_disk v1.4.34: 给 daemon-reload 升级用——用磁盘缓存的 (uid, tgtgt, device_sig, rand_key) 走一次 remember_login，成功则把新 tgtgt 写回 credentials 文件。 reset_device_state 删除 device_id 文件 + credentials 文件（--reset-device 使用）。 tighten_secret_files_at_startup 启动时扫 ~/.futu-opend-rs/ 把已存在的 secret 文件 (credentials-.json
/ device- .dat) 收紧到 0600. v1.4.101 及以前版本可能创建了 0644 文件,
此 fn 是迁移路径. with_auth_challenge_port VerifyCodeCallback 验证码获取回调类型