fix(ibkr): reconcile CP API v1 read-path to the live paper gateway

[NotAProfDev]

Closes #128

Deferred Task 9 from #127: replace the representative CP API v1 fixtures with real, sanitized captures from a live paper Client Portal Gateway, and reconcile the code to the live wire.

Live-wire corrections (the real gateway disagreed with the representative fixtures)

• tickle binds IBKR's misspelled collission key (an alias keeps the correct spelling should IBKR fix it); guard test added.
• secdef/info binds ticker (not symbol) and returns a single object (not an array) for one conid.
• Endpoint::secdef_info is now conid-only — a stock lookup with secType=STK is rejected 400 "month required".
• capture.sh sends an empty-body POST /tickle (a bodyless POST returns 411) and drops secType from secdef/info.
• secdef/search real AAPL returns 6 sections; positions keep money as serde_json::Number (real mktPrice preserved, holdings zeroed).

Sanitization

Account id, holder name, session token, userId, MAC, hardware id, balances, and account-status date scrubbed; the public market price is kept. gitleaks clean; collission allowlisted in _typos.toml.

just ci is green. Adversarially verified across three lenses (data-leak audit / wire fidelity / harness correctness).

Not in this PR: the widened gateway ips.allow that makes browser login work in a devcontainer was an ephemeral runtime patch. Baking it in + harness hardening (healthcheck, compose limits, container-IP capture — ideas from a reference oath-ibkr-v2 gateway) is a planned follow-up.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Improved IBKR authentication-status parsing for the API’s misspelled collision field.
  • Updated security-definition requests and responses to match observed gateway behavior.
  • Corrected handling of security-definition details, including ticker information and response formatting.

• Tests

  • Expanded and refreshed IBKR paper-gateway fixtures to reflect real-world response payloads.
  • Added coverage for authentication and security-definition compatibility cases.

• Documentation

  • Updated the unreleased changelog with details on the refreshed IBKR gateway fixtures and behavior.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fc940566-5482-4210-a0ce-e1117490c5d1

📥 Commits

Reviewing files that changed from the base of the PR and between 1218850 and ba21ab3.

📒 Files selected for processing (17)

• CHANGELOG.md
• _typos.toml
• crates/adapter/ibkr/src/cpapi/auth.rs
• crates/adapter/ibkr/src/cpapi/endpoint.rs
• crates/adapter/ibkr/src/cpapi/secdef.rs
• crates/adapter/ibkr/tests/auth.rs
• crates/adapter/ibkr/tests/endpoint.rs
• crates/adapter/ibkr/tests/fixtures/cpapi/auth_status.json
• crates/adapter/ibkr/tests/fixtures/cpapi/iserver_accounts.json
• crates/adapter/ibkr/tests/fixtures/cpapi/portfolio_accounts.json
• crates/adapter/ibkr/tests/fixtures/cpapi/positions.json
• crates/adapter/ibkr/tests/fixtures/cpapi/secdef_info.json
• crates/adapter/ibkr/tests/fixtures/cpapi/secdef_search.json
• crates/adapter/ibkr/tests/fixtures/cpapi/tickle.json
• crates/adapter/ibkr/tests/portfolio.rs
• crates/adapter/ibkr/tests/secdef.rs
• docker/cpapi/capture.sh

---

📝 Walkthrough

Walkthrough

IBKR CPAPI mappings and endpoint requests were reconciled with sanitized paper-gateway captures. Fixtures, capture commands, deserialization behavior, public endpoint signatures, and related tests were updated for the observed wire shapes.

Changes

IBKR CPAPI wire reconciliation

Layer / File(s)	Summary
Update CPAPI wire contracts crates/adapter/ibkr/src/cpapi/auth.rs, crates/adapter/ibkr/src/cpapi/secdef.rs, crates/adapter/ibkr/src/cpapi/endpoint.rs, _typos.toml	Tickle accepts the wire key collission, SecdefInfo exposes ticker, and secdef_info now builds a conid-only request.
Capture observed gateway payloads docker/cpapi/capture.sh, crates/adapter/ibkr/tests/fixtures/cpapi/*, CHANGELOG.md	Capture commands and sanitized fixtures now reflect observed tickle, security-definition, authentication, account, position, and search payloads.
Validate reconciled behavior crates/adapter/ibkr/tests/auth.rs, crates/adapter/ibkr/tests/endpoint.rs, crates/adapter/ibkr/tests/secdef.rs, crates/adapter/ibkr/tests/portfolio.rs	Tests verify wire-key decoding, endpoint paths, response shapes, ticker mapping, section counts, and updated market-price data.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• feat(ibkr): Client Portal API v1 read-path wire layer + paper gateway harness #126 — The PR updates the IBKR CPAPI wire layer with DTO mappings, endpoint contracts, fixtures, and capture behavior.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows Conventional Commits and accurately reflects the IBKR CP API v1 read-path reconciliation.
Linked Issues check	✅ Passed	The changes match the linked issue by replacing fixtures with live captures and reconciling DTOs, endpoints, and capture.sh.
Out of Scope Changes check	✅ Passed	No unrelated scope was introduced; the changes stay within fixture, DTO, endpoint, test, and capture-script updates.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/ibkr-cpapi-real-fixtures

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}