Added auth token fix for retroshare mobile

[defnax]

Walkthrough - Secure API Token Authentication

We have designed and implemented a safer authentication mechanism for RetroShare's JSON API. The PGP/profile password is no longer transmitted in the Authorization headers of REST requests, nor is it registered as the API token. Instead, we dynamically derive a secure API token client-side and authorize it upon login.

---

Changes

1. C++ Core (libretroshare)

• rsinit.h: Marked attemptLogin as manualwrapper to exclude it from automatic API wrapper generation.
• jsonapi.cpp: Implemented a manual wrapper for /rsLoginHelper/attemptLogin that deserializes optional apiUser and apiPass fields, calls attemptLogin, and registers the client's custom credentials using authorizeUser(apiUser, apiPass) if the login is successful.

2. Dart API Wrapper (Retroshare-Wrapper)

• retroshare.dart: Updated requestLogIn and requestAccountCreation to accept optional apiUser and apiPass arguments and include them in the request body parameters.

3. Mobile Client (rs-mobile)

• pubspec.yaml:
  • Added the crypto package dependency.
• auth.dart:
  • Added deriveApiToken helper function using sha256(locationId:password) to dynamically compute secure API credentials.
  • Modified getinitializeAuth to verify credentials using deriveApiToken.
  • Updated login and signup methods to derive the secure credentials and pass them during registration/login calls.

---

Verification Results

• All components compiled successfully with zero errors.
• Dependencies were resolved correctly with flutter pub get.

[defnax]

@G10h4ck

[defnax]

Hope merged soon i need continue on retroshare mobile

[G10h4ck]

did you test it on at least a couple of platforms?

[defnax]

i tesed with rs mobile flutter with windows desktop(w10) and android (Samsung) no issue