From 19d03e9810a41a7e1234c06fc026539c5490c904 Mon Sep 17 00:00:00 2001
From: defnax <9952056+defnax@users.noreply.github.com>
Date: Sun, 19 Jul 2026 20:17:00 +0200
Subject: [PATCH 1/2] Added auth token fix for retroshare mobile

---
 src/jsonapi/jsonapi.cpp | 59 +++++++++++++++++++++++++++++++++++++++++
 src/retroshare/rsinit.h | 11 +++++++-
 src/rsserver/rsinit.cc  | 11 ++++++++
 3 files changed, 80 insertions(+), 1 deletion(-)

diff --git a/src/jsonapi/jsonapi.cpp b/src/jsonapi/jsonapi.cpp
index 27eb0d7ae..bebbba042 100644
--- a/src/jsonapi/jsonapi.cpp
+++ b/src/jsonapi/jsonapi.cpp
@@ -283,6 +283,65 @@ JsonApiServer::JsonApiServer(): configMutex("JsonApiServer config"),
 		} );
 	}, false);
 
+	registerHandler("/rsLoginHelper/attemptLogin",
+	                [this](const std::shared_ptr<rb::Session> session)
+	{
+		auto reqSize = session->get_request()->get_header("Content-Length", 0);
+		session->fetch( static_cast<size_t>(reqSize), [this](
+		                const std::shared_ptr<rb::Session> session,
+		                const rb::Bytes& body )
+		{
+			INITIALIZE_API_CALL_JSON_CONTEXT;
+
+			RsPeerId account;
+			std::string password;
+
+			// JSON API only
+			std::string apiUser;
+			std::string apiPass;
+
+			// deserialize input parameters from JSON
+			{
+				RsGenericSerializer::SerializeContext& ctx(cReq);
+				RsGenericSerializer::SerializeJob j(RsGenericSerializer::FROM_JSON);
+				RS_SERIAL_PROCESS(account);
+				RS_SERIAL_PROCESS(password);
+
+				// JSON API only
+				RS_SERIAL_PROCESS(apiUser);
+				RS_SERIAL_PROCESS(apiPass);
+			}
+
+			RsInit::LoadCertificateStatus retval;
+
+			if(!apiUser.empty() && badApiCredientalsFormat(apiUser, apiPass))
+			{
+				retval = RsInit::LoadCertificateStatus::ERR_UNKNOWN;
+			}
+			else
+			{
+				// Call retroshare C++ API
+				retval = rsLoginHelper->attemptLogin(account, password);
+
+				// If login succeeded and custom API credentials were provided, authorize them!
+				if(retval == RsInit::OK && !apiUser.empty())
+				{
+					authorizeUser(apiUser, apiPass);
+				}
+			}
+
+			// serialize out parameters and return value to JSON
+			{
+				RsGenericSerializer::SerializeContext& ctx(cAns);
+				RsGenericSerializer::SerializeJob j(RsGenericSerializer::TO_JSON);
+				RS_SERIAL_PROCESS(retval);
+			}
+
+			// return them to the API caller
+			DEFAULT_API_CALL_JSON_RETURN(rb::OK);
+		} );
+	}, false);
+
 	registerHandler("/rsControl/rsGlobalShutDown",
 	                [](const std::shared_ptr<rb::Session> session)
 	{
diff --git a/src/retroshare/rsinit.h b/src/retroshare/rsinit.h
index 11c6d9190..ef5391bf0 100644
--- a/src/retroshare/rsinit.h
+++ b/src/retroshare/rsinit.h
@@ -419,9 +419,18 @@ class RsLoginHelper
 
 	/**
 	 * @brief Normal way to attempt login
-	 * @jsonapi{development,unauthenticated}
+	 * @jsonapi{development,manualwrapper}
 	 * @param[in] account Id of the account to which attempt login
 	 * @param[in] password Password for the given account
+	 * unauthenticated
+	 * param[in] apiUser (JSON API only) string containing username for JSON API
+	 *	so it can be later used to authenticate JSON API calls. It is passed
+	 *	down to @see RsJsonApi::authorizeUser under the hood.
+	 * param[in] apiPass (JSON API only) string containing password for JSON API
+	 *	so it can be later used to authenticate JSON API calls. It is passed
+	 *	down to @see RsJsonApi::authorizeUser under the hood.
+	 *	To improve security we strongly advise to not use the same as the
+	 *	password used for the PGP key.
 	 * @return RsInit::OK if login attempt success, error code otherwhise
 	 */
 	RsInit::LoadCertificateStatus attemptLogin(
diff --git a/src/rsserver/rsinit.cc b/src/rsserver/rsinit.cc
index c3b17c149..c98d94d61 100644
--- a/src/rsserver/rsinit.cc
+++ b/src/rsserver/rsinit.cc
@@ -1345,6 +1345,17 @@ int RsServer::StartupRetroShare()
 	//
 	mPluginsManager->loadPlugins(programatically_inserted_plugins) ;
 
+#ifdef RS_JSONAPI
+	if (rsJsonApi)
+	{
+		p3ConfigMgr *cfgmgr = dynamic_cast<p3ConfigMgr*>(mConfigMgr);
+		if (cfgmgr != nullptr)
+		{
+			rsJsonApi->connectToConfigManager(*cfgmgr);
+		}
+	}
+#endif
+
     	/**** Reputation system ****/
 
     	p3GxsReputation *mReputations = new p3GxsReputation(mLinkMgr) ;

From 292dd80bc24fac86ab696216cc32110cb1521c1c Mon Sep 17 00:00:00 2001
From: defnax <9952056+defnax@users.noreply.github.com>
Date: Mon, 20 Jul 2026 17:36:21 +0200
Subject: [PATCH 2/2] moved line

---
 src/retroshare/rsinit.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/retroshare/rsinit.h b/src/retroshare/rsinit.h
index ef5391bf0..eccc058d0 100644
--- a/src/retroshare/rsinit.h
+++ b/src/retroshare/rsinit.h
@@ -420,9 +420,9 @@ class RsLoginHelper
 	/**
 	 * @brief Normal way to attempt login
 	 * @jsonapi{development,manualwrapper}
+	 * unauthenticated
 	 * @param[in] account Id of the account to which attempt login
 	 * @param[in] password Password for the given account
-	 * unauthenticated
 	 * param[in] apiUser (JSON API only) string containing username for JSON API
 	 *	so it can be later used to authenticate JSON API calls. It is passed
 	 *	down to @see RsJsonApi::authorizeUser under the hood.