@sumaris-net/ngx-components 2.6.4-alpha4 → 2.6.4-alpha5

package/src/app/core/services/account.service.ts

@@ -0,0 +1,1431 @@
+import {Inject, Injectable, InjectionToken, Optional} from '@angular/core';
+import {CryptoService, Keypair} from './crypto.service';
+import {Department} from './model/department.model';
+import {Account, UserSettings} from './model/account.model';
+import {Person, PersonUtils, UserProfileLabel} from './model/person.model';
+import {LocalSettings, UsageMode} from './model/settings.model';
+import {BehaviorSubject, from, Observable, Subject, Subscription} from 'rxjs';
+import {FetchPolicy, gql} from '@apollo/client/core';
+import {Storage} from '@ionic/storage-angular';
+
+import {isEmptyArray, isNil, sleep, toNumber} from '../../shared/functions';
+import {BaseGraphqlService} from './base-graphql-service.class';
+import {ErrorCodes, ServerErrorCodes} from './errors';
+import {GraphqlService} from '../graphql/graphql.service';
+import {LocalSettingsService} from './local-settings.service';
+import {FormFieldDefinition, FormFieldDefinitionMap} from '../../shared/form/field.model';
+import {NetworkService} from './network.service';
+import {AuthTokenType} from './network.types';
+import {FileService} from '../../shared/file/file.service';
+import {MINIFY_ENTITY_FOR_POD, Referential, ReferentialUtils} from './model/referential.model';
+import {StatusIds} from './model/model.enum';
+import {Base58} from './base58';
+import {ENVIRONMENT} from '../../../environments/environment.class';
+import {fromDateISOString} from '../../shared/dates';
+import {firstNotNilPromise} from '../../shared/observables';
+import {debounceTime, filter, map, switchMap} from 'rxjs/operators';
+import {BaseEntityGraphqlMutations, BaseEntityGraphqlSubscriptions} from './base-entity-service.class';
+import {Moment} from 'moment';
+import {ShowToastOptions, Toasts} from '../../shared/toast/toasts';
+import {OverlayEventDetail} from '@ionic/core';
+import {ToastController} from '@ionic/angular';
+import {TranslateService} from '@ngx-translate/core';
+import {TokenScope, UserToken} from './model/token.model';
+
+
+export declare interface AccountDetails {
+  loaded: boolean;
+  keypair: Keypair;
+  authToken: string;
+  authBasic?: string;
+  pubkey: string;
+  person: Person;
+  department: Department;
+  mainProfile: string;
+}
+export interface AuthData {
+  username: string;
+  password: string;
+  offline?: boolean;
+}
+export interface RegisterData extends AuthData {
+  account: Account;
+}
+
+const TOKEN_STORAGE_KEY = 'token';
+const PUBKEY_STORAGE_KEY = 'pubkey';
+const SECKEY_STORAGE_KEY = 'seckey';
+const ACCOUNT_STORAGE_KEY = 'account';
+
+const DEFAULT_AVATAR_IMAGE = 'assets/img/person.png';
+
+export interface UserSettingsOptions {
+  options: FormFieldDefinitionMap;
+}
+export const APP_USER_SETTINGS_OPTIONS = new InjectionToken<UserSettingsOptions>('UserSettingsOptions');
+export const APP_USER_TOKEN_SCOPES = new InjectionToken<TokenScope[]>('UserTokenScopes');
+
+
+/* ------------------------------------
+ * GraphQL queries
+ * ------------------------------------*/
+const Fragments = {
+  account: gql`
+    fragment AccountFragment on AccountVO {
+      id
+      firstName
+      lastName
+      email
+      pubkey
+#      username
+#      usernameExtranet
+      avatar
+      statusId
+      updateDate
+      creationDate
+      profiles
+      settings {
+        ...UserSettingsFragment
+      }
+      tokens {
+        ...UserTokenFragment
+      }
+      department {
+        id
+        label
+        name
+        __typename
+      }
+      __typename
+    }`,
+
+  settings: gql`fragment UserSettingsFragment on UserSettingsVO {
+    id
+    locale
+    latLongFormat
+    content
+    nonce
+    updateDate
+    __typename
+  }`,
+
+  token: gql`fragment UserTokenFragment on UserTokenVO {
+    id
+    pubkey
+    token
+    name
+    flags
+    expirationDate
+    lastUsedDate
+    creationDate
+    updateDate
+    __typename
+  }`
+};
+
+// Load account query
+const LoadQuery: any = gql`
+  query Account {
+    data: account {
+      ...AccountFragment
+    }
+  }
+  ${Fragments.account}
+  ${Fragments.settings}
+  ${Fragments.token}
+`;
+
+// Check email query
+const IsEmailExistsQuery: any = gql`
+  query IsEmailExists($email: String, $hash: String){
+    isEmailExists(email: $email, hash: $hash)
+  }
+`;
+export declare interface IsEmailExistsVariables {
+  email: string;
+  hash: string;
+}
+
+// Save (create or update) account mutation
+const AccountMutations: Partial<BaseEntityGraphqlMutations> & { create: any; saveSettings: any } = {
+  save: gql` mutation SaveAccount($data:AccountVOInput){
+    data: saveAccount(account: $data){
+      ...AccountFragment
+    }
+  }
+  ${Fragments.account}
+  ${Fragments.token}
+  ${Fragments.settings}
+  `,
+
+  create: gql`mutation CreateAccount($data:AccountVOInput){
+    data: createAccount(account: $data){
+      ...AccountFragment
+    }
+  }
+  ${Fragments.account}
+  ${Fragments.settings}
+  ${Fragments.token}
+  `,
+
+  saveSettings: gql`mutation SaveSettings($data:UserSettingsVOInput){
+    data: saveSettings(settings: $data){
+      ...UserSettingsFragment
+    }
+  }
+  ${Fragments.settings}`
+};
+
+// Sent confirmation email
+const SendConfirmEmailMutation: any = gql`
+  mutation sendAccountConfirmationEmail($email:String, $locale:String){
+    sendAccountConfirmationEmail(email: $email, locale: $locale)
+  }
+`;
+
+// Confirm account email
+const ConfirmEmailMutation: any = gql`
+  mutation confirmAccountEmail($email:String, $code:String){
+    confirmAccountEmail(email: $email, code: $code)
+  }
+`;
+
+// Authentication  query
+const AuthQuery: any = gql`
+  query Auth($token: String){
+    authenticate(token: $token)
+  }
+`;
+
+// New auth challenge query
+const AuthChallengeQuery: any = gql`
+  query AuthChallenge{
+    authChallenge{
+      challenge
+      pubkey
+      signature
+    }
+  }
+`;
+
+interface IAuthChallenge {
+  pubkey: string;
+  challenge: string;
+  signature: string;
+}
+
+const AccountSubscriptions: BaseEntityGraphqlSubscriptions = {
+  listenChanges: gql`subscription updateAccount($interval: Int){
+    data: updateAccount(interval: $interval) {
+      id
+      updateDate
+    }
+  }`
+};
+
+export interface AccountWatchOptions {
+  intervalInSeconds?: number;
+}
+
+@Injectable({providedIn: 'root', deps: [ ENVIRONMENT ]})
+export class AccountService extends BaseGraphqlService<Account, any, number, Account> {
+
+  onLogin = new Subject<Account>();
+  onLogout = new Subject<void>();
+  onChange = new Subject<Account>();
+  onAuthTokenChange = new BehaviorSubject<string | undefined>(undefined);
+  onAuthBasicChange = new BehaviorSubject<string | undefined>(undefined);
+
+  private _listenChangesSubscription: Subscription = null;
+  private readonly _enableListenChanges: boolean;
+  private readonly _listenIntervalInSeconds: number;
+  private _cache: AccountDetails = {
+    loaded: false,
+    keypair: null,
+    authToken: null,
+    authBasic: null,
+    pubkey: null,
+    mainProfile: null,
+    person: null,
+    department: null
+  };
+  private readonly _optionDefs: FormFieldDefinition[];
+  private _$additionalFields = new BehaviorSubject<FormFieldDefinition[]>([]);
+  private _tokenType$ = new BehaviorSubject<AuthTokenType>(undefined);
+
+  get account(): Account {
+    return this._cache.loaded ? this._data : undefined;
+  }
+
+  get person(): Person {
+    if (this._cache.loaded && !this._cache.person) {
+      this._cache.person = this._cache.loaded ? this._data.asPerson() : undefined;
+    }
+    return this._cache.person;
+  }
+
+  get department(): Department {
+    if (this._cache.loaded && !this._cache.department) {
+      this._cache.department = this._cache.loaded ? this._data.asPerson().department : undefined;
+    }
+    return this._cache.department;
+  }
+
+  get tokenType(): AuthTokenType {
+    return this._tokenType$.value;
+  }
+
+  set tokenType(value: AuthTokenType) {
+    if (this._tokenType$.value !== value) {
+      console.info('[account] Using authentication token type: ' + value);
+      this._tokenType$.next(value);
+      // Reset values
+      this._cache.authToken = undefined;
+      this.onAuthTokenChange.next(undefined);
+      this._cache.authBasic = undefined;
+      this.onAuthBasicChange.next(undefined);
+    }
+  }
+
+  constructor(
+    protected network: NetworkService,
+    protected graphql: GraphqlService,
+    protected settings: LocalSettingsService,
+    protected storage: Storage,
+    protected file: FileService,
+    @Optional() private translate: TranslateService,
+    @Optional() private toastController: ToastController,
+    @Inject(ENVIRONMENT) protected environment,
+    @Optional() @Inject(APP_USER_SETTINGS_OPTIONS) options: UserSettingsOptions
+  ) {
+    super(graphql, environment);
+    this._enableListenChanges = (!environment.account || environment.account.enableListenChanges !== false); // True by default
+    this._listenIntervalInSeconds = toNumber(environment.account && environment.account.listenIntervalInSeconds, 0); // no timer by default
+
+    this._debug = !environment.production;
+    if (this._debug) console.debug('[account-service] Creating service');
+    this._optionDefs = Object.values(options?.options || {});
+
+    this.resetData();
+
+    // Send auth token to the graphql layer, when changed
+    this.onAuthTokenChange.subscribe((token) => this.graphql.setAuthToken(token));
+    this.onAuthBasicChange.subscribe((basic) => this.graphql.setAuthBasic(basic));
+
+    // Force network to wait account service, after getting connection to the peer
+    this.network.on('beforeTryOnlineFinish', async (online) => {
+      // If online, wait a full restart, because it can force offline mode
+      if (online && (!this.started || this.isLogin())) {
+        console.debug('[account] Force networkService.tryOnline() to wait, that graphql and account service is restarted...');
+        await sleep(500); // wait graphql service to be restarted
+        if (!this.started) await this.ready();
+      }
+    });
+  }
+
+
+  async ngOnStart(): Promise<Account> {
+
+    await Promise.all([
+      this.settings.ready(),
+      // Wait token type to be set
+      firstNotNilPromise(this._tokenType$)
+    ]);
+
+    // Listen graphql start (or restart)
+    this.registerSubscription(
+      this.graphql.stopSubject.subscribe(() => {
+        if (this.started && this.isLogin()) {
+          console.debug('[account] Restarting, to retry to authenticate...');
+          this.restart();
+        }
+      })
+    );
+
+    await this.restoreLocally();
+    await this.listenSettings();
+
+    return this._data;
+  }
+
+  protected async ngOnStop(): Promise<void> {
+    const hadAuthToken = this._cache.authToken && true;
+    const hadAuthBasic = this._cache.authBasic && true;
+    const hadAuth = hadAuthToken || hadAuthBasic;
+    this.resetData();
+    if (hadAuth) {
+      this.onLogout.next();
+      this.onChange.next(undefined);
+      if (hadAuthToken) this.onAuthTokenChange.next(undefined);
+      if (hadAuthBasic) this.onAuthBasicChange.next(undefined);
+    }
+  }
+
+  isLogin(): boolean {
+    return !!(this._cache.pubkey && this._cache.loaded);
+  }
+
+  isAuth(): boolean {
+    return !!(this._cache.pubkey && this._cache.keypair && this._cache.keypair.secretKey);
+  }
+
+  hasMinProfile(userProfile: UserProfileLabel): boolean {
+    // should be login, and status ENABLE or TEMPORARY
+    if (!this._data || !this._data.pubkey ||
+      (this._data.statusId !== StatusIds.ENABLE && this._data.statusId !== StatusIds.TEMPORARY)) {
+      return false;
+    }
+    return PersonUtils.hasUpperOrEqualsProfile(this._data.profiles, userProfile);
+  }
+
+  hasExactProfile(label: UserProfileLabel): boolean {
+    // should be login, and status ENABLE or TEMPORARY
+    if (!this._data || !this._data.pubkey ||
+      (this._data.statusId !== StatusIds.ENABLE && this._data.statusId !== StatusIds.TEMPORARY))
+      return false;
+    return this._data.profiles.some(profile => profile === label);
+  }
+
+  hasProfileAndIsEnable(userProfile: UserProfileLabel): boolean {
+    // should be login, and status ENABLE
+    if (!this._data || !this._data.pubkey || this._data.statusId !== StatusIds.ENABLE) return false;
+    return PersonUtils.hasUpperOrEqualsProfile(this._data.profiles, userProfile);
+  }
+
+  isAdmin(): boolean {
+    return this.hasProfileAndIsEnable('ADMIN');
+  }
+
+  isSupervisor(): boolean {
+    return this.hasProfileAndIsEnable('SUPERVISOR');
+  }
+
+  isUser(): boolean {
+    return this.hasProfileAndIsEnable('USER');
+  }
+
+  /**
+   * @deprecated
+   * @param mode
+   */
+  isUsageMode(mode: UsageMode): boolean {
+    return this.settings.isUsageMode(mode);
+  }
+
+  isOnlyGuest(): boolean {
+    // Should be login, and status ENABLE or TEMPORARY
+    if (!this._data || !this._data.pubkey ||
+      (this._data.statusId !== StatusIds.ENABLE && this._data.statusId !== StatusIds.TEMPORARY))
+      return false;
+    // Profile less then user
+    return !PersonUtils.hasUpperOrEqualsProfile(this._data.profiles, 'USER');
+  }
+
+  /**
+   *
+   * @param recorderDepartment
+   * @deprecated use ProgramRefService.canUserWriteDataForDepartment() instead
+   */
+  canUserWriteDataForDepartment(recorderDepartment: Referential | any): boolean {
+    if (ReferentialUtils.isEmpty(recorderDepartment)) {
+      return this.isAdmin();
+    }
+
+    // Should be login, and status ENABLE
+    if (!this._data || !this._data.pubkey || this._data.statusId !== StatusIds.ENABLE) return false;
+
+    if (!this._data.department || !this._data.department.id) {
+      console.warn('User account has no department ! Unable to check write right against recorderDepartment');
+      return false;
+    }
+
+    // Same recorder department: OK, user can write
+    if (this._data.department.id === recorderDepartment.id) return true;
+
+    // Else, check if supervisor (or more)
+    return PersonUtils.hasUpperOrEqualsProfile(this._data.profiles, 'SUPERVISOR');
+  }
+
+  async register(data: RegisterData): Promise<Account> {
+    if (this.isLogin()) {
+      throw new Error('User already login. Please logout before register.');
+    }
+    if (!data.username || !data.password) throw new Error('Missing required username or password');
+
+    if (this._debug) console.debug('[account] Register new user account...', data.account);
+    this._cache.loaded = false;
+    const now = Date.now();
+
+    try {
+      const keypair = await CryptoService.scryptKeypair(data.username, data.password);
+      data.account.pubkey = Base58.encode(keypair.publicKey);
+
+      // Default values
+      data.account.settings = data.account.settings || new UserSettings();
+      data.account.settings.locale = this.settings.locale;
+      data.account.settings.latLongFormat = this.settings.latLongFormat;
+      data.account.settings.content = data.account.settings.content || {};
+      data.account.department.id = data.account.department.id || this.environment.defaultDepartmentId;
+
+      this._cache.keypair = keypair;
+      const account = await this.saveRemotely(data.account, keypair);
+
+      // Default values
+      account.avatar = account.avatar || (this.environment.baseUrl + DEFAULT_AVATAR_IMAGE);
+      this._cache.mainProfile = PersonUtils.getMainProfile(account.profiles);
+
+      this._data = account;
+      this._cache.pubkey = account.pubkey;
+
+      // Try to auth on pod
+      await this.authenticate(data);
+
+      this._cache.loaded = true;
+
+      await this.saveLocally();
+
+      console.debug(`[account] Account successfully registered in ${Date.now() - now}ms`);
+
+      // Emit events
+      this.onLogin.next(this._data);
+      this.onChange.next(this._data);
+
+      // Listen remote changes
+      if (this._enableListenChanges) this.startListenRemoteChanges();
+
+      return this._data;
+    }
+    catch (error) {
+      console.error(error && error.message || error);
+      this.resetData();
+      throw error;
+    }
+  }
+
+  async authenticate(data?: AuthData) {
+    // Wait the auth token, then continue
+    const tokenType = await firstNotNilPromise(this._tokenType$);
+
+    // Basic auth
+    if (tokenType === 'basic' || tokenType === 'basic-and-token') {
+
+      // Generate the authBasic, if used
+      if (!this._cache.authBasic) {
+        // Skip if token already provided
+        if (!(this._cache.authToken && tokenType === 'basic-and-token')) {
+          if (!data || !data.username || !data.password) throw new Error('Missing username and password');
+          this._cache.authBasic = CryptoService.encodeBase64(`${data.username}:${data.password}`);
+        }
+      }
+      this.onAuthBasicChange.next(this._cache.authBasic);
+    }
+
+    // Generate the authToken, if used
+    if (tokenType === 'token' || tokenType === 'basic-and-token') {
+      try {
+        this._cache.authToken = await this.authenticateAndGetToken(this._cache.authToken);
+      } catch (error) {
+        // Never authenticate, or not ready for offline mode => exit
+        console.error(error);
+        this.resetData();
+        throw error;
+      }
+    }
+
+    // Forget authBasic, to switch to authToken
+    if (tokenType === 'basic-and-token') {
+      this._cache.authBasic = undefined;
+      this.onAuthBasicChange.next(undefined);
+    }
+  }
+
+  async login(data: AuthData): Promise<Account> {
+    if (!data || !data.username || !data.password) throw new Error('Missing required username or password');
+
+    console.debug('[account] Login...');
+
+    let keypair;
+    try {
+      keypair = await CryptoService.scryptKeypair(data.username, data.password);
+    } catch (error) {
+      console.error(error);
+      this.resetData();
+      throw { code: ErrorCodes.UNKNOWN_ERROR, message: 'ERROR.SCRYPT_ERROR' };
+    }
+
+    // Store pubkey+keypair
+    this._cache.pubkey = Base58.encode(keypair.publicKey);
+    this._cache.keypair = keypair;
+
+    // Try to load previous token
+    let previousToken: string = await this.storage.get(TOKEN_STORAGE_KEY);
+    previousToken = previousToken && previousToken.startsWith(this._cache.pubkey) && previousToken || null;
+
+    // Offline mode
+    const offline = this.settings.hasOfflineFeature() && (this.network.offline || data.offline === true);
+    if (offline)  {
+      this._cache.authToken = previousToken;
+
+      // Make sure network if set as offline
+      this.network.setForceOffline(true, {showToast: false});
+      console.info(`[account] Login [OK] {pubkey: ${this._cache.pubkey.substr(0, 8)}}, {offline: true}`);
+    }
+
+    // Online mode: try to auth on pod
+    else {
+
+      try {
+        await this.authenticate(data);
+      } catch (error) {
+        // Never authenticate, or not ready for offline mode => exit
+        console.error(error);
+        this.resetData();
+        throw error;
+      }
+    }
+
+    // Load account data
+    try {
+      await this.loadData({offline, fetchPolicy: 'network-only'});
+    }
+    catch (err) {
+      // If account not found, check if email is valid
+      if (err && +(err.code) === ErrorCodes.LOAD_ACCOUNT_ERROR) {
+
+        // Check email exists
+        if (data.username.indexOf('@') !== -1) {
+          let isEmailExists;
+          try {
+            isEmailExists = await this.isEmailExists(data.username);
+          } catch (otherError) {
+            throw err; // resend the first error
+          }
+
+          // Email not exists (no account)
+          if (!isEmailExists) {
+            throw { code: ErrorCodes.UNKNOWN_ACCOUNT_EMAIL, message: 'ERROR.UNKNOWN_ACCOUNT_EMAIL' };
+          }
+        }
+
+        // Email exists, so error = 'bad password'
+        throw { code: ErrorCodes.BAD_PASSWORD, message: 'ERROR.BAD_PASSWORD' };
+      }
+
+      throw err; // resend the first error
+    }
+
+    try {
+      // Store to local storage
+      await this.saveLocally();
+    }
+    catch (error) {
+      console.error(error);
+      this.resetData();
+      throw error;
+    }
+
+    // Emit event to observers
+    this.onLogin.next(this._data);
+    this.onChange.next(this._data);
+
+    if (this._enableListenChanges) this.startListenRemoteChanges();
+
+    return this._data;
+  }
+
+  async reload(opts?: {showToast?: boolean}): Promise<Account> {
+    if (!this._cache.pubkey) throw new Error('User not logged');
+    if (this.network.offline) throw new Error('Cannot check account in offline mode');
+
+    const now = Date.now();
+    console.debug(`[account] Reloading account...`);
+    const wasLogin = this.isLogin();
+
+    try {
+
+      await this.loadData();
+      await this.saveLocally();
+
+      console.debug(`[account] Reloading account [OK] in ${Date.now() - now}ms`);
+
+      // Emit login event to subscribers
+      this.onLogin.next(this._data);
+      this.onChange.next(this._data);
+
+      // Display toast (without await, because not need to wait toast close event)
+      if (!opts || opts.showToast !== false) {
+        this.showToast({message: 'ACCOUNT.INFO.RELOADED', type: 'info'});
+      }
+
+      return this._data;
+    }
+    catch (error) {
+      // Cannot reload but was login: force to logout
+      if (wasLogin && !this.isLogin()) {
+        console.error(`[account] Reloading account failed. Will force logout...`, error);
+        await this.logout();
+      }
+      else {
+        throw error;
+      }
+    }
+  }
+
+  /**
+   * Create or update an user account, to the remote storage
+   *
+   * @param account
+   */
+  async save(account: Account): Promise<Account> {
+    if (!this._cache.pubkey) return Promise.reject('User not logged');
+    if (this._cache.pubkey !== account.pubkey) return Promise.reject('Not user account');
+
+    account = await this.saveRemotely(account, this._cache.keypair);
+
+    // Set defaults
+    account.avatar = account.avatar || (this.environment.baseUrl + DEFAULT_AVATAR_IMAGE);
+    this._cache.mainProfile = PersonUtils.getMainProfile(account.profiles);
+
+    this._data = account;
+    this._cache.loaded = true;
+
+    // Save locally (in storage)
+    await this.saveLocally();
+
+    // Send event
+    this.onLogin.next(this._data);
+    this.onChange.next(this._data);
+
+    return this._data;
+  }
+
+  async logout(): Promise<void> {
+
+    const hadAuthToken = this._cache.authToken && true;
+    const hadAuthBasic = this._cache.authBasic && true;
+    const pubkey = this._cache && this._cache.pubkey;
+
+    this.resetData();
+
+    if (!this.settings.hasOfflineFeature()) {
+
+      // Remove all data from the local storage
+      await Promise.all([
+        this.storage.remove(PUBKEY_STORAGE_KEY),
+        this.storage.remove(TOKEN_STORAGE_KEY),
+        this.storage.remove(ACCOUNT_STORAGE_KEY),
+        pubkey && this.storage.remove(ACCOUNT_STORAGE_KEY + '#' + pubkey) || Promise.resolve(),
+        this.storage.remove(SECKEY_STORAGE_KEY)
+      ]);
+    }
+
+    // Offline features enable: need to keep some data
+    else {
+      // Always remove only secret key
+      // But keep:
+      // - account by pubkey
+      // - auth token
+      await Promise.all([
+        this.storage.remove(PUBKEY_STORAGE_KEY),
+        this.storage.remove(ACCOUNT_STORAGE_KEY),
+        this.storage.remove(SECKEY_STORAGE_KEY)
+      ]);
+    }
+
+    // Clean page history, in local settings
+    await this.settings.clearPageHistory();
+
+    // Notify observers
+    this.onLogout.next();
+    if (hadAuthToken) this.onAuthTokenChange.next(undefined);
+    if (hadAuthBasic) this.onAuthBasicChange.next(undefined);
+    this.onChange.next(undefined);
+  }
+
+  /**
+   * Load a account
+   *
+   * @param opts
+   */
+  async load(opts?: {
+    offline?: boolean;
+    fetchPolicy?: FetchPolicy;
+  }): Promise<Account | undefined> {
+
+    const now = this._debug && Date.now();
+    if (this._debug) console.debug(`[account] Loading account...`);
+    let json: any;
+
+    // Load locally
+    const offline = this.network.offline
+      && (!opts || (opts.fetchPolicy !== 'network-only' && opts.fetchPolicy !== 'no-cache'))
+      || (opts && opts.offline === true);
+    if (offline) {
+      json = await this.storage.get(ACCOUNT_STORAGE_KEY);
+      json = json && (typeof json === 'string') && JSON.parse(json) || json;
+      json = json && this._cache.pubkey && (json.pubkey === this._cache.pubkey) && json || null;
+      if (!json && this._cache.pubkey) {
+        json = await this.storage.get(ACCOUNT_STORAGE_KEY + '#' + this._cache.pubkey);
+        json = json && (typeof json === 'string') && JSON.parse(json) || json;
+      }
+    }
+
+    // Load remotely
+    else {
+      const {data} = await this.graphql.query<{ data: any }>({
+        query: LoadQuery,
+        error: { code: ErrorCodes.LOAD_ACCOUNT_ERROR, message: 'ERROR.LOAD_ACCOUNT_ERROR' },
+        fetchPolicy: opts && opts.fetchPolicy || 'no-cache' || undefined
+      });
+      json = data;
+    }
+
+    if (json) {
+      const account = Account.fromObject(json);
+      if (this._debug) console.debug(`[account] Account loaded in ${Date.now() - now}ms`, account);
+       return account;
+    }
+    else {
+      console.warn(`[account] Account not found !`);
+      return undefined;
+    }
+  }
+
+  async generateToken(flags: number): Promise<string | undefined> {
+
+    const now = this._debug && Date.now();
+    if (this._debug) console.debug(`[account] Generate token...`);
+
+    const authChallenge = await this.getAuthChallenge();
+    // Add Flags to challenge
+    const challenge = `${authChallenge.challenge}:${flags}`;
+    const signature = await CryptoService.sign(challenge, this._cache.keypair);
+    const newToken = `${this._cache.pubkey}:${challenge}|${signature}`;
+
+    if (newToken) {
+      if (this._debug) console.debug(`[account] Token generated in ${Date.now() - now}ms`);
+    } else {
+      console.warn(`[account] Token generation failed !`);
+    }
+
+    return newToken;
+  }
+
+  /**
+   * Check if email is available for new account registration.
+   * Throw an error if not available
+   *
+   * @param email
+   */
+  async checkEmailAvailable(email: string): Promise<void> {
+    const isEmailExists = await this.isEmailExists(email);
+    if (isEmailExists) {
+      throw { code: ErrorCodes.EMAIL_ALREADY_REGISTERED, message: 'ERROR.EMAIL_ALREADY_REGISTERED' };
+    }
+  }
+
+  /**
+   * Check if email is exists in server.
+   *
+   * @param email
+   */
+  async isEmailExists(email: string): Promise<boolean> {
+
+    if (this._debug) console.debug('[account] Checking if {' + email + '} exists...');
+
+    const data = await this.graphql.query<{ isEmailExists: boolean }, IsEmailExistsVariables>({
+      query: IsEmailExistsQuery,
+      variables: {
+        email,
+        hash: undefined
+      }
+    });
+
+    if (this._debug) console.debug('[account] Email exist: ' + (data && data.isEmailExists));
+
+    return data && data.isEmailExists;
+  }
+
+  async sendConfirmationEmail(email: string, locale?: string): Promise<boolean> {
+
+    locale = locale || this.settings.locale;
+    console.debug('[account] Sending confirmation email to {' + email + '} with locale {' + locale + '}...');
+
+    return await this.graphql.mutate<boolean>({
+      mutation: SendConfirmEmailMutation,
+      variables: {
+        email,
+        locale
+      },
+      error: {
+        code: ErrorCodes.SENT_CONFIRMATION_EMAIL_FAILED,
+        message: 'ERROR.SENT_ACCOUNT_CONFIRMATION_EMAIL_FAILED'
+      }
+    });
+  }
+
+  async confirmEmail(email: string, code: string): Promise<boolean> {
+
+    console.debug('[account] Sending confirm request for email {' + email + '} with code {' + code + '}...');
+
+    const res = await this.graphql.mutate<{ confirmAccountEmail: boolean }>({
+      mutation: ConfirmEmailMutation,
+      variables: {
+        email,
+        code
+      },
+      error: {
+        code: ErrorCodes.CONFIRM_EMAIL_FAILED,
+        message: 'ERROR.CONFIRM_ACCOUNT_EMAIL_FAILED'
+      }
+    });
+    return res && res.confirmAccountEmail;
+  }
+
+  listenChanges(opts?: AccountWatchOptions): Subscription {
+    if (this._enableListenChanges) return new Subscription(); // Already started: skip
+
+    return this.startListenRemoteChanges(opts);
+  }
+
+  get additionalFields(): FormFieldDefinition[] {
+    return this._$additionalFields.getValue();
+  }
+
+  get $additionalFields(): Observable<FormFieldDefinition[]> {
+    return this._$additionalFields.asObservable();
+  }
+
+  getAdditionalField(key: string): FormFieldDefinition | undefined {
+    return this._$additionalFields.getValue().find(f => f.key === key);
+  }
+
+  registerAdditionalField(field: FormFieldDefinition) {
+    const values = this._$additionalFields.getValue();
+    if (!!values.find(f => f.key === field.key)) {
+      throw new Error(`Additional account field {key: ${field.key}} already define.`);
+    }
+    if (this._debug) console.debug(`[account] Found additional account's field {key: ${field.key}}`);
+    this._$additionalFields.next(values.concat(field));
+  }
+
+  get optionDefs(): FormFieldDefinition[] {
+    return this._optionDefs;
+  }
+
+  registerOption(def: FormFieldDefinition) {
+    if (this._optionDefs.findIndex(f => f.key === def.key) !== -1) {
+      throw new Error(`Additional option {${def.key}} already define.`);
+    }
+    if (this._debug) console.debug(`[account] Adding additional option {${def.key}}`, def);
+    this._optionDefs.push(def);
+  }
+
+  registerOptions(defs: FormFieldDefinition[]) {
+    (defs || []).forEach(def => this.registerOption(def));
+  }
+
+
+  /* -- protected method -- */
+
+  protected resetData() {
+    this.stopListenRemoteChanges();
+    this._cache.loaded = false;
+    this._cache.keypair = null;
+    this._cache.authToken = null;
+    this._cache.authBasic = null;
+    this._cache.pubkey = null;
+    this._cache.mainProfile = null;
+    this._cache.person = null;
+    this._cache.department = null;
+    this._data = new Account();
+  }
+
+  protected async loadData(opts?: {
+    offline?: boolean;
+    fetchPolicy?: FetchPolicy;
+  }): Promise<Account> {
+    if (!this._cache.pubkey) throw new Error('User not logged');
+
+    this._cache.loaded = false;
+
+    try {
+      const account = (await this.load(opts)) || new Account();
+
+      // Set defaults
+      account.avatar = account.avatar || (this.environment.baseUrl + DEFAULT_AVATAR_IMAGE);
+      account.settings = account.settings || new UserSettings();
+      account.settings.locale = account.settings.locale || this.settings.locale;
+      account.settings.latLongFormat = account.settings.latLongFormat || this.settings.latLongFormat || 'DDMM';
+      account.settings.content = account.settings.content || {};
+
+      // Read main profile
+      this._cache.mainProfile = PersonUtils.getMainProfile(account.profiles);
+
+      // Update, instead of replace it
+      if (this._data) {
+        this._data.fromObject(account);
+      }
+      else {
+        this._data = account;
+      }
+      this._cache.loaded = true;
+
+      // Apply settings, found in remote account
+      if (account.settings) {
+        const settings = {
+          ...this.settings.settings,
+          ...account.settings.asLocalSettings()
+        };
+        await this.settings.apply(settings);
+      }
+
+      return this._data;
+    }
+    catch (error) {
+      this.resetData();
+      if (error.code && error.message) throw error;
+
+      console.error(error);
+      throw {
+        code: ErrorCodes.LOAD_ACCOUNT_ERROR,
+        message: 'ERROR.LOAD_ACCOUNT_ERROR'
+      };
+    }
+  }
+
+  protected async listenSettings(): Promise<void>{
+    // When settings changed: save it remotely
+    this.registerSubscription(
+      this.settings.onChange
+        .pipe(
+          debounceTime(1000),
+          filter(() => this.isLogin() && this.network.online)
+        )
+        .subscribe(settings => this.saveLocalSettingsRemotely(settings)));
+  }
+
+  protected async restoreLocally(): Promise<Account | undefined> {
+
+    // Restore from storage
+    const values = await Promise.all([
+      this.storage.get(PUBKEY_STORAGE_KEY),
+      this.storage.get(TOKEN_STORAGE_KEY),
+      this.storage.get(SECKEY_STORAGE_KEY)
+    ]);
+    let pubkey = values[0];
+    let token = values[1];
+    const seckey = values[2];
+
+    // DEV only - auth by token
+    if (!this.environment.production && this.environment.defaultAuthValues?.token) {
+      token = token || this.environment.defaultAuthValues.token;
+      pubkey = pubkey || token?.split(':', 2)[0];
+    }
+
+    // Quit if no pubkey (not logged)
+    if (!pubkey) return;
+
+    // Quit if could not auth on pod
+    const canRemoteAuth = token || seckey || false;
+    if (!canRemoteAuth) return;
+
+    if (this._debug) console.debug(`[account] Account restoration...`);
+
+    this._cache.authToken = token;
+    this._cache.pubkey = pubkey;
+    this._cache.keypair = seckey && {
+      publicKey: Base58.decode(pubkey),
+      secretKey: Base58.decode(seckey)
+    } || null;
+
+    // Online mode: try to connect to pod
+    if (this.network.online) {
+      try {
+        await this.authenticate();
+        if (!this._cache.authToken && !this._cache.authBasic) throw new Error('Authentication failed');
+      }
+      catch (error) {
+        // Offline feature are enable: continue in offline mode
+        if (this.settings.hasOfflineFeature()) {
+          console.warn('[account] Unable to authenticate on pod: forcing offline mode');
+          this.network.setForceOffline(true, {showToast: false});
+          // Continue
+        }
+        // No offline features enable (=offline mode not allowed)
+        else {
+          console.error(error);
+          this.logout();
+          return;
+        }
+
+      }
+    }
+
+    // Get the account, from pubkey
+    let jsonAccount = await this.storage.get(`${ACCOUNT_STORAGE_KEY}#${pubkey}`);
+    if (!jsonAccount) {
+      // Try using the old storage key
+      const accountStr = await this.storage.get(ACCOUNT_STORAGE_KEY);
+      jsonAccount = accountStr && ((typeof accountStr === 'string') && JSON.parse(jsonAccount) || accountStr);
+    }
+
+    // Invalid account: do not use it
+    if (!jsonAccount || jsonAccount.pubkey !== pubkey) {
+
+      // DEV only: create a fake account with given username
+      if (!this.environment.production && this.environment.defaultAuthValues.username) {
+        const username = this.environment.defaultAuthValues.username;
+        jsonAccount = {pubkey, username, firstName: username, lastName: username};
+      }
+      else {
+        return;
+      }
+    }
+
+    // Transform to entity
+    const account = Account.fromObject(jsonAccount);
+
+    // Update data
+    this._data = account;
+    this._cache.mainProfile = PersonUtils.getMainProfile(account.profiles);
+    this._cache.loaded = true;
+
+    // Emit event
+    this.onLogin.next(this._data);
+    this.onChange.next(this._data);
+
+    if (this._enableListenChanges) this.startListenRemoteChanges();
+
+    if (this._debug) console.debug(`[account] Account restoration [OK] {pubkey: ${pubkey.substr(0, 8)}}, {profile: ${this._cache.mainProfile}}`);
+
+    return account;
+  }
+
+  /**
+   * Save account into the local storage
+   */
+  protected async saveLocally(): Promise<void> {
+    if (!this._cache.pubkey) throw new Error('User not logged');
+
+    if (this._debug) console.debug(`[account] Saving account {${this._cache.pubkey.substring(0, 6)}} in local storage...`);
+
+    // Convert account to json
+    const json = this._data.asObject({keepTypename: true});
+    const seckey = this._cache.keypair && this._cache.keypair.secretKey && Base58.encode(this._cache.keypair.secretKey) || null;
+
+    // Convert avatar URL to dataUrl (e.g. 'data:image/png:<base64 content>')
+    const hasAvatarUrl = json.avatar && !json.avatar.endsWith(DEFAULT_AVATAR_IMAGE) &&
+      (json.avatar.startsWith('http://') || (json.avatar.startsWith('https://')));
+    if (hasAvatarUrl && this.network.online) {
+      await this.file.getImage(json.avatar, {
+        thumbnail: true,
+        outputType: 'dataUrl'
+      })
+        .then(dataUrl => {
+          if (dataUrl && this._debug) console.debug('[account] Image fetched: ', dataUrl.substring(0, 50));
+
+          // TODO: make sure to display Base64 image in the menu top header
+          //jsonAccount.avatar = dataUrl;
+        })
+        .catch(err => {
+          console.error(`[account] Error while fetching image: ${json.avatar}: ${err}`);
+        });
+    }
+
+    try {
+      await Promise.all([
+        this.storage.set(PUBKEY_STORAGE_KEY, this._cache.pubkey),
+        this.storage.set(TOKEN_STORAGE_KEY, this._cache.authToken),
+        this.storage.set(`${ACCOUNT_STORAGE_KEY}#${this._cache.pubkey}`, json),
+        // Secret key (optional)
+        seckey && this.storage.set(SECKEY_STORAGE_KEY, seckey) || this.storage.remove(SECKEY_STORAGE_KEY),
+        // Remove old storage key
+        this.storage.remove(ACCOUNT_STORAGE_KEY)
+      ]);
+
+      if (this._debug) console.debug('[account] Account saved in local storage');
+    }
+    catch(err) {
+      console.error('[account] Error while saving account locally: ' + (err && err.message || err), err);
+    }
+  }
+
+   async saveLocalSettingsRemotely(source: LocalSettings){
+     if (!source || !this.isLogin() || source.accountInheritance === false) return; // Skip
+     const account = this.account;
+
+     // Merge local settings into account's settings
+     const settings = UserSettings.fromObject(account.settings) || new UserSettings();
+     const changed = settings.merge(source, ['locale', 'latLongFormat', 'properties']);
+
+     if (!changed) return; // Skip if unchanged
+
+     // Save remotely
+     this.account.settings = settings;
+     await this.saveSettingsRemotely(settings);
+  }
+
+  /**
+   * Create or update an user account
+   *
+   * @param account
+   * @param keyPair
+   */
+  protected async saveRemotely(account: Account, keyPair?: Keypair): Promise<Account> {
+    account.pubkey = account.pubkey || (keyPair && Base58.encode(keyPair.publicKey));
+    if (!account.pubkey) throw new Error('Missing account pubkey');
+
+    const now = this._debug && Date.now();
+    if (this._debug) console.debug(`[account] Saving account remotely...`);
+
+    const isNew = isNil(account.id);
+
+    // If this is an update: get existing account's updateDate, to avoid 'version error' when saving
+    if (!isNew) {
+      const existingAccount = await this.load({ fetchPolicy: 'network-only' });
+      if (!existingAccount || !existingAccount.updateDate) {
+        throw { code: ErrorCodes.ACCOUNT_NOT_EXISTS, message: 'ERROR.ACCOUNT_NOT_EXISTS' };
+      }
+      this.copyIdAndUpdateDate(existingAccount, account);
+    }
+
+    // Merging settings
+    account.settings.content['pages'] = this.settings.settings.pages;
+    account.settings.content['pageHistory'] = this.settings.settings.pageHistory;
+
+    // Convert to json
+    const json = account.asObject(MINIFY_ENTITY_FOR_POD);
+
+    // User not allow to change his profiles
+    delete json.profiles;
+
+    // Execute mutation
+    const { data } = await this.graphql.mutate<{ data: Account }>({
+      mutation: isNew ? AccountMutations.create : AccountMutations.save,
+      variables: { data: json },
+      error: {
+        code: ErrorCodes.SAVE_ACCOUNT_ERROR,
+        message: 'ERROR.SAVE_ACCOUNT_ERROR'
+      }
+    });
+
+    // Copy update properties
+    this.copyIdAndUpdateDate(data, account);
+
+    if (this._debug) console.debug(`[account] Account remotely saved in ${Date.now() - now}ms`);
+
+    return account;
+  }
+
+  /**
+   * Create or update user settings
+   *
+   * @param settings
+   */
+  protected async saveSettingsRemotely(settings: UserSettings) {
+
+    const now = this._debug && Date.now();
+    if (this._debug) console.debug(`[account] Saving settings remotely...`);
+
+    const json = settings.asObject(MINIFY_ENTITY_FOR_POD);
+
+    // Execute mutation
+    const { data } = await this.graphql.mutate<{ data: UserSettings }>({
+      mutation: AccountMutations.saveSettings,
+      variables: { data: json },
+      error: {
+        code: ErrorCodes.SAVE_SETTINGS_ERROR,
+        message: 'ERROR.SAVE_SETTINGS_ERROR'
+      }
+    });
+
+    // Copy update properties
+    this.copyIdAndUpdateDateSettings(data, settings);
+
+    if (this._debug) console.debug(`[account] Settings remotely saved in ${Date.now() - now}ms`);
+
+    // Save into account
+    if (this.account) this.account.settings = settings;
+  }
+
+  protected async authenticateAndGetToken(token?: string, counter?: number): Promise<string> {
+    if (!this._cache.pubkey) throw new Error('User not logged');
+
+    if (!counter) console.info('[account] Authentication on pod...');
+
+    if (counter > 4) {
+      if (this._debug) console.debug(`[account] Failed to authentication on pod (after ${counter} attempts)`);
+      throw { code: ErrorCodes.AUTH_SERVER_ERROR, message: 'ERROR.AUTH_SERVER_ERROR' };
+    }
+
+    // Check if valid
+    if (token) {
+      const data = await this.graphql.query<{ authenticate: boolean }, { token: string }>({
+        query: AuthQuery,
+        variables: {
+          token
+        },
+        error: {
+          code: ErrorCodes.UNAUTHORIZED,
+          message: 'ERROR.UNAUTHORIZED'
+        },
+        fetchPolicy: 'no-cache'
+      });
+
+      // Token is accepted by the server
+      if (data && data.authenticate) {
+        // Store the token
+        this.onAuthTokenChange.next(token);
+
+        console.info(`[account] Authentication on pod [OK] {pubkey: '${this._cache.pubkey.substr(0, 8)}'}`);
+        return token; // return the token
+      }
+
+      // Continue (will retry with another challenge)
+    }
+
+    // Generate a new token
+    const authChallenge = await this.getAuthChallenge();
+    // TODO: check server pubkey as a valid certificate
+
+    // Do the challenge
+    const signature = await CryptoService.sign(authChallenge.challenge, this._cache.keypair);
+    const newToken = `${this._cache.pubkey}:${authChallenge.challenge}|${signature}`;
+
+    // iterate with the new token
+    return await this.authenticateAndGetToken(newToken, (counter || 1) + 1 /* increment */);
+  }
+
+  protected async getAuthChallenge(): Promise<IAuthChallenge> {
+    const challengeError = {
+      code: ErrorCodes.AUTH_CHALLENGE_ERROR,
+      message: 'ERROR.AUTH_CHALLENGE_ERROR'
+    };
+    const { authChallenge} = await this.graphql.query<{
+      authChallenge: IAuthChallenge;
+    }>({
+      query: AuthChallengeQuery,
+      variables: {},
+      error: challengeError,
+      fetchPolicy: 'network-only'
+    });
+
+    // Check challenge
+    if (!authChallenge) throw challengeError; // Should never occur
+
+    // Check server signature
+    const signatureOK = await CryptoService.verify(
+      authChallenge.challenge,
+      authChallenge.signature,
+      authChallenge.pubkey
+    );
+    if (!signatureOK) {
+      console.warn('FIXME: Bad peer signature on auth challenge !', authChallenge);
+    }
+    return authChallenge;
+  }
+
+  protected startListenRemoteChanges(opts?: AccountWatchOptions): Subscription {
+    if (this._listenChangesSubscription) this.stopListenRemoteChanges(); // Stop previous subscription
+    if (this.network.offline) return new Subscription(); // Offline: skip
+
+    this._listenChangesSubscription = this.watchChanges(opts)
+      .subscribe({
+        next: (data) => {
+          console.debug(`[account] Remote update detected at ${data.updateDate}`);
+          this.reload();
+        },
+        error: (err) => {
+          if (err && +err.code === ServerErrorCodes.NOT_FOUND) {
+            console.info('[account] [WS] Account not exists anymore: force user to logout...', err);
+            this.logout();
+          } else if (err && +err.code === ServerErrorCodes.UNAUTHORIZED) {
+            console.info('[account] [WS] Account not authorized: force user to logout...', err);
+            this.logout();
+          } else {
+            console.warn('[account] [WS] Received error:', err);
+          }
+        }
+      });
+    this._listenChangesSubscription.add(() => {
+      console.debug(`[account] Stop watching remote changes`);
+      this._listenChangesSubscription = null;
+    });
+    return this._listenChangesSubscription;
+  }
+
+  protected stopListenRemoteChanges() {
+    this._listenChangesSubscription?.unsubscribe();
+  }
+
+  protected watchChanges(opts?: AccountWatchOptions): Observable<Account> {
+
+    if (!this.started) {
+      // Wait service ready, then loop
+      return from(this.ready())
+        .pipe(switchMap(() => this.watchChanges(opts)));
+    }
+
+    if (!this._cache.pubkey) throw new Error('Not logged in');
+    if (this.network.offline) throw new Error('Cannot watch account changes: network is offline.');
+
+    const variables = {
+      interval: toNumber(opts && opts.intervalInSeconds, this._listenIntervalInSeconds)
+    };
+
+    console.debug(`[account] Watching remote changes, every ${variables.interval}s`);
+
+    return this.graphql.subscribe<{data: any}>({
+      query: AccountSubscriptions.listenChanges,
+      variables,
+      error: {
+        code: ErrorCodes.SUBSCRIBE_ACCOUNT_ERROR,
+        message: 'ERROR.ACCOUNT.SUBSCRIBE_ERROR'
+      }
+    }).pipe(
+        map(({data}) => data),
+        // Keep only if newer
+        filter(data => {
+          const currentUpdateDate: Moment = fromDateISOString(this._data?.updateDate);
+          const remoteUpdateDate: Moment = fromDateISOString(data?.updateDate);
+          return (remoteUpdateDate && (!currentUpdateDate || !remoteUpdateDate.isSame(currentUpdateDate, 'millisecond')));
+        })
+      );
+  }
+
+  protected copyIdAndUpdateDate(source: Account | undefined, target: Account) {
+    if (!source) return;
+
+    target.id = source.id || target.id;
+    target.updateDate = source.updateDate || target.updateDate;
+
+    this.copyIdAndUpdateDateSettings(source.settings, target.settings);
+    this.copyIdAndUpdateDateToken(source.tokens, target.tokens);
+  }
+
+  protected copyIdAndUpdateDateSettings(source: UserSettings | undefined, target: UserSettings) {
+    if (!source) return;
+
+    target.id = source.id || target.id;
+    target.updateDate = source.updateDate || target.updateDate;
+  }
+
+  protected copyIdAndUpdateDateToken(sources: UserToken[] | undefined, targets: UserToken[]) {
+    if (isEmptyArray(sources)) return;
+
+    sources.forEach(source => {
+      const target = targets.find(value => value.id === source.id || value.name === source.name);
+      if (target) {
+        target.id = source.id || target.id;
+        target.creationDate = source.creationDate || target.creationDate;
+        target.updateDate = source.updateDate || target.updateDate;
+        target.token = undefined;
+      }
+    });
+  }
+
+  protected showToast<T = any>(opts: ShowToastOptions): Promise<OverlayEventDetail<T>> {
+    return Toasts.show(this.toastController, this.translate, opts);
+  }
+}