From 21fc56457dea97584ae0e47e20a323dd5797ee35 Mon Sep 17 00:00:00 2001
From: Jake Fink <jfink@bitwarden.com>
Date: Fri, 13 Oct 2023 13:41:52 -0400
Subject: [PATCH] fix isLocked logic and add comments (#2802)

---
 src/Core/Services/VaultTimeoutService.cs | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/src/Core/Services/VaultTimeoutService.cs b/src/Core/Services/VaultTimeoutService.cs
index 50b3a411b..b5c985095 100644
--- a/src/Core/Services/VaultTimeoutService.cs
+++ b/src/Core/Services/VaultTimeoutService.cs
@@ -3,7 +3,6 @@ using System.Threading.Tasks;
 using Bit.Core.Abstractions;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
-using Bit.Core.Models.Domain;
 
 namespace Bit.Core.Services
 {
@@ -56,8 +55,15 @@ namespace Bit.Core.Services
 
         public long? DelayLockAndLogoutMs { get; set; }
 
+        /// <summary>
+        /// Determine if the current or provided account is locked.
+        /// </summary>
+        /// <param name="userId">
+        /// Optional specified user, must be provided if not the current account.
+        /// </param>
         public async Task<bool> IsLockedAsync(string userId = null)
         {
+            // If biometrics are used, we can use the flag to determine locked state
             var biometricSet = await IsBiometricLockSetAsync(userId);
             if (biometricSet && await _stateService.GetBiometricLockedAsync(userId))
             {
@@ -68,18 +74,21 @@ namespace Bit.Core.Services
             {
                 try
                 {
+                    // Filter out accounts without auto key
                     if (!await _cryptoService.HasAutoUnlockKeyAsync(userId))
                     {
                         return true;
                     }
+                    // Inactive accounts with an auto key aren't locked, but we shouldn't set user key
                     if (userId != null && await _stateService.GetActiveUserIdAsync() != userId)
                     {
-                        await _cryptoService.SetUserKeyAsync(await _cryptoService.GetAutoUnlockKeyAsync(userId),
-                            userId);
+                        return false;
                     }
+                    await _cryptoService.SetUserKeyAsync(await _cryptoService.GetAutoUnlockKeyAsync(userId), userId);
                 }
                 catch (LegacyUserException)
                 {
+                    // Legacy users must migrate on web vault before login
                     await LogOutAsync(false, userId);
                 }