Merge branch 'main' into auth/pm-8111/browser-refresh-login-component

2025-12-30 15:13:32 +00:00 · 2024-09-24 21:58:22 -05:00
parent 74767b02b5 e6c3de9f47
commit 22eb2aac97
543 changed files with 31609 additions and 7636 deletions
--- a/libs/auth/src/angular/anon-layout/anon-layout-wrapper.component.ts
+++ b/libs/auth/src/angular/anon-layout/anon-layout-wrapper.component.ts
@@ -1,4 +1,4 @@
-import { Component, OnDestroy, OnInit } from "@angular/core";
+import { ChangeDetectorRef, Component, OnDestroy, OnInit } from "@angular/core";
 import { ActivatedRoute, Data, NavigationEnd, Router, RouterModule } from "@angular/router";
 import { Subject, filter, switchMap, takeUntil, tap } from "rxjs";

@@ -40,6 +40,7 @@ export class AnonLayoutWrapperComponent implements OnInit, OnDestroy {
    private route: ActivatedRoute,
    private i18nService: I18nService,
    private anonLayoutWrapperDataService: AnonLayoutWrapperDataService,
+    private changeDetectorRef: ChangeDetectorRef,
  ) {}

  ngOnInit(): void {
@@ -122,6 +123,10 @@ export class AnonLayoutWrapperComponent implements OnInit, OnDestroy {
    if (data.showReadonlyHostname != null) {
      this.showReadonlyHostname = data.showReadonlyHostname;
    }
+
+    // Manually fire change detection to avoid ExpressionChangedAfterItHasBeenCheckedError
+    // when setting the page data from a service
+    this.changeDetectorRef.detectChanges();
  }

  private resetPageData() {
--- a/libs/auth/src/angular/fingerprint-dialog/fingerprint-dialog.component.html
+++ b/libs/auth/src/angular/fingerprint-dialog/fingerprint-dialog.component.html
@@ -1,8 +1,10 @@
 <bit-simple-dialog>
  <i bitDialogIcon class="bwi bwi-info-circle tw-text-3xl" aria-hidden="true"></i>
-  <span bitDialogTitle>{{ "yourAccountsFingerprint" | i18n }}:</span>
+  <span bitDialogTitle
+    ><strong>{{ "yourAccountsFingerprint" | i18n }}:</strong></span
+  >
  <span bitDialogContent>
-    <strong>{{ data.fingerprint.join("-") }}</strong>
+    {{ data.fingerprint.join("-") }}
  </span>
  <ng-container bitDialogFooter>
    <a
--- a/libs/auth/src/angular/vault-timeout-input/vault-timeout-input.component.html
+++ b/libs/auth/src/angular/vault-timeout-input/vault-timeout-input.component.html
@@ -1,29 +1,47 @@
-<div [formGroup]="form">
-  <bit-form-field>
-    <bit-label>{{ "vaultTimeout" | i18n }}</bit-label>
+<div [formGroup]="form" class="tw-mb-4">
+  <bit-form-field [disableMargin]="!showCustom">
+    <bit-label>{{ "vaultTimeout1" | i18n }}</bit-label>
    <bit-select formControlName="vaultTimeout">
      <bit-option
-        *ngFor="let o of vaultTimeoutOptions"
+        *ngFor="let o of filteredVaultTimeoutOptions"
        [value]="o.value"
        [label]="o.name"
      ></bit-option>
    </bit-select>
-    <bit-hint class="tw-text-sm">{{
-      ((canLockVault$ | async) ? "vaultTimeoutDesc" : "vaultTimeoutLogoutDesc") | i18n
-    }}</bit-hint>
  </bit-form-field>
  <div class="tw-grid tw-grid-cols-12 tw-gap-4" *ngIf="showCustom" formGroupName="custom">
-    <bit-form-field class="tw-col-span-6">
-      <bit-label>{{ "customVaultTimeout" | i18n }}</bit-label>
-      <input bitInput type="number" min="0" formControlName="hours" />
-      <bit-hint>{{ "hours" | i18n }}</bit-hint>
+    <bit-form-field class="tw-col-span-6" disableMargin>
+      <input
+        bitInput
+        type="number"
+        min="0"
+        formControlName="hours"
+        aria-labelledby="maximum-error"
+      />
+      <bit-label>{{ "hours" | i18n }}</bit-label>
    </bit-form-field>
-    <bit-form-field class="tw-col-span-6 tw-self-end">
-      <input bitInput type="number" min="0" name="minutes" formControlName="minutes" />
-      <bit-hint>{{ "minutes" | i18n }}</bit-hint>
+    <bit-form-field class="tw-col-span-6 tw-self-end" disableMargin>
+      <input
+        bitInput
+        type="number"
+        min="0"
+        name="minutes"
+        formControlName="minutes"
+        aria-labelledby="maximum-error"
+      />
+      <bit-label>{{ "minutes" | i18n }}</bit-label>
    </bit-form-field>
  </div>
-  <small *ngIf="!exceedsMinimumTimout" class="tw-text-danger">
+  <bit-hint *ngIf="vaultTimeoutPolicy != null && !exceedsMaximumTimeout">
+    {{ "vaultTimeoutPolicyInEffect1" | i18n: vaultTimeoutPolicyHours : vaultTimeoutPolicyMinutes }}
+  </bit-hint>
+  <small *ngIf="!exceedsMinimumTimeout" class="tw-text-danger">
    <i class="bwi bwi-error" aria-hidden="true"></i> {{ "vaultCustomTimeoutMinimum" | i18n }}
  </small>
+  <small class="tw-text-danger" *ngIf="exceedsMaximumTimeout" id="maximum-error">
+    <i class="bwi bwi-error" aria-hidden="true"></i>
+    {{
+      "vaultTimeoutPolicyMaximumError" | i18n: vaultTimeoutPolicyHours : vaultTimeoutPolicyMinutes
+    }}
+  </small>
 </div>
--- a/libs/auth/src/angular/vault-timeout-input/vault-timeout-input.component.ts
+++ b/libs/auth/src/angular/vault-timeout-input/vault-timeout-input.component.ts
@@ -55,16 +55,41 @@ type VaultTimeoutFormValue = VaultTimeoutForm["value"];
 export class VaultTimeoutInputComponent
  implements ControlValueAccessor, Validator, OnInit, OnDestroy, OnChanges
 {
+  protected readonly VaultTimeoutAction = VaultTimeoutAction;
+
  get showCustom() {
    return this.form.get("vaultTimeout").value === VaultTimeoutInputComponent.CUSTOM_VALUE;
  }

-  get exceedsMinimumTimout(): boolean {
+  get exceedsMinimumTimeout(): boolean {
    return (
      !this.showCustom || this.customTimeInMinutes() > VaultTimeoutInputComponent.MIN_CUSTOM_MINUTES
    );
  }

+  get exceedsMaximumTimeout(): boolean {
+    return (
+      this.showCustom &&
+      this.customTimeInMinutes() >
+        this.vaultTimeoutPolicyMinutes + 60 * this.vaultTimeoutPolicyHours
+    );
+  }
+
+  get filteredVaultTimeoutOptions(): VaultTimeoutOption[] {
+    // by policy max value
+    if (this.vaultTimeoutPolicy == null || this.vaultTimeoutPolicy.data == null) {
+      return this.vaultTimeoutOptions;
+    }
+
+    return this.vaultTimeoutOptions.filter((option) => {
+      if (typeof option.value === "number") {
+        return option.value <= this.vaultTimeoutPolicy.data.minutes;
+      }
+
+      return false;
+    });
+  }
+
  static CUSTOM_VALUE = -100;
  static MIN_CUSTOM_MINUTES = 0;

@@ -77,6 +102,7 @@ export class VaultTimeoutInputComponent
  });

  @Input() vaultTimeoutOptions: VaultTimeoutOption[];
+
  vaultTimeoutPolicy: Policy;
  vaultTimeoutPolicyHours: number;
  vaultTimeoutPolicyMinutes: number;
@@ -207,7 +233,7 @@ export class VaultTimeoutInputComponent
      return { policyError: true };
    }

-    if (!this.exceedsMinimumTimout) {
+    if (!this.exceedsMinimumTimeout) {
      return { minTimeoutError: true };
    }

--- a/libs/auth/src/common/login-strategies/auth-request-login.strategy.spec.ts
+++ b/libs/auth/src/common/login-strategies/auth-request-login.strategy.spec.ts
@@ -12,6 +12,7 @@ import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abs
 import { VaultTimeoutAction } from "@bitwarden/common/enums/vault-timeout-action.enum";
 import { AppIdService } from "@bitwarden/common/platform/abstractions/app-id.service";
 import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
+import { EncryptService } from "@bitwarden/common/platform/abstractions/encrypt.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
@@ -37,6 +38,7 @@ describe("AuthRequestLoginStrategy", () => {
  let cache: AuthRequestLoginStrategyData;

  let cryptoService: MockProxy<CryptoService>;
+  let encryptService: MockProxy<EncryptService>;
  let apiService: MockProxy<ApiService>;
  let tokenService: MockProxy<TokenService>;
  let appIdService: MockProxy<AppIdService>;
@@ -101,6 +103,7 @@ describe("AuthRequestLoginStrategy", () => {
      accountService,
      masterPasswordService,
      cryptoService,
+      encryptService,
      apiService,
      tokenService,
      appIdService,
--- a/libs/auth/src/common/login-strategies/login.strategy.spec.ts
+++ b/libs/auth/src/common/login-strategies/login.strategy.spec.ts
@@ -22,6 +22,7 @@ import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abs
 import { VaultTimeoutAction } from "@bitwarden/common/enums/vault-timeout-action.enum";
 import { AppIdService } from "@bitwarden/common/platform/abstractions/app-id.service";
 import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
+import { EncryptService } from "@bitwarden/common/platform/abstractions/encrypt.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
@@ -104,6 +105,7 @@ describe("LoginStrategy", () => {

  let loginStrategyService: MockProxy<LoginStrategyServiceAbstraction>;
  let cryptoService: MockProxy<CryptoService>;
+  let encryptService: MockProxy<EncryptService>;
  let apiService: MockProxy<ApiService>;
  let tokenService: MockProxy<TokenService>;
  let appIdService: MockProxy<AppIdService>;
@@ -128,6 +130,7 @@ describe("LoginStrategy", () => {

    loginStrategyService = mock<LoginStrategyServiceAbstraction>();
    cryptoService = mock<CryptoService>();
+    encryptService = mock<EncryptService>();
    apiService = mock<ApiService>();
    tokenService = mock<TokenService>();
    appIdService = mock<AppIdService>();
@@ -156,6 +159,7 @@ describe("LoginStrategy", () => {
      accountService,
      masterPasswordService,
      cryptoService,
+      encryptService,
      apiService,
      tokenService,
      appIdService,
@@ -467,6 +471,7 @@ describe("LoginStrategy", () => {
        accountService,
        masterPasswordService,
        cryptoService,
+        encryptService,
        apiService,
        tokenService,
        appIdService,
--- a/libs/auth/src/common/login-strategies/login.strategy.ts
+++ b/libs/auth/src/common/login-strategies/login.strategy.ts
@@ -26,6 +26,7 @@ import { VaultTimeoutAction } from "@bitwarden/common/enums/vault-timeout-action
 import { KeysRequest } from "@bitwarden/common/models/request/keys.request";
 import { AppIdService } from "@bitwarden/common/platform/abstractions/app-id.service";
 import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
+import { EncryptService } from "@bitwarden/common/platform/abstractions/encrypt.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
@@ -66,6 +67,7 @@ export abstract class LoginStrategy {
    protected accountService: AccountService,
    protected masterPasswordService: InternalMasterPasswordServiceAbstraction,
    protected cryptoService: CryptoService,
+    protected encryptService: EncryptService,
    protected apiService: ApiService,
    protected tokenService: TokenService,
    protected appIdService: AppIdService,
--- a/libs/auth/src/common/login-strategies/password-login.strategy.spec.ts
+++ b/libs/auth/src/common/login-strategies/password-login.strategy.spec.ts
@@ -16,6 +16,7 @@ import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abs
 import { VaultTimeoutAction } from "@bitwarden/common/enums/vault-timeout-action.enum";
 import { AppIdService } from "@bitwarden/common/platform/abstractions/app-id.service";
 import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
+import { EncryptService } from "@bitwarden/common/platform/abstractions/encrypt.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
@@ -63,6 +64,7 @@ describe("PasswordLoginStrategy", () => {

  let loginStrategyService: MockProxy<LoginStrategyServiceAbstraction>;
  let cryptoService: MockProxy<CryptoService>;
+  let encryptService: MockProxy<EncryptService>;
  let apiService: MockProxy<ApiService>;
  let tokenService: MockProxy<TokenService>;
  let appIdService: MockProxy<AppIdService>;
@@ -88,6 +90,7 @@ describe("PasswordLoginStrategy", () => {

    loginStrategyService = mock<LoginStrategyServiceAbstraction>();
    cryptoService = mock<CryptoService>();
+    encryptService = mock<EncryptService>();
    apiService = mock<ApiService>();
    tokenService = mock<TokenService>();
    appIdService = mock<AppIdService>();
@@ -127,6 +130,7 @@ describe("PasswordLoginStrategy", () => {
      accountService,
      masterPasswordService,
      cryptoService,
+      encryptService,
      apiService,
      tokenService,
      appIdService,
--- a/libs/auth/src/common/login-strategies/sso-login.strategy.spec.ts
+++ b/libs/auth/src/common/login-strategies/sso-login.strategy.spec.ts
@@ -17,6 +17,7 @@ import { VaultTimeoutAction } from "@bitwarden/common/enums/vault-timeout-action
 import { ErrorResponse } from "@bitwarden/common/models/response/error.response";
 import { AppIdService } from "@bitwarden/common/platform/abstractions/app-id.service";
 import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
+import { EncryptService } from "@bitwarden/common/platform/abstractions/encrypt.service";
 import { I18nService } from "@bitwarden/common/platform/abstractions/i18n.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
@@ -44,6 +45,7 @@ describe("SsoLoginStrategy", () => {
  let masterPasswordService: FakeMasterPasswordService;

  let cryptoService: MockProxy<CryptoService>;
+  let encryptService: MockProxy<EncryptService>;
  let apiService: MockProxy<ApiService>;
  let tokenService: MockProxy<TokenService>;
  let appIdService: MockProxy<AppIdService>;
@@ -78,6 +80,7 @@ describe("SsoLoginStrategy", () => {
    masterPasswordService = new FakeMasterPasswordService();

    cryptoService = mock<CryptoService>();
+    encryptService = mock<EncryptService>();
    apiService = mock<ApiService>();
    tokenService = mock<TokenService>();
    appIdService = mock<AppIdService>();
@@ -125,6 +128,7 @@ describe("SsoLoginStrategy", () => {
      accountService,
      masterPasswordService,
      cryptoService,
+      encryptService,
      apiService,
      tokenService,
      appIdService,
--- a/libs/auth/src/common/login-strategies/user-api-login.strategy.spec.ts
+++ b/libs/auth/src/common/login-strategies/user-api-login.strategy.spec.ts
@@ -11,6 +11,7 @@ import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abs
 import { VaultTimeoutAction } from "@bitwarden/common/enums/vault-timeout-action.enum";
 import { AppIdService } from "@bitwarden/common/platform/abstractions/app-id.service";
 import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
+import { EncryptService } from "@bitwarden/common/platform/abstractions/encrypt.service";
 import {
  Environment,
  EnvironmentService,
@@ -39,6 +40,7 @@ describe("UserApiLoginStrategy", () => {
  let masterPasswordService: FakeMasterPasswordService;

  let cryptoService: MockProxy<CryptoService>;
+  let encryptService: MockProxy<EncryptService>;
  let apiService: MockProxy<ApiService>;
  let tokenService: MockProxy<TokenService>;
  let appIdService: MockProxy<AppIdService>;
@@ -99,6 +101,7 @@ describe("UserApiLoginStrategy", () => {
      accountService,
      masterPasswordService,
      cryptoService,
+      encryptService,
      apiService,
      tokenService,
      appIdService,
--- a/libs/auth/src/common/login-strategies/webauthn-login.strategy.spec.ts
+++ b/libs/auth/src/common/login-strategies/webauthn-login.strategy.spec.ts
@@ -14,6 +14,7 @@ import { BillingAccountProfileStateService } from "@bitwarden/common/billing/abs
 import { VaultTimeoutAction } from "@bitwarden/common/enums/vault-timeout-action.enum";
 import { AppIdService } from "@bitwarden/common/platform/abstractions/app-id.service";
 import { CryptoService } from "@bitwarden/common/platform/abstractions/crypto.service";
+import { EncryptService } from "@bitwarden/common/platform/abstractions/encrypt.service";
 import { LogService } from "@bitwarden/common/platform/abstractions/log.service";
 import { MessagingService } from "@bitwarden/common/platform/abstractions/messaging.service";
 import { PlatformUtilsService } from "@bitwarden/common/platform/abstractions/platform-utils.service";
@@ -37,6 +38,7 @@ describe("WebAuthnLoginStrategy", () => {
  let masterPasswordService: FakeMasterPasswordService;

  let cryptoService!: MockProxy<CryptoService>;
+  let encryptService!: MockProxy<EncryptService>;
  let apiService!: MockProxy<ApiService>;
  let tokenService!: MockProxy<TokenService>;
  let appIdService!: MockProxy<AppIdService>;
@@ -79,6 +81,7 @@ describe("WebAuthnLoginStrategy", () => {
    masterPasswordService = new FakeMasterPasswordService();

    cryptoService = mock<CryptoService>();
+    encryptService = mock<EncryptService>();
    apiService = mock<ApiService>();
    tokenService = mock<TokenService>();
    appIdService = mock<AppIdService>();
@@ -103,6 +106,7 @@ describe("WebAuthnLoginStrategy", () => {
      accountService,
      masterPasswordService,
      cryptoService,
+      encryptService,
      apiService,
      tokenService,
      appIdService,
@@ -221,7 +225,7 @@ describe("WebAuthnLoginStrategy", () => {
    const mockUserKeyArray: Uint8Array = randomBytes(32);
    const mockUserKey = new SymmetricCryptoKey(mockUserKeyArray) as UserKey;

-    cryptoService.decryptToBytes.mockResolvedValue(mockPrfPrivateKey);
+    encryptService.decryptToBytes.mockResolvedValue(mockPrfPrivateKey);
    cryptoService.rsaDecrypt.mockResolvedValue(mockUserKeyArray);

    // Act
@@ -235,8 +239,8 @@ describe("WebAuthnLoginStrategy", () => {
      userId,
    );

-    expect(cryptoService.decryptToBytes).toHaveBeenCalledTimes(1);
-    expect(cryptoService.decryptToBytes).toHaveBeenCalledWith(
+    expect(encryptService.decryptToBytes).toHaveBeenCalledTimes(1);
+    expect(encryptService.decryptToBytes).toHaveBeenCalledWith(
      idTokenResponse.userDecryptionOptions.webAuthnPrfOption.encryptedPrivateKey,
      webAuthnCredentials.prfKey,
    );
@@ -268,7 +272,7 @@ describe("WebAuthnLoginStrategy", () => {
    await webAuthnLoginStrategy.logIn(webAuthnCredentials);

    // Assert
-    expect(cryptoService.decryptToBytes).not.toHaveBeenCalled();
+    expect(encryptService.decryptToBytes).not.toHaveBeenCalled();
    expect(cryptoService.rsaDecrypt).not.toHaveBeenCalled();
    expect(cryptoService.setUserKey).not.toHaveBeenCalled();
  });
@@ -303,7 +307,7 @@ describe("WebAuthnLoginStrategy", () => {

    apiService.postIdentityToken.mockResolvedValue(idTokenResponse);

-    cryptoService.decryptToBytes.mockResolvedValue(null);
+    encryptService.decryptToBytes.mockResolvedValue(null);

    // Act
    await webAuthnLoginStrategy.logIn(webAuthnCredentials);
--- a/libs/auth/src/common/login-strategies/webauthn-login.strategy.ts
+++ b/libs/auth/src/common/login-strategies/webauthn-login.strategy.ts
@@ -80,7 +80,7 @@ export class WebAuthnLoginStrategy extends LoginStrategy {
      }

      // decrypt prf encrypted private key
-      const privateKey = await this.cryptoService.decryptToBytes(
+      const privateKey = await this.encryptService.decryptToBytes(
        webAuthnPrfOption.encryptedPrivateKey,
        credentials.prfKey,
      );
--- a/libs/auth/src/common/services/accounts/lock.service.ts
+++ b/libs/auth/src/common/services/accounts/lock.service.ts
@@ -0,0 +1,49 @@
+import { combineLatest, firstValueFrom, map } from "rxjs";
+
+import { VaultTimeoutService } from "@bitwarden/common/abstractions/vault-timeout/vault-timeout.service";
+import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { UserId } from "@bitwarden/common/types/guid";
+
+export abstract class LockService {
+  /**
+   * Locks all accounts.
+   */
+  abstract lockAll(): Promise<void>;
+}
+
+export class DefaultLockService implements LockService {
+  constructor(
+    private readonly accountService: AccountService,
+    private readonly vaultTimeoutService: VaultTimeoutService,
+  ) {}
+
+  async lockAll() {
+    const accounts = await firstValueFrom(
+      combineLatest([this.accountService.activeAccount$, this.accountService.accounts$]).pipe(
+        map(([activeAccount, accounts]) => {
+          const otherAccounts = Object.keys(accounts) as UserId[];
+
+          if (activeAccount == null) {
+            return { activeAccount: null, otherAccounts: otherAccounts };
+          }
+
+          return {
+            activeAccount: activeAccount.id,
+            otherAccounts: otherAccounts.filter((accountId) => accountId !== activeAccount.id),
+          };
+        }),
+      ),
+    );
+
+    for (const otherAccount of accounts.otherAccounts) {
+      await this.vaultTimeoutService.lock(otherAccount);
+    }
+
+    // Do the active account last in case we ever try to route the user on lock
+    // that way this whole operation will be complete before that routing
+    // could take place.
+    if (accounts.activeAccount != null) {
+      await this.vaultTimeoutService.lock(accounts.activeAccount);
+    }
+  }
+}
--- a/libs/auth/src/common/services/accounts/lock.services.spec.ts
+++ b/libs/auth/src/common/services/accounts/lock.services.spec.ts
@@ -0,0 +1,43 @@
+import { mock } from "jest-mock-extended";
+
+import { VaultTimeoutService } from "@bitwarden/common/abstractions/vault-timeout/vault-timeout.service";
+import { mockAccountServiceWith } from "@bitwarden/common/spec";
+import { UserId } from "@bitwarden/common/types/guid";
+
+import { DefaultLockService } from "./lock.service";
+
+describe("DefaultLockService", () => {
+  const mockUser1 = "user1" as UserId;
+  const mockUser2 = "user2" as UserId;
+  const mockUser3 = "user3" as UserId;
+
+  const accountService = mockAccountServiceWith(mockUser1);
+  const vaultTimeoutService = mock<VaultTimeoutService>();
+
+  const sut = new DefaultLockService(accountService, vaultTimeoutService);
+  describe("lockAll", () => {
+    it("locks the active account last", async () => {
+      await accountService.addAccount(mockUser2, {
+        name: "name2",
+        email: "email2@example.com",
+        emailVerified: false,
+      });
+
+      await accountService.addAccount(mockUser3, {
+        name: "name3",
+        email: "email3@example.com",
+        emailVerified: false,
+      });
+
+      await sut.lockAll();
+
+      expect(vaultTimeoutService.lock).toHaveBeenCalledTimes(3);
+      // Non-Active users should be called first
+      expect(vaultTimeoutService.lock).toHaveBeenNthCalledWith(1, mockUser2);
+      expect(vaultTimeoutService.lock).toHaveBeenNthCalledWith(2, mockUser3);
+
+      // Active user should be called last
+      expect(vaultTimeoutService.lock).toHaveBeenNthCalledWith(3, mockUser1);
+    });
+  });
+});
--- a/libs/auth/src/common/services/index.ts
+++ b/libs/auth/src/common/services/index.ts
@@ -4,3 +4,4 @@ export * from "./login-strategies/login-strategy.service";
 export * from "./user-decryption-options/user-decryption-options.service";
 export * from "./auth-request/auth-request.service";
 export * from "./register-route.service";
+export * from "./accounts/lock.service";
--- a/libs/auth/src/common/services/login-strategies/login-strategy.service.ts
+++ b/libs/auth/src/common/services/login-strategies/login-strategy.service.ts
@@ -317,6 +317,7 @@ export class LoginStrategyService implements LoginStrategyServiceAbstraction {
      this.accountService,
      this.masterPasswordService,
      this.cryptoService,
+      this.encryptService,
      this.apiService,
      this.tokenService,
      this.appIdService,