[PM-6688] Use AccountService as account source (#8893)

* Use account service to track accounts and active account

* Remove state service active account Observables.

* Add email verified to account service

* Do not store account info on logged out accounts

* Add account activity tracking to account service

* Use last account activity from account service

* migrate or replicate account service data

* Add `AccountActivityService` that handles storing account last active data

* Move active and next active user to account service

* Remove authenticated accounts from state object

* Fold account activity into account service

* Fix builds

* Fix desktop app switch

* Fix logging out non active user

* Expand helper to handle new authenticated accounts location

* Prefer view observable to tons of async pipes

* Fix `npm run test:types`

* Correct user activity sorting test

* Be more precise about log out messaging

* Fix dev compare errors

All stored values are serializable, the next step wasn't necessary and was erroring on some types that lack `toString`.

* If the account in unlocked on load of lock component, navigate away from lock screen

* Handle no users case for auth service statuses

* Specify account to switch to

* Filter active account out of inactive accounts

* Prefer constructor init

* Improve comparator

* Use helper methods internally

* Fixup component tests

* Clarify name

* Ensure accounts object has only valid userIds

* Capitalize const values

* Prefer descriptive, single-responsibility guards

* Update libs/common/src/state-migrations/migrate.ts

Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>

* Fix merge

* Add user Id validation

activity for undefined was being set, which was resulting in requests for the auth status of `"undefined"` (string) userId, due to key enumeration. These changes stop that at both locations, as well as account add for good measure.

---------

Co-authored-by: Justin Baur <19896123+justindbaur@users.noreply.github.com>

libs/common/src/auth/abstractions/account.service.ts

@@ -8,18 +8,44 @@ import { UserId } from "../../types/guid";
  */
 export type AccountInfo = {
   email: string;
+  emailVerified: boolean;
   name: string | undefined;
 };
 
 export function accountInfoEqual(a: AccountInfo, b: AccountInfo) {
-  return a?.email === b?.email && a?.name === b?.name;
+  if (a == null && b == null) {
+    return true;
+  }
+
+  if (a == null || b == null) {
+    return false;
+  }
+
+  const keys = new Set([...Object.keys(a), ...Object.keys(b)]) as Set<keyof AccountInfo>;
+  for (const key of keys) {
+    if (a[key] !== b[key]) {
+      return false;
+    }
+  }
+  return true;
 }
 
 export abstract class AccountService {
   accounts$: Observable<Record<UserId, AccountInfo>>;
   activeAccount$: Observable<{ id: UserId | undefined } & AccountInfo>;
+
+  /**
+   * Observable of the last activity time for each account.
+   */
+  accountActivity$: Observable<Record<UserId, Date>>;
+  /** Account list in order of descending recency */
+  sortedUserIds$: Observable<UserId[]>;
+  /** Next account that is not the current active account */
+  nextUpAccount$: Observable<{ id: UserId } & AccountInfo>;
   /**
    * Updates the `accounts$` observable with the new account data.
+   *
+   * @note Also sets the last active date of the account to `now`.
    * @param userId
    * @param accountData
    */
@@ -36,11 +62,30 @@ export abstract class AccountService {
    * @param email
    */
   abstract setAccountEmail(userId: UserId, email: string): Promise<void>;
+  /**
+   * updates the `accounts$` observable with the new email verification status for the account.
+   * @param userId
+   * @param emailVerified
+   */
+  abstract setAccountEmailVerified(userId: UserId, emailVerified: boolean): Promise<void>;
   /**
    * Updates the `activeAccount$` observable with the new active account.
    * @param userId
    */
   abstract switchAccount(userId: UserId): Promise<void>;
+  /**
+   * Cleans personal information for the given account from the `accounts$` observable. Does not remove the userId from the observable.
+   *
+   * @note Also sets the last active date of the account to `null`.
+   * @param userId
+   */
+  abstract clean(userId: UserId): Promise<void>;
+  /**
+   * Updates the given user's last activity time.
+   * @param userId
+   * @param lastActivity
+   */
+  abstract setAccountActivity(userId: UserId, lastActivity: Date): Promise<void>;
 }
 
 export abstract class InternalAccountService extends AccountService {

libs/common/src/auth/services/account.service.spec.ts

@@ -1,3 +1,8 @@
+/**
+ * need to update test environment so structuredClone works appropriately
+ * @jest-environment ../../libs/shared/test.environment.ts
+ */
+
 import { MockProxy, mock } from "jest-mock-extended";
 import { firstValueFrom } from "rxjs";
 
@@ -6,15 +11,57 @@ import { FakeGlobalStateProvider } from "../../../spec/fake-state-provider";
 import { trackEmissions } from "../../../spec/utils";
 import { LogService } from "../../platform/abstractions/log.service";
 import { MessagingService } from "../../platform/abstractions/messaging.service";
+import { Utils } from "../../platform/misc/utils";
 import { UserId } from "../../types/guid";
-import { AccountInfo } from "../abstractions/account.service";
+import { AccountInfo, accountInfoEqual } from "../abstractions/account.service";
 
 import {
   ACCOUNT_ACCOUNTS,
   ACCOUNT_ACTIVE_ACCOUNT_ID,
+  ACCOUNT_ACTIVITY,
   AccountServiceImplementation,
 } from "./account.service";
 
+describe("accountInfoEqual", () => {
+  const accountInfo: AccountInfo = { name: "name", email: "email", emailVerified: true };
+
+  it("compares nulls", () => {
+    expect(accountInfoEqual(null, null)).toBe(true);
+    expect(accountInfoEqual(null, accountInfo)).toBe(false);
+    expect(accountInfoEqual(accountInfo, null)).toBe(false);
+  });
+
+  it("compares all keys, not just those defined in AccountInfo", () => {
+    const different = { ...accountInfo, extra: "extra" };
+
+    expect(accountInfoEqual(accountInfo, different)).toBe(false);
+  });
+
+  it("compares name", () => {
+    const same = { ...accountInfo };
+    const different = { ...accountInfo, name: "name2" };
+
+    expect(accountInfoEqual(accountInfo, same)).toBe(true);
+    expect(accountInfoEqual(accountInfo, different)).toBe(false);
+  });
+
+  it("compares email", () => {
+    const same = { ...accountInfo };
+    const different = { ...accountInfo, email: "email2" };
+
+    expect(accountInfoEqual(accountInfo, same)).toBe(true);
+    expect(accountInfoEqual(accountInfo, different)).toBe(false);
+  });
+
+  it("compares emailVerified", () => {
+    const same = { ...accountInfo };
+    const different = { ...accountInfo, emailVerified: false };
+
+    expect(accountInfoEqual(accountInfo, same)).toBe(true);
+    expect(accountInfoEqual(accountInfo, different)).toBe(false);
+  });
+});
+
 describe("accountService", () => {
   let messagingService: MockProxy<MessagingService>;
   let logService: MockProxy<LogService>;
@@ -22,8 +69,8 @@ describe("accountService", () => {
   let sut: AccountServiceImplementation;
   let accountsState: FakeGlobalState<Record<UserId, AccountInfo>>;
   let activeAccountIdState: FakeGlobalState<UserId>;
-  const userId = "userId" as UserId;
-  const userInfo = { email: "email", name: "name" };
+  const userId = Utils.newGuid() as UserId;
+  const userInfo = { email: "email", name: "name", emailVerified: true };
 
   beforeEach(() => {
     messagingService = mock();
@@ -86,6 +133,25 @@ describe("accountService", () => {
 
       expect(currentValue).toEqual({ [userId]: userInfo });
     });
+
+    it("sets the last active date of the account to now", async () => {
+      const state = globalStateProvider.getFake(ACCOUNT_ACTIVITY);
+      state.stateSubject.next({});
+      await sut.addAccount(userId, userInfo);
+
+      expect(state.nextMock).toHaveBeenCalledWith({ [userId]: expect.any(Date) });
+    });
+
+    it.each([null, undefined, 123, "not a guid"])(
+      "does not set last active if the userId is not a valid guid",
+      async (userId) => {
+        const state = globalStateProvider.getFake(ACCOUNT_ACTIVITY);
+        state.stateSubject.next({});
+        await expect(sut.addAccount(userId as UserId, userInfo)).rejects.toThrow(
+          "userId is required",
+        );
+      },
+    );
   });
 
   describe("setAccountName", () => {
@@ -134,6 +200,58 @@ describe("accountService", () => {
     });
   });
 
+  describe("setAccountEmailVerified", () => {
+    const initialState = { [userId]: userInfo };
+    initialState[userId].emailVerified = false;
+    beforeEach(() => {
+      accountsState.stateSubject.next(initialState);
+    });
+
+    it("should update the account", async () => {
+      await sut.setAccountEmailVerified(userId, true);
+      const currentState = await firstValueFrom(accountsState.state$);
+
+      expect(currentState).toEqual({
+        [userId]: { ...userInfo, emailVerified: true },
+      });
+    });
+
+    it("should not update if the email is the same", async () => {
+      await sut.setAccountEmailVerified(userId, false);
+      const currentState = await firstValueFrom(accountsState.state$);
+
+      expect(currentState).toEqual(initialState);
+    });
+  });
+
+  describe("clean", () => {
+    beforeEach(() => {
+      accountsState.stateSubject.next({ [userId]: userInfo });
+    });
+
+    it("removes account info of the given user", async () => {
+      await sut.clean(userId);
+      const currentState = await firstValueFrom(accountsState.state$);
+
+      expect(currentState).toEqual({
+        [userId]: {
+          email: "",
+          emailVerified: false,
+          name: undefined,
+        },
+      });
+    });
+
+    it("removes account activity of the given user", async () => {
+      const state = globalStateProvider.getFake(ACCOUNT_ACTIVITY);
+      state.stateSubject.next({ [userId]: new Date() });
+
+      await sut.clean(userId);
+
+      expect(state.nextMock).toHaveBeenCalledWith({});
+    });
+  });
+
   describe("switchAccount", () => {
     beforeEach(() => {
       accountsState.stateSubject.next({ [userId]: userInfo });
@@ -152,4 +270,83 @@ describe("accountService", () => {
       expect(sut.switchAccount("unknown" as UserId)).rejects.toThrowError("Account does not exist");
     });
   });
+
+  describe("account activity", () => {
+    let state: FakeGlobalState<Record<UserId, Date>>;
+
+    beforeEach(() => {
+      state = globalStateProvider.getFake(ACCOUNT_ACTIVITY);
+    });
+    describe("accountActivity$", () => {
+      it("returns the account activity state", async () => {
+        state.stateSubject.next({
+          [toId("user1")]: new Date(1),
+          [toId("user2")]: new Date(2),
+        });
+
+        await expect(firstValueFrom(sut.accountActivity$)).resolves.toEqual({
+          [toId("user1")]: new Date(1),
+          [toId("user2")]: new Date(2),
+        });
+      });
+
+      it("returns an empty object when account activity is null", async () => {
+        state.stateSubject.next(null);
+
+        await expect(firstValueFrom(sut.accountActivity$)).resolves.toEqual({});
+      });
+    });
+
+    describe("sortedUserIds$", () => {
+      it("returns the sorted user ids by date with most recent first", async () => {
+        state.stateSubject.next({
+          [toId("user1")]: new Date(3),
+          [toId("user2")]: new Date(2),
+          [toId("user3")]: new Date(1),
+        });
+
+        await expect(firstValueFrom(sut.sortedUserIds$)).resolves.toEqual([
+          "user1" as UserId,
+          "user2" as UserId,
+          "user3" as UserId,
+        ]);
+      });
+
+      it("returns an empty array when account activity is null", async () => {
+        state.stateSubject.next(null);
+
+        await expect(firstValueFrom(sut.sortedUserIds$)).resolves.toEqual([]);
+      });
+    });
+
+    describe("setAccountActivity", () => {
+      const userId = Utils.newGuid() as UserId;
+      it("sets the account activity", async () => {
+        await sut.setAccountActivity(userId, new Date(1));
+
+        expect(state.nextMock).toHaveBeenCalledWith({ [userId]: new Date(1) });
+      });
+
+      it("does not update if the activity is the same", async () => {
+        state.stateSubject.next({ [userId]: new Date(1) });
+
+        await sut.setAccountActivity(userId, new Date(1));
+
+        expect(state.nextMock).not.toHaveBeenCalled();
+      });
+
+      it.each([null, undefined, 123, "not a guid"])(
+        "does not set last active if the userId is not a valid guid",
+        async (userId) => {
+          await sut.setAccountActivity(userId as UserId, new Date(1));
+
+          expect(state.nextMock).not.toHaveBeenCalled();
+        },
+      );
+    });
+  });
 });
+
+function toId(userId: string) {
+  return userId as UserId;
+}

libs/common/src/auth/services/account.service.ts

@@ -1,4 +1,4 @@
-import { Subject, combineLatestWith, map, distinctUntilChanged, shareReplay } from "rxjs";
+import { combineLatestWith, map, distinctUntilChanged, shareReplay, combineLatest } from "rxjs";
 
 import {
   AccountInfo,
@@ -7,8 +7,9 @@ import {
 } from "../../auth/abstractions/account.service";
 import { LogService } from "../../platform/abstractions/log.service";
 import { MessagingService } from "../../platform/abstractions/messaging.service";
+import { Utils } from "../../platform/misc/utils";
 import {
-  ACCOUNT_MEMORY,
+  ACCOUNT_DISK,
   GlobalState,
   GlobalStateProvider,
   KeyDefinition,
@@ -16,25 +17,36 @@ import {
 import { UserId } from "../../types/guid";
 
 export const ACCOUNT_ACCOUNTS = KeyDefinition.record<AccountInfo, UserId>(
-  ACCOUNT_MEMORY,
+  ACCOUNT_DISK,
   "accounts",
   {
     deserializer: (accountInfo) => accountInfo,
   },
 );
 
-export const ACCOUNT_ACTIVE_ACCOUNT_ID = new KeyDefinition(ACCOUNT_MEMORY, "activeAccountId", {
+export const ACCOUNT_ACTIVE_ACCOUNT_ID = new KeyDefinition(ACCOUNT_DISK, "activeAccountId", {
   deserializer: (id: UserId) => id,
 });
 
+export const ACCOUNT_ACTIVITY = KeyDefinition.record<Date, UserId>(ACCOUNT_DISK, "activity", {
+  deserializer: (activity) => new Date(activity),
+});
+
+const LOGGED_OUT_INFO: AccountInfo = {
+  email: "",
+  emailVerified: false,
+  name: undefined,
+};
+
 export class AccountServiceImplementation implements InternalAccountService {
-  private lock = new Subject<UserId>();
-  private logout = new Subject<UserId>();
   private accountsState: GlobalState<Record<UserId, AccountInfo>>;
   private activeAccountIdState: GlobalState<UserId | undefined>;
 
   accounts$;
   activeAccount$;
+  accountActivity$;
+  sortedUserIds$;
+  nextUpAccount$;
 
   constructor(
     private messagingService: MessagingService,
@@ -53,14 +65,40 @@ export class AccountServiceImplementation implements InternalAccountService {
       distinctUntilChanged((a, b) => a?.id === b?.id && accountInfoEqual(a, b)),
       shareReplay({ bufferSize: 1, refCount: false }),
     );
+    this.accountActivity$ = this.globalStateProvider
+      .get(ACCOUNT_ACTIVITY)
+      .state$.pipe(map((activity) => activity ?? {}));
+    this.sortedUserIds$ = this.accountActivity$.pipe(
+      map((activity) => {
+        return Object.entries(activity)
+          .map(([userId, lastActive]: [UserId, Date]) => ({ userId, lastActive }))
+          .sort((a, b) => b.lastActive.getTime() - a.lastActive.getTime()) // later dates first
+          .map((a) => a.userId);
+      }),
+    );
+    this.nextUpAccount$ = combineLatest([
+      this.accounts$,
+      this.activeAccount$,
+      this.sortedUserIds$,
+    ]).pipe(
+      map(([accounts, activeAccount, sortedUserIds]) => {
+        const nextId = sortedUserIds.find((id) => id !== activeAccount?.id && accounts[id] != null);
+        return nextId ? { id: nextId, ...accounts[nextId] } : null;
+      }),
+    );
   }
 
   async addAccount(userId: UserId, accountData: AccountInfo): Promise<void> {
+    if (!Utils.isGuid(userId)) {
+      throw new Error("userId is required");
+    }
+
     await this.accountsState.update((accounts) => {
       accounts ||= {};
       accounts[userId] = accountData;
       return accounts;
     });
+    await this.setAccountActivity(userId, new Date());
   }
 
   async setAccountName(userId: UserId, name: string): Promise<void> {
@@ -71,6 +109,15 @@ export class AccountServiceImplementation implements InternalAccountService {
     await this.setAccountInfo(userId, { email });
   }
 
+  async setAccountEmailVerified(userId: UserId, emailVerified: boolean): Promise<void> {
+    await this.setAccountInfo(userId, { emailVerified });
+  }
+
+  async clean(userId: UserId) {
+    await this.setAccountInfo(userId, LOGGED_OUT_INFO);
+    await this.removeAccountActivity(userId);
+  }
+
   async switchAccount(userId: UserId): Promise<void> {
     await this.activeAccountIdState.update(
       (_, accounts) => {
@@ -94,6 +141,37 @@ export class AccountServiceImplementation implements InternalAccountService {
     );
   }
 
+  async setAccountActivity(userId: UserId, lastActivity: Date): Promise<void> {
+    if (!Utils.isGuid(userId)) {
+      // only store for valid userIds
+      return;
+    }
+
+    await this.globalStateProvider.get(ACCOUNT_ACTIVITY).update(
+      (activity) => {
+        activity ||= {};
+        activity[userId] = lastActivity;
+        return activity;
+      },
+      {
+        shouldUpdate: (oldActivity) => oldActivity?.[userId]?.getTime() !== lastActivity?.getTime(),
+      },
+    );
+  }
+
+  async removeAccountActivity(userId: UserId): Promise<void> {
+    await this.globalStateProvider.get(ACCOUNT_ACTIVITY).update(
+      (activity) => {
+        if (activity == null) {
+          return activity;
+        }
+        delete activity[userId];
+        return activity;
+      },
+      { shouldUpdate: (oldActivity) => oldActivity?.[userId] != null },
+    );
+  }
+
   // TODO: update to use our own account status settings. Requires inverting direction of state service accounts flow
   async delete(): Promise<void> {
     try {

libs/common/src/auth/services/auth.service.spec.ts

@@ -56,6 +56,7 @@ describe("AuthService", () => {
       status: AuthenticationStatus.Unlocked,
       id: userId,
       email: "email",
+      emailVerified: false,
       name: "name",
     };
 
@@ -109,6 +110,7 @@ describe("AuthService", () => {
         status: AuthenticationStatus.Unlocked,
         id: Utils.newGuid() as UserId,
         email: "email2",
+        emailVerified: false,
         name: "name2",
       };
 
@@ -126,7 +128,11 @@ describe("AuthService", () => {
     it("requests auth status for all known users", async () => {
       const userId2 = Utils.newGuid() as UserId;
 
-      await accountService.addAccount(userId2, { email: "email2", name: "name2" });
+      await accountService.addAccount(userId2, {
+        email: "email2",
+        emailVerified: false,
+        name: "name2",
+      });
 
       const mockFn = jest.fn().mockReturnValue(of(AuthenticationStatus.Locked));
       sut.authStatusFor$ = mockFn;
@@ -147,11 +153,14 @@ describe("AuthService", () => {
       cryptoService.getInMemoryUserKeyFor$.mockReturnValue(of(undefined));
     });
 
-    it("emits LoggedOut when userId is null", async () => {
-      expect(await firstValueFrom(sut.authStatusFor$(null))).toEqual(
-        AuthenticationStatus.LoggedOut,
-      );
-    });
+    it.each([null, undefined, "not a userId"])(
+      "emits LoggedOut when userId is invalid (%s)",
+      async () => {
+        expect(await firstValueFrom(sut.authStatusFor$(null))).toEqual(
+          AuthenticationStatus.LoggedOut,
+        );
+      },
+    );
 
     it("emits LoggedOut when there is no access token", async () => {
       tokenService.hasAccessToken$.mockReturnValue(of(false));

libs/common/src/auth/services/auth.service.ts

@@ -2,6 +2,7 @@ import {
   Observable,
   combineLatest,
   distinctUntilChanged,
+  firstValueFrom,
   map,
   of,
   shareReplay,
@@ -12,6 +13,7 @@ import { ApiService } from "../../abstractions/api.service";
 import { CryptoService } from "../../platform/abstractions/crypto.service";
 import { MessagingService } from "../../platform/abstractions/messaging.service";
 import { StateService } from "../../platform/abstractions/state.service";
+import { Utils } from "../../platform/misc/utils";
 import { UserId } from "../../types/guid";
 import { AccountService } from "../abstractions/account.service";
 import { AuthService as AuthServiceAbstraction } from "../abstractions/auth.service";
@@ -39,13 +41,16 @@ export class AuthService implements AuthServiceAbstraction {
 
     this.authStatuses$ = this.accountService.accounts$.pipe(
       map((accounts) => Object.keys(accounts) as UserId[]),
-      switchMap((entries) =>
-        combineLatest(
+      switchMap((entries) => {
+        if (entries.length === 0) {
+          return of([] as { userId: UserId; status: AuthenticationStatus }[]);
+        }
+        return combineLatest(
           entries.map((userId) =>
             this.authStatusFor$(userId).pipe(map((status) => ({ userId, status }))),
           ),
-        ),
-      ),
+        );
+      }),
       map((statuses) => {
         return statuses.reduce(
           (acc, { userId, status }) => {
@@ -59,7 +64,7 @@ export class AuthService implements AuthServiceAbstraction {
   }
 
   authStatusFor$(userId: UserId): Observable<AuthenticationStatus> {
-    if (userId == null) {
+    if (!Utils.isGuid(userId)) {
       return of(AuthenticationStatus.LoggedOut);
     }
 
@@ -84,17 +89,8 @@ export class AuthService implements AuthServiceAbstraction {
   }
 
   async getAuthStatus(userId?: string): Promise<AuthenticationStatus> {
-    // If we don't have an access token or userId, we're logged out
-    const isAuthenticated = await this.stateService.getIsAuthenticated({ userId: userId });
-    if (!isAuthenticated) {
-      return AuthenticationStatus.LoggedOut;
-    }
-
-    // Note: since we aggresively set the auto user key to memory if it exists on app init (see InitService)
-    // we only need to check if the user key is in memory.
-    const hasUserKey = await this.cryptoService.hasUserKeyInMemory(userId as UserId);
-
-    return hasUserKey ? AuthenticationStatus.Unlocked : AuthenticationStatus.Locked;
+    userId ??= await firstValueFrom(this.accountService.activeAccount$.pipe(map((a) => a?.id)));
+    return await firstValueFrom(this.authStatusFor$(userId as UserId));
   }
 
   logOut(callback: () => void) {

libs/common/src/auth/services/password-reset-enrollment.service.implementation.spec.ts

@@ -90,6 +90,7 @@ describe("PasswordResetEnrollmentServiceImplementation", () => {
       const user1AccountInfo: AccountInfo = {
         name: "Test User 1",
         email: "test1@email.com",
+        emailVerified: true,
       };
       activeAccountSubject.next(Object.assign(user1AccountInfo, { id: "userId" as UserId }));
 

libs/common/src/platform/abstractions/state.service.ts

@@ -25,11 +25,10 @@ export type InitOptions = {
 
 export abstract class StateService<T extends Account = Account> {
   accounts$: Observable<{ [userId: string]: T }>;
-  activeAccount$: Observable<string>;
 
   addAccount: (account: T) => Promise<void>;
-  setActiveUser: (userId: string) => Promise<void>;
-  clean: (options?: StorageOptions) => Promise<UserId>;
+  clearDecryptedData: (userId: UserId) => Promise<void>;
+  clean: (options?: StorageOptions) => Promise<void>;
   init: (initOptions?: InitOptions) => Promise<void>;
 
   /**
@@ -122,8 +121,6 @@ export abstract class StateService<T extends Account = Account> {
   setDuckDuckGoSharedKey: (value: string, options?: StorageOptions) => Promise<void>;
   getEmail: (options?: StorageOptions) => Promise<string>;
   setEmail: (value: string, options?: StorageOptions) => Promise<void>;
-  getEmailVerified: (options?: StorageOptions) => Promise<boolean>;
-  setEmailVerified: (value: boolean, options?: StorageOptions) => Promise<void>;
   getEnableBrowserIntegration: (options?: StorageOptions) => Promise<boolean>;
   setEnableBrowserIntegration: (value: boolean, options?: StorageOptions) => Promise<void>;
   getEnableBrowserIntegrationFingerprint: (options?: StorageOptions) => Promise<boolean>;
@@ -147,8 +144,6 @@ export abstract class StateService<T extends Account = Account> {
    */
   setEncryptedPinProtected: (value: string, options?: StorageOptions) => Promise<void>;
   getIsAuthenticated: (options?: StorageOptions) => Promise<boolean>;
-  getLastActive: (options?: StorageOptions) => Promise<number>;
-  setLastActive: (value: number, options?: StorageOptions) => Promise<void>;
   getLastSync: (options?: StorageOptions) => Promise<string>;
   setLastSync: (value: string, options?: StorageOptions) => Promise<void>;
   getMinimizeOnCopyToClipboard: (options?: StorageOptions) => Promise<boolean>;
@@ -180,5 +175,4 @@ export abstract class StateService<T extends Account = Account> {
   setVaultTimeout: (value: number, options?: StorageOptions) => Promise<void>;
   getVaultTimeoutAction: (options?: StorageOptions) => Promise<string>;
   setVaultTimeoutAction: (value: string, options?: StorageOptions) => Promise<void>;
-  nextUpActiveUser: () => Promise<UserId>;
 }

libs/common/src/platform/misc/utils.spec.ts

@@ -3,6 +3,33 @@ import * as path from "path";
 import { Utils } from "./utils";
 
 describe("Utils Service", () => {
+  describe("isGuid", () => {
+    it("is false when null", () => {
+      expect(Utils.isGuid(null)).toBe(false);
+    });
+
+    it("is false when undefined", () => {
+      expect(Utils.isGuid(undefined)).toBe(false);
+    });
+
+    it("is false when empty", () => {
+      expect(Utils.isGuid("")).toBe(false);
+    });
+
+    it("is false when not a string", () => {
+      expect(Utils.isGuid(123 as any)).toBe(false);
+    });
+
+    it("is false when not a guid", () => {
+      expect(Utils.isGuid("not a guid")).toBe(false);
+    });
+
+    it("is true when a guid", () => {
+      // we use a limited guid scope in which all zeroes is invalid
+      expect(Utils.isGuid("00000000-0000-1000-8000-000000000000")).toBe(true);
+    });
+  });
+
   describe("getDomain", () => {
     it("should fail for invalid urls", () => {
       expect(Utils.getDomain(null)).toBeNull();

libs/common/src/platform/models/domain/state.ts

@@ -9,9 +9,6 @@ export class State<
 > {
   accounts: { [userId: string]: TAccount } = {};
   globals: TGlobalState;
-  activeUserId: string;
-  authenticatedAccounts: string[] = [];
-  accountActivity: { [userId: string]: number } = {};
 
   constructor(globals: TGlobalState) {
     this.globals = globals;

libs/common/src/platform/services/default-environment.service.spec.ts

@@ -31,10 +31,12 @@ describe("EnvironmentService", () => {
       [testUser]: {
         name: "name",
         email: "email",
+        emailVerified: false,
       },
       [alternateTestUser]: {
         name: "name",
         email: "email",
+        emailVerified: false,
       },
     });
     stateProvider = new FakeStateProvider(accountService);
@@ -47,6 +49,7 @@ describe("EnvironmentService", () => {
       id: userId,
       email: "test@example.com",
       name: `Test Name ${userId}`,
+      emailVerified: false,
     });
     await awaitAsync();
   };

libs/common/src/platform/services/state.service.ts

@@ -1,4 +1,4 @@
-import { BehaviorSubject } from "rxjs";
+import { BehaviorSubject, firstValueFrom, map } from "rxjs";
 import { Jsonify, JsonValue } from "type-fest";
 
 import { AccountService } from "../../auth/abstractions/account.service";
@@ -33,10 +33,7 @@ const keys = {
   state: "state",
   stateVersion: "stateVersion",
   global: "global",
-  authenticatedAccounts: "authenticatedAccounts",
-  activeUserId: "activeUserId",
   tempAccountSettings: "tempAccountSettings", // used to hold account specific settings (i.e clear clipboard) between initial migration and first account authentication
-  accountActivity: "accountActivity",
 };
 
 const partialKeys = {
@@ -58,9 +55,6 @@ export class StateService<
   protected accountsSubject = new BehaviorSubject<{ [userId: string]: TAccount }>({});
   accounts$ = this.accountsSubject.asObservable();
 
-  protected activeAccountSubject = new BehaviorSubject<string | null>(null);
-  activeAccount$ = this.activeAccountSubject.asObservable();
-
   private hasBeenInited = false;
   protected isRecoveredSession = false;
 
@@ -112,36 +106,16 @@ export class StateService<
     }
 
     // Get all likely authenticated accounts
-    const authenticatedAccounts = (
-      (await this.storageService.get<string[]>(keys.authenticatedAccounts)) ?? []
-    ).filter((account) => account != null);
+    const authenticatedAccounts = await firstValueFrom(
+      this.accountService.accounts$.pipe(map((accounts) => Object.keys(accounts))),
+    );
 
     await this.updateState(async (state) => {
       for (const i in authenticatedAccounts) {
         state = await this.syncAccountFromDisk(authenticatedAccounts[i]);
       }
 
-      // After all individual accounts have been added
-      state.authenticatedAccounts = authenticatedAccounts;
-
-      const storedActiveUser = await this.storageService.get<string>(keys.activeUserId);
-      if (storedActiveUser != null) {
-        state.activeUserId = storedActiveUser;
-      }
       await this.pushAccounts();
-      this.activeAccountSubject.next(state.activeUserId);
-      // TODO: Temporary update to avoid routing all account status changes through account service for now.
-      // account service tracks logged out accounts, but State service does not, so we need to add the active account
-      // if it's not in the accounts list.
-      if (state.activeUserId != null && this.accountsSubject.value[state.activeUserId] == null) {
-        const activeDiskAccount = await this.getAccountFromDisk({ userId: state.activeUserId });
-        await this.accountService.addAccount(state.activeUserId as UserId, {
-          name: activeDiskAccount.profile.name,
-          email: activeDiskAccount.profile.email,
-        });
-      }
-      await this.accountService.switchAccount(state.activeUserId as UserId);
-      // End TODO
 
       return state;
     });
@@ -161,61 +135,25 @@ export class StateService<
       return state;
     });
 
-    // TODO: Temporary update to avoid routing all account status changes through account service for now.
-    // The determination of state should be handled by the various services that control those values.
-    await this.accountService.addAccount(userId as UserId, {
-      name: diskAccount.profile.name,
-      email: diskAccount.profile.email,
-    });
-
     return state;
   }
 
   async addAccount(account: TAccount) {
     await this.environmentService.seedUserEnvironment(account.profile.userId as UserId);
     await this.updateState(async (state) => {
-      state.authenticatedAccounts.push(account.profile.userId);
-      await this.storageService.save(keys.authenticatedAccounts, state.authenticatedAccounts);
       state.accounts[account.profile.userId] = account;
       return state;
     });
     await this.scaffoldNewAccountStorage(account);
-    await this.setLastActive(new Date().getTime(), { userId: account.profile.userId });
-    // TODO: Temporary update to avoid routing all account status changes through account service for now.
-    await this.accountService.addAccount(account.profile.userId as UserId, {
-      name: account.profile.name,
-      email: account.profile.email,
-    });
-    await this.setActiveUser(account.profile.userId);
   }
 
-  async setActiveUser(userId: string): Promise<void> {
-    await this.clearDecryptedDataForActiveUser();
-    await this.updateState(async (state) => {
-      state.activeUserId = userId;
-      await this.storageService.save(keys.activeUserId, userId);
-      this.activeAccountSubject.next(state.activeUserId);
-      // TODO: temporary update to avoid routing all account status changes through account service for now.
-      await this.accountService.switchAccount(userId as UserId);
-
-      return state;
-    });
-
-    await this.pushAccounts();
-  }
-
-  async clean(options?: StorageOptions): Promise<UserId> {
+  async clean(options?: StorageOptions): Promise<void> {
     options = this.reconcileOptions(options, await this.defaultInMemoryOptions());
     await this.deAuthenticateAccount(options.userId);
-    let currentUser = (await this.state())?.activeUserId;
-    if (options.userId === currentUser) {
-      currentUser = await this.dynamicallySetActiveUser();
-    }
 
     await this.removeAccountFromDisk(options?.userId);
     await this.removeAccountFromMemory(options?.userId);
     await this.pushAccounts();
-    return currentUser as UserId;
   }
 
   /**
@@ -515,24 +453,6 @@ export class StateService<
     );
   }
 
-  async getEmailVerified(options?: StorageOptions): Promise<boolean> {
-    return (
-      (await this.getAccount(this.reconcileOptions(options, await this.defaultOnDiskOptions())))
-        ?.profile.emailVerified ?? false
-    );
-  }
-
-  async setEmailVerified(value: boolean, options?: StorageOptions): Promise<void> {
-    const account = await this.getAccount(
-      this.reconcileOptions(options, await this.defaultOnDiskOptions()),
-    );
-    account.profile.emailVerified = value;
-    await this.saveAccount(
-      account,
-      this.reconcileOptions(options, await this.defaultOnDiskOptions()),
-    );
-  }
-
   async getEnableBrowserIntegration(options?: StorageOptions): Promise<boolean> {
     return (
       (await this.getGlobals(this.reconcileOptions(options, await this.defaultOnDiskOptions())))
@@ -642,35 +562,6 @@ export class StateService<
     );
   }
 
-  async getLastActive(options?: StorageOptions): Promise<number> {
-    options = this.reconcileOptions(options, await this.defaultOnDiskOptions());
-
-    const accountActivity = await this.storageService.get<{ [userId: string]: number }>(
-      keys.accountActivity,
-      options,
-    );
-
-    if (accountActivity == null || Object.keys(accountActivity).length < 1) {
-      return null;
-    }
-
-    return accountActivity[options.userId];
-  }
-
-  async setLastActive(value: number, options?: StorageOptions): Promise<void> {
-    options = this.reconcileOptions(options, await this.defaultOnDiskOptions());
-    if (options.userId == null) {
-      return;
-    }
-    const accountActivity =
-      (await this.storageService.get<{ [userId: string]: number }>(
-        keys.accountActivity,
-        options,
-      )) ?? {};
-    accountActivity[options.userId] = value;
-    await this.storageService.save(keys.accountActivity, accountActivity, options);
-  }
-
   async getLastSync(options?: StorageOptions): Promise<string> {
     return (
       await this.getAccount(this.reconcileOptions(options, await this.defaultOnDiskMemoryOptions()))
@@ -910,24 +801,28 @@ export class StateService<
   }
 
   protected async getAccountFromMemory(options: StorageOptions): Promise<TAccount> {
+    const userId =
+      options.userId ??
+      (await firstValueFrom(
+        this.accountService.activeAccount$.pipe(map((account) => account?.id)),
+      ));
+
     return await this.state().then(async (state) => {
       if (state.accounts == null) {
         return null;
       }
-      return state.accounts[await this.getUserIdFromMemory(options)];
-    });
-  }
-
-  protected async getUserIdFromMemory(options: StorageOptions): Promise<string> {
-    return await this.state().then((state) => {
-      return options?.userId != null
-        ? state.accounts[options.userId]?.profile?.userId
-        : state.activeUserId;
+      return state.accounts[userId];
     });
   }
 
   protected async getAccountFromDisk(options: StorageOptions): Promise<TAccount> {
-    if (options?.userId == null && (await this.state())?.activeUserId == null) {
+    const userId =
+      options.userId ??
+      (await firstValueFrom(
+        this.accountService.activeAccount$.pipe(map((account) => account?.id)),
+      ));
+
+    if (userId == null) {
       return null;
     }
 
@@ -1086,53 +981,76 @@ export class StateService<
   }
 
   protected async defaultInMemoryOptions(): Promise<StorageOptions> {
+    const userId = await firstValueFrom(
+      this.accountService.activeAccount$.pipe(map((account) => account?.id)),
+    );
+
     return {
       storageLocation: StorageLocation.Memory,
-      userId: (await this.state()).activeUserId,
+      userId,
     };
   }
 
   protected async defaultOnDiskOptions(): Promise<StorageOptions> {
+    const userId = await firstValueFrom(
+      this.accountService.activeAccount$.pipe(map((account) => account?.id)),
+    );
+
     return {
       storageLocation: StorageLocation.Disk,
       htmlStorageLocation: HtmlStorageLocation.Session,
-      userId: (await this.state())?.activeUserId ?? (await this.getActiveUserIdFromStorage()),
+      userId,
       useSecureStorage: false,
     };
   }
 
   protected async defaultOnDiskLocalOptions(): Promise<StorageOptions> {
+    const userId = await firstValueFrom(
+      this.accountService.activeAccount$.pipe(map((account) => account?.id)),
+    );
+
     return {
       storageLocation: StorageLocation.Disk,
       htmlStorageLocation: HtmlStorageLocation.Local,
-      userId: (await this.state())?.activeUserId ?? (await this.getActiveUserIdFromStorage()),
+      userId,
       useSecureStorage: false,
     };
   }
 
   protected async defaultOnDiskMemoryOptions(): Promise<StorageOptions> {
+    const userId = await firstValueFrom(
+      this.accountService.activeAccount$.pipe(map((account) => account?.id)),
+    );
+
     return {
       storageLocation: StorageLocation.Disk,
       htmlStorageLocation: HtmlStorageLocation.Memory,
-      userId: (await this.state())?.activeUserId ?? (await this.getUserId()),
+      userId,
       useSecureStorage: false,
     };
   }
 
   protected async defaultSecureStorageOptions(): Promise<StorageOptions> {
+    const userId = await firstValueFrom(
+      this.accountService.activeAccount$.pipe(map((account) => account?.id)),
+    );
+
     return {
       storageLocation: StorageLocation.Disk,
       useSecureStorage: true,
-      userId: (await this.state())?.activeUserId ?? (await this.getActiveUserIdFromStorage()),
+      userId,
     };
   }
 
   protected async getActiveUserIdFromStorage(): Promise<string> {
-    return await this.storageService.get<string>(keys.activeUserId);
+    return await firstValueFrom(this.accountService.activeAccount$.pipe(map((a) => a?.id)));
   }
 
   protected async removeAccountFromLocalStorage(userId: string = null): Promise<void> {
-    userId = userId ?? (await this.state())?.activeUserId;
+    userId ??= await firstValueFrom(
+      this.accountService.activeAccount$.pipe(map((account) => account?.id)),
+    );
+
     const storedAccount = await this.getAccount(
       this.reconcileOptions({ userId: userId }, await this.defaultOnDiskLocalOptions()),
     );
@@ -1143,7 +1061,10 @@ export class StateService<
   }
 
   protected async removeAccountFromSessionStorage(userId: string = null): Promise<void> {
-    userId = userId ?? (await this.state())?.activeUserId;
+    userId ??= await firstValueFrom(
+      this.accountService.activeAccount$.pipe(map((account) => account?.id)),
+    );
+
     const storedAccount = await this.getAccount(
       this.reconcileOptions({ userId: userId }, await this.defaultOnDiskOptions()),
     );
@@ -1154,7 +1075,10 @@ export class StateService<
   }
 
   protected async removeAccountFromSecureStorage(userId: string = null): Promise<void> {
-    userId = userId ?? (await this.state())?.activeUserId;
+    userId ??= await firstValueFrom(
+      this.accountService.activeAccount$.pipe(map((account) => account?.id)),
+    );
+
     await this.setUserKeyAutoUnlock(null, { userId: userId });
     await this.setUserKeyBiometric(null, { userId: userId });
     await this.setCryptoMasterKeyAuto(null, { userId: userId });
@@ -1163,8 +1087,11 @@ export class StateService<
   }
 
   protected async removeAccountFromMemory(userId: string = null): Promise<void> {
+    userId ??= await firstValueFrom(
+      this.accountService.activeAccount$.pipe(map((account) => account?.id)),
+    );
+
     await this.updateState(async (state) => {
-      userId = userId ?? state.activeUserId;
       delete state.accounts[userId];
       return state;
     });
@@ -1178,15 +1105,16 @@ export class StateService<
     return Object.assign(this.createAccount(), persistentAccountInformation);
   }
 
-  protected async clearDecryptedDataForActiveUser(): Promise<void> {
+  async clearDecryptedData(userId: UserId): Promise<void> {
     await this.updateState(async (state) => {
-      const userId = state?.activeUserId;
       if (userId != null && state?.accounts[userId]?.data != null) {
         state.accounts[userId].data = new AccountData();
       }
 
       return state;
     });
+
+    await this.pushAccounts();
   }
 
   protected createAccount(init: Partial<TAccount> = null): TAccount {
@@ -1201,14 +1129,6 @@ export class StateService<
     // We must have a manual call to clear tokens as we can't leverage state provider to clean
     // up our data as we have secure storage in the mix.
     await this.tokenService.clearTokens(userId as UserId);
-    await this.setLastActive(null, { userId: userId });
-    await this.updateState(async (state) => {
-      state.authenticatedAccounts = state.authenticatedAccounts.filter((id) => id !== userId);
-
-      await this.storageService.save(keys.authenticatedAccounts, state.authenticatedAccounts);
-
-      return state;
-    });
   }
 
   protected async removeAccountFromDisk(userId: string) {
@@ -1217,32 +1137,6 @@ export class StateService<
     await this.removeAccountFromSecureStorage(userId);
   }
 
-  async nextUpActiveUser() {
-    const accounts = (await this.state())?.accounts;
-    if (accounts == null || Object.keys(accounts).length < 1) {
-      return null;
-    }
-
-    let newActiveUser;
-    for (const userId in accounts) {
-      if (userId == null) {
-        continue;
-      }
-      if (await this.getIsAuthenticated({ userId: userId })) {
-        newActiveUser = userId;
-        break;
-      }
-      newActiveUser = null;
-    }
-    return newActiveUser as UserId;
-  }
-
-  protected async dynamicallySetActiveUser() {
-    const newActiveUser = await this.nextUpActiveUser();
-    await this.setActiveUser(newActiveUser);
-    return newActiveUser;
-  }
-
   protected async saveSecureStorageKey<T extends JsonValue>(
     key: string,
     value: T,

libs/common/src/platform/services/system.service.ts

@@ -1,10 +1,12 @@
-import { firstValueFrom, timeout } from "rxjs";
+import { firstValueFrom, map, timeout } from "rxjs";
 
 import { VaultTimeoutSettingsService } from "../../abstractions/vault-timeout/vault-timeout-settings.service";
+import { AccountService } from "../../auth/abstractions/account.service";
 import { AuthService } from "../../auth/abstractions/auth.service";
 import { AuthenticationStatus } from "../../auth/enums/authentication-status";
 import { AutofillSettingsServiceAbstraction } from "../../autofill/services/autofill-settings.service";
 import { VaultTimeoutAction } from "../../enums/vault-timeout-action.enum";
+import { UserId } from "../../types/guid";
 import { MessagingService } from "../abstractions/messaging.service";
 import { PlatformUtilsService } from "../abstractions/platform-utils.service";
 import { StateService } from "../abstractions/state.service";
@@ -25,15 +27,18 @@ export class SystemService implements SystemServiceAbstraction {
     private autofillSettingsService: AutofillSettingsServiceAbstraction,
     private vaultTimeoutSettingsService: VaultTimeoutSettingsService,
     private biometricStateService: BiometricStateService,
+    private accountService: AccountService,
   ) {}
 
   async startProcessReload(authService: AuthService): Promise<void> {
-    const accounts = await firstValueFrom(this.stateService.accounts$);
+    const accounts = await firstValueFrom(this.accountService.accounts$);
     if (accounts != null) {
       const keys = Object.keys(accounts);
       if (keys.length > 0) {
         for (const userId of keys) {
-          if ((await authService.getAuthStatus(userId)) === AuthenticationStatus.Unlocked) {
+          let status = await firstValueFrom(authService.authStatusFor$(userId as UserId));
+          status = await authService.getAuthStatus(userId);
+          if (status === AuthenticationStatus.Unlocked) {
             return;
           }
         }
@@ -63,15 +68,24 @@ export class SystemService implements SystemServiceAbstraction {
       clearInterval(this.reloadInterval);
       this.reloadInterval = null;
 
-      const currentUser = await firstValueFrom(this.stateService.activeAccount$.pipe(timeout(500)));
+      const currentUser = await firstValueFrom(
+        this.accountService.activeAccount$.pipe(
+          map((a) => a?.id),
+          timeout(500),
+        ),
+      );
       // Replace current active user if they will be logged out on reload
       if (currentUser != null) {
         const timeoutAction = await firstValueFrom(
           this.vaultTimeoutSettingsService.vaultTimeoutAction$().pipe(timeout(500)),
         );
         if (timeoutAction === VaultTimeoutAction.LogOut) {
-          const nextUser = await this.stateService.nextUpActiveUser();
-          await this.stateService.setActiveUser(nextUser);
+          const nextUser = await firstValueFrom(
+            this.accountService.nextUpAccount$.pipe(map((account) => account?.id ?? null)),
+          );
+          // Can be removed once we migrate password generation history to state providers
+          await this.stateService.clearDecryptedData(currentUser);
+          await this.accountService.switchAccount(nextUser);
         }
       }
 

libs/common/src/platform/state/implementations/default-active-user-state.provider.spec.ts

@@ -1,7 +1,6 @@
 import { mock } from "jest-mock-extended";
 
 import { mockAccountServiceWith, trackEmissions } from "../../../../spec";
-import { AuthenticationStatus } from "../../../auth/enums/authentication-status";
 import { UserId } from "../../../types/guid";
 import { SingleUserStateProvider } from "../user-state.provider";
 
@@ -14,7 +13,7 @@ describe("DefaultActiveUserStateProvider", () => {
     id: userId,
     name: "name",
     email: "email",
-    status: AuthenticationStatus.Locked,
+    emailVerified: false,
   };
   const accountService = mockAccountServiceWith(userId, accountInfo);
   let sut: DefaultActiveUserStateProvider;

libs/common/src/platform/state/implementations/default-active-user-state.spec.ts

@@ -82,6 +82,7 @@ describe("DefaultActiveUserState", () => {
     activeAccountSubject.next({
       id: userId,
       email: `test${id}@example.com`,
+      emailVerified: false,
       name: `Test User ${id}`,
     });
     await awaitAsync();

libs/common/src/platform/state/implementations/default-state.provider.spec.ts

@@ -69,7 +69,12 @@ describe("DefaultStateProvider", () => {
         userId?: UserId,
       ) => Observable<string>,
     ) => {
-      const accountInfo = { email: "email", name: "name", status: AuthenticationStatus.LoggedOut };
+      const accountInfo = {
+        email: "email",
+        emailVerified: false,
+        name: "name",
+        status: AuthenticationStatus.LoggedOut,
+      };
       const keyDefinition = new KeyDefinition<string>(new StateDefinition("test", "disk"), "test", {
         deserializer: (s) => s,
       });
@@ -114,7 +119,12 @@ describe("DefaultStateProvider", () => {
   );
 
   describe("getUserState$", () => {
-    const accountInfo = { email: "email", name: "name", status: AuthenticationStatus.LoggedOut };
+    const accountInfo = {
+      email: "email",
+      emailVerified: false,
+      name: "name",
+      status: AuthenticationStatus.LoggedOut,
+    };
     const keyDefinition = new KeyDefinition<string>(new StateDefinition("test", "disk"), "test", {
       deserializer: (s) => s,
     });

libs/common/src/platform/state/state-definitions.ts

@@ -38,6 +38,7 @@ export const BILLING_DISK = new StateDefinition("billing", "disk");
 export const KDF_CONFIG_DISK = new StateDefinition("kdfConfig", "disk");
 export const KEY_CONNECTOR_DISK = new StateDefinition("keyConnector", "disk");
 export const ACCOUNT_MEMORY = new StateDefinition("account", "memory");
+export const ACCOUNT_DISK = new StateDefinition("account", "disk");
 export const MASTER_PASSWORD_MEMORY = new StateDefinition("masterPassword", "memory");
 export const MASTER_PASSWORD_DISK = new StateDefinition("masterPassword", "disk");
 export const TWO_FACTOR_MEMORY = new StateDefinition("twoFactor", "memory");

libs/common/src/services/vault-timeout/vault-timeout.service.spec.ts

@@ -1,9 +1,10 @@
 import { MockProxy, any, mock } from "jest-mock-extended";
-import { BehaviorSubject } from "rxjs";
+import { BehaviorSubject, of } from "rxjs";
 
 import { FakeAccountService, mockAccountServiceWith } from "../../../spec/fake-account-service";
 import { SearchService } from "../../abstractions/search.service";
 import { VaultTimeoutSettingsService } from "../../abstractions/vault-timeout/vault-timeout-settings.service";
+import { AccountInfo } from "../../auth/abstractions/account.service";
 import { AuthService } from "../../auth/abstractions/auth.service";
 import { AuthenticationStatus } from "../../auth/enums/authentication-status";
 import { FakeMasterPasswordService } from "../../auth/services/master-password/fake-master-password.service";
@@ -13,7 +14,6 @@ import { MessagingService } from "../../platform/abstractions/messaging.service"
 import { PlatformUtilsService } from "../../platform/abstractions/platform-utils.service";
 import { StateService } from "../../platform/abstractions/state.service";
 import { Utils } from "../../platform/misc/utils";
-import { Account } from "../../platform/models/domain/account";
 import { StateEventRunnerService } from "../../platform/state";
 import { UserId } from "../../types/guid";
 import { CipherService } from "../../vault/abstractions/cipher.service";
@@ -39,7 +39,6 @@ describe("VaultTimeoutService", () => {
   let lockedCallback: jest.Mock<Promise<void>, [userId: string]>;
   let loggedOutCallback: jest.Mock<Promise<void>, [expired: boolean, userId?: string]>;
 
-  let accountsSubject: BehaviorSubject<Record<string, Account>>;
   let vaultTimeoutActionSubject: BehaviorSubject<VaultTimeoutAction>;
   let availableVaultTimeoutActionsSubject: BehaviorSubject<VaultTimeoutAction[]>;
 
@@ -65,10 +64,6 @@ describe("VaultTimeoutService", () => {
     lockedCallback = jest.fn();
     loggedOutCallback = jest.fn();
 
-    accountsSubject = new BehaviorSubject(null);
-
-    stateService.accounts$ = accountsSubject;
-
     vaultTimeoutActionSubject = new BehaviorSubject(VaultTimeoutAction.Lock);
 
     vaultTimeoutSettingsService.vaultTimeoutAction$.mockReturnValue(vaultTimeoutActionSubject);
@@ -127,21 +122,39 @@ describe("VaultTimeoutService", () => {
       return Promise.resolve(accounts[userId]?.vaultTimeout);
     });
 
-    stateService.getLastActive.mockImplementation((options) => {
-      return Promise.resolve(accounts[options.userId]?.lastActive);
-    });
-
     stateService.getUserId.mockResolvedValue(globalSetups?.userId);
 
-    stateService.activeAccount$ = new BehaviorSubject<string>(globalSetups?.userId);
-
+    // Set desired user active and known users on accounts service : note the only thing that matters here is that the ID are set
     if (globalSetups?.userId) {
       accountService.activeAccountSubject.next({
         id: globalSetups.userId as UserId,
         email: null,
+        emailVerified: false,
         name: null,
       });
     }
+    accountService.accounts$ = of(
+      Object.entries(accounts).reduce(
+        (agg, [id]) => {
+          agg[id] = {
+            email: "",
+            emailVerified: true,
+            name: "",
+          };
+          return agg;
+        },
+        {} as Record<string, AccountInfo>,
+      ),
+    );
+    accountService.accountActivity$ = of(
+      Object.entries(accounts).reduce(
+        (agg, [id, info]) => {
+          agg[id] = info.lastActive ? new Date(info.lastActive) : null;
+          return agg;
+        },
+        {} as Record<string, Date>,
+      ),
+    );
 
     platformUtilsService.isViewOpen.mockResolvedValue(globalSetups?.isViewOpen ?? false);
 
@@ -158,16 +171,6 @@ describe("VaultTimeoutService", () => {
         ],
       );
     });
-
-    const accountsSubjectValue: Record<string, Account> = Object.keys(accounts).reduce(
-      (agg, key) => {
-        const newPartial: Record<string, unknown> = {};
-        newPartial[key] = null; // No values actually matter on this other than the key
-        return Object.assign(agg, newPartial);
-      },
-      {} as Record<string, Account>,
-    );
-    accountsSubject.next(accountsSubjectValue);
   };
 
   const expectUserToHaveLocked = (userId: string) => {

libs/common/src/services/vault-timeout/vault-timeout.service.ts

@@ -1,4 +1,4 @@
-import { firstValueFrom, timeout } from "rxjs";
+import { combineLatest, firstValueFrom, switchMap } from "rxjs";
 
 import { SearchService } from "../../abstractions/search.service";
 import { VaultTimeoutSettingsService } from "../../abstractions/vault-timeout/vault-timeout-settings.service";
@@ -64,14 +64,25 @@ export class VaultTimeoutService implements VaultTimeoutServiceAbstraction {
     // Get whether or not the view is open a single time so it can be compared for each user
     const isViewOpen = await this.platformUtilsService.isViewOpen();
 
-    const activeUserId = await firstValueFrom(this.stateService.activeAccount$.pipe(timeout(500)));
-
-    const accounts = await firstValueFrom(this.stateService.accounts$);
-    for (const userId in accounts) {
-      if (userId != null && (await this.shouldLock(userId, activeUserId, isViewOpen))) {
-        await this.executeTimeoutAction(userId);
-      }
-    }
+    await firstValueFrom(
+      combineLatest([
+        this.accountService.activeAccount$,
+        this.accountService.accountActivity$,
+      ]).pipe(
+        switchMap(async ([activeAccount, accountActivity]) => {
+          const activeUserId = activeAccount?.id;
+          for (const userIdString in accountActivity) {
+            const userId = userIdString as UserId;
+            if (
+              userId != null &&
+              (await this.shouldLock(userId, accountActivity[userId], activeUserId, isViewOpen))
+            ) {
+              await this.executeTimeoutAction(userId);
+            }
+          }
+        }),
+      ),
+    );
   }
 
   async lock(userId?: string): Promise<void> {
@@ -123,6 +134,7 @@ export class VaultTimeoutService implements VaultTimeoutServiceAbstraction {
 
   private async shouldLock(
     userId: string,
+    lastActive: Date,
     activeUserId: string,
     isViewOpen: boolean,
   ): Promise<boolean> {
@@ -146,13 +158,12 @@ export class VaultTimeoutService implements VaultTimeoutServiceAbstraction {
       return false;
     }
 
-    const lastActive = await this.stateService.getLastActive({ userId: userId });
     if (lastActive == null) {
       return false;
     }
 
     const vaultTimeoutSeconds = vaultTimeout * 60;
-    const diffSeconds = (new Date().getTime() - lastActive) / 1000;
+    const diffSeconds = (new Date().getTime() - lastActive.getTime()) / 1000;
     return diffSeconds >= vaultTimeoutSeconds;
   }
 

libs/common/src/state-migrations/migrate.ts

@@ -57,13 +57,14 @@ import { CipherServiceMigrator } from "./migrations/57-move-cipher-service-to-st
 import { RemoveRefreshTokenMigratedFlagMigrator } from "./migrations/58-remove-refresh-token-migrated-state-provider-flag";
 import { KdfConfigMigrator } from "./migrations/59-move-kdf-config-to-state-provider";
 import { RemoveLegacyEtmKeyMigrator } from "./migrations/6-remove-legacy-etm-key";
+import { KnownAccountsMigrator } from "./migrations/60-known-accounts";
 import { MoveBiometricAutoPromptToAccount } from "./migrations/7-move-biometric-auto-prompt-to-account";
 import { MoveStateVersionMigrator } from "./migrations/8-move-state-version";
 import { MoveBrowserSettingsToGlobal } from "./migrations/9-move-browser-settings-to-global";
 import { MinVersionMigrator } from "./migrations/min-version";
 
 export const MIN_VERSION = 3;
-export const CURRENT_VERSION = 59;
+export const CURRENT_VERSION = 60;
 export type MinVersion = typeof MIN_VERSION;
 
 export function createMigrationBuilder() {
@@ -124,7 +125,8 @@ export function createMigrationBuilder() {
     .with(AuthRequestMigrator, 55, 56)
     .with(CipherServiceMigrator, 56, 57)
     .with(RemoveRefreshTokenMigratedFlagMigrator, 57, 58)
-    .with(KdfConfigMigrator, 58, CURRENT_VERSION);
+    .with(KdfConfigMigrator, 58, 59)
+    .with(KnownAccountsMigrator, 59, CURRENT_VERSION);
 }
 
 export async function currentVersion(

libs/common/src/state-migrations/migration-helper.spec.ts

@@ -27,6 +27,14 @@ const exampleJSON = {
   },
   global_serviceName_key: "global_serviceName_key",
   user_userId_serviceName_key: "user_userId_serviceName_key",
+  global_account_accounts: {
+    "c493ed01-4e08-4e88-abc7-332f380ca760": {
+      otherStuff: "otherStuff3",
+    },
+    "23e61a5f-2ece-4f5e-b499-f0bc489482a9": {
+      otherStuff: "otherStuff4",
+    },
+  },
 };
 
 describe("RemoveLegacyEtmKeyMigrator", () => {
@@ -81,6 +89,41 @@ describe("RemoveLegacyEtmKeyMigrator", () => {
         const accounts = await sut.getAccounts();
         expect(accounts).toEqual([]);
       });
+
+      it("handles global scoped known accounts for version 60 and after", async () => {
+        sut.currentVersion = 60;
+        const accounts = await sut.getAccounts();
+        expect(accounts).toEqual([
+          // Note, still gets values stored in state service objects, just grabs user ids from global
+          {
+            userId: "c493ed01-4e08-4e88-abc7-332f380ca760",
+            account: { otherStuff: "otherStuff1" },
+          },
+          {
+            userId: "23e61a5f-2ece-4f5e-b499-f0bc489482a9",
+            account: { otherStuff: "otherStuff2" },
+          },
+        ]);
+      });
+    });
+
+    describe("getKnownUserIds", () => {
+      it("returns all user ids", async () => {
+        const userIds = await sut.getKnownUserIds();
+        expect(userIds).toEqual([
+          "c493ed01-4e08-4e88-abc7-332f380ca760",
+          "23e61a5f-2ece-4f5e-b499-f0bc489482a9",
+        ]);
+      });
+
+      it("returns all user ids when version is 60 or greater", async () => {
+        sut.currentVersion = 60;
+        const userIds = await sut.getKnownUserIds();
+        expect(userIds).toEqual([
+          "c493ed01-4e08-4e88-abc7-332f380ca760",
+          "23e61a5f-2ece-4f5e-b499-f0bc489482a9",
+        ]);
+      });
     });
 
     describe("getFromGlobal", () => {

libs/common/src/state-migrations/migration-helper.ts

@@ -162,7 +162,7 @@ export class MigrationHelper {
   async getAccounts<ExpectedAccountType>(): Promise<
     { userId: string; account: ExpectedAccountType }[]
   > {
-    const userIds = (await this.get<string[]>("authenticatedAccounts")) ?? [];
+    const userIds = await this.getKnownUserIds();
     return Promise.all(
       userIds.map(async (userId) => ({
         userId,
@@ -171,6 +171,17 @@ export class MigrationHelper {
     );
   }
 
+  /**
+   * Helper method to read known users ids.
+   */
+  async getKnownUserIds(): Promise<string[]> {
+    if (this.currentVersion < 61) {
+      return knownAccountUserIdsBuilderPre61(this.storageService);
+    } else {
+      return knownAccountUserIdsBuilder(this.storageService);
+    }
+  }
+
   /**
    * Builds a user storage key appropriate for the current version.
    *
@@ -233,3 +244,18 @@ function globalKeyBuilder(keyDefinition: KeyDefinitionLike): string {
 function globalKeyBuilderPre9(): string {
   throw Error("No key builder should be used for versions prior to 9.");
 }
+
+async function knownAccountUserIdsBuilderPre61(
+  storageService: AbstractStorageService,
+): Promise<string[]> {
+  return (await storageService.get<string[]>("authenticatedAccounts")) ?? [];
+}
+
+async function knownAccountUserIdsBuilder(
+  storageService: AbstractStorageService,
+): Promise<string[]> {
+  const accounts = await storageService.get<Record<string, unknown>>(
+    globalKeyBuilder({ stateDefinition: { name: "account" }, key: "accounts" }),
+  );
+  return Object.keys(accounts ?? {});
+}

libs/common/src/state-migrations/migrations/60-known-accounts.spec.ts

@@ -0,0 +1,145 @@
+import { MockProxy } from "jest-mock-extended";
+
+import { MigrationHelper } from "../migration-helper";
+import { mockMigrationHelper } from "../migration-helper.spec";
+
+import {
+  ACCOUNT_ACCOUNTS,
+  ACCOUNT_ACTIVE_ACCOUNT_ID,
+  ACCOUNT_ACTIVITY,
+  KnownAccountsMigrator,
+} from "./60-known-accounts";
+
+const migrateJson = () => {
+  return {
+    authenticatedAccounts: ["user1", "user2"],
+    activeUserId: "user1",
+    user1: {
+      profile: {
+        email: "user1",
+        name: "User 1",
+        emailVerified: true,
+      },
+    },
+    user2: {
+      profile: {
+        email: "",
+        emailVerified: false,
+      },
+    },
+    accountActivity: {
+      user1: 1609459200000, // 2021-01-01
+      user2: 1609545600000, // 2021-01-02
+    },
+  };
+};
+
+const rollbackJson = () => {
+  return {
+    user1: {
+      profile: {
+        email: "user1",
+        name: "User 1",
+        emailVerified: true,
+      },
+    },
+    user2: {
+      profile: {
+        email: "",
+        emailVerified: false,
+      },
+    },
+    global_account_accounts: {
+      user1: {
+        profile: {
+          email: "user1",
+          name: "User 1",
+          emailVerified: true,
+        },
+      },
+      user2: {
+        profile: {
+          email: "",
+          emailVerified: false,
+        },
+      },
+    },
+    global_account_activeAccountId: "user1",
+    global_account_activity: {
+      user1: "2021-01-01T00:00:00.000Z",
+      user2: "2021-01-02T00:00:00.000Z",
+    },
+  };
+};
+
+describe("ReplicateKnownAccounts", () => {
+  let helper: MockProxy<MigrationHelper>;
+  let sut: KnownAccountsMigrator;
+
+  describe("migrate", () => {
+    beforeEach(() => {
+      helper = mockMigrationHelper(migrateJson(), 59);
+      sut = new KnownAccountsMigrator(59, 60);
+    });
+
+    it("migrates accounts", async () => {
+      await sut.migrate(helper);
+      expect(helper.setToGlobal).toHaveBeenCalledWith(ACCOUNT_ACCOUNTS, {
+        user1: {
+          email: "user1",
+          name: "User 1",
+          emailVerified: true,
+        },
+        user2: {
+          email: "",
+          emailVerified: false,
+          name: undefined,
+        },
+      });
+      expect(helper.remove).toHaveBeenCalledWith("authenticatedAccounts");
+    });
+
+    it("migrates active account it", async () => {
+      await sut.migrate(helper);
+      expect(helper.setToGlobal).toHaveBeenCalledWith(ACCOUNT_ACTIVE_ACCOUNT_ID, "user1");
+      expect(helper.remove).toHaveBeenCalledWith("activeUserId");
+    });
+
+    it("migrates account activity", async () => {
+      await sut.migrate(helper);
+      expect(helper.setToGlobal).toHaveBeenCalledWith(ACCOUNT_ACTIVITY, {
+        user1: '"2021-01-01T00:00:00.000Z"',
+        user2: '"2021-01-02T00:00:00.000Z"',
+      });
+      expect(helper.remove).toHaveBeenCalledWith("accountActivity");
+    });
+  });
+
+  describe("rollback", () => {
+    beforeEach(() => {
+      helper = mockMigrationHelper(rollbackJson(), 60);
+      sut = new KnownAccountsMigrator(59, 60);
+    });
+
+    it("rolls back authenticated accounts", async () => {
+      await sut.rollback(helper);
+      expect(helper.set).toHaveBeenCalledWith("authenticatedAccounts", ["user1", "user2"]);
+      expect(helper.removeFromGlobal).toHaveBeenCalledWith(ACCOUNT_ACCOUNTS);
+    });
+
+    it("rolls back active account id", async () => {
+      await sut.rollback(helper);
+      expect(helper.set).toHaveBeenCalledWith("activeUserId", "user1");
+      expect(helper.removeFromGlobal).toHaveBeenCalledWith(ACCOUNT_ACTIVE_ACCOUNT_ID);
+    });
+
+    it("rolls back account activity", async () => {
+      await sut.rollback(helper);
+      expect(helper.set).toHaveBeenCalledWith("accountActivity", {
+        user1: 1609459200000,
+        user2: 1609545600000,
+      });
+      expect(helper.removeFromGlobal).toHaveBeenCalledWith(ACCOUNT_ACTIVITY);
+    });
+  });
+});

libs/common/src/state-migrations/migrations/60-known-accounts.ts

@@ -0,0 +1,111 @@
+import { KeyDefinitionLike, MigrationHelper } from "../migration-helper";
+import { Migrator } from "../migrator";
+
+export const ACCOUNT_ACCOUNTS: KeyDefinitionLike = {
+  stateDefinition: {
+    name: "account",
+  },
+  key: "accounts",
+};
+
+export const ACCOUNT_ACTIVE_ACCOUNT_ID: KeyDefinitionLike = {
+  stateDefinition: {
+    name: "account",
+  },
+  key: "activeAccountId",
+};
+
+export const ACCOUNT_ACTIVITY: KeyDefinitionLike = {
+  stateDefinition: {
+    name: "account",
+  },
+  key: "activity",
+};
+
+type ExpectedAccountType = {
+  profile?: {
+    email?: string;
+    name?: string;
+    emailVerified?: boolean;
+  };
+};
+
+export class KnownAccountsMigrator extends Migrator<59, 60> {
+  async migrate(helper: MigrationHelper): Promise<void> {
+    await this.migrateAuthenticatedAccounts(helper);
+    await this.migrateActiveAccountId(helper);
+    await this.migrateAccountActivity(helper);
+  }
+  async rollback(helper: MigrationHelper): Promise<void> {
+    // authenticated account are removed, but the accounts record also contains logged out accounts. Best we can do is to add them all back
+    const accounts = (await helper.getFromGlobal<Record<string, unknown>>(ACCOUNT_ACCOUNTS)) ?? {};
+    await helper.set("authenticatedAccounts", Object.keys(accounts));
+    await helper.removeFromGlobal(ACCOUNT_ACCOUNTS);
+
+    // Active Account Id
+    const activeAccountId = await helper.getFromGlobal<string>(ACCOUNT_ACTIVE_ACCOUNT_ID);
+    if (activeAccountId) {
+      await helper.set("activeUserId", activeAccountId);
+    }
+    await helper.removeFromGlobal(ACCOUNT_ACTIVE_ACCOUNT_ID);
+
+    // Account Activity
+    const accountActivity = await helper.getFromGlobal<Record<string, string>>(ACCOUNT_ACTIVITY);
+    if (accountActivity) {
+      const toStore = Object.entries(accountActivity).reduce(
+        (agg, [userId, dateString]) => {
+          agg[userId] = new Date(dateString).getTime();
+          return agg;
+        },
+        {} as Record<string, number>,
+      );
+      await helper.set("accountActivity", toStore);
+    }
+    await helper.removeFromGlobal(ACCOUNT_ACTIVITY);
+  }
+
+  private async migrateAuthenticatedAccounts(helper: MigrationHelper) {
+    const authenticatedAccounts = (await helper.get<string[]>("authenticatedAccounts")) ?? [];
+    const accounts = await Promise.all(
+      authenticatedAccounts.map(async (userId) => {
+        const account = await helper.get<ExpectedAccountType>(userId);
+        return { userId, account };
+      }),
+    );
+    const accountsToStore = accounts.reduce(
+      (agg, { userId, account }) => {
+        if (account?.profile) {
+          agg[userId] = {
+            email: account.profile.email ?? "",
+            emailVerified: account.profile.emailVerified ?? false,
+            name: account.profile.name,
+          };
+        }
+        return agg;
+      },
+      {} as Record<string, { email: string; emailVerified: boolean; name: string | undefined }>,
+    );
+
+    await helper.setToGlobal(ACCOUNT_ACCOUNTS, accountsToStore);
+    await helper.remove("authenticatedAccounts");
+  }
+
+  private async migrateAccountActivity(helper: MigrationHelper) {
+    const stored = await helper.get<Record<string, Date>>("accountActivity");
+    const accountActivity = Object.entries(stored ?? {}).reduce(
+      (agg, [userId, dateMs]) => {
+        agg[userId] = JSON.stringify(new Date(dateMs));
+        return agg;
+      },
+      {} as Record<string, string>,
+    );
+    await helper.setToGlobal(ACCOUNT_ACTIVITY, accountActivity);
+    await helper.remove("accountActivity");
+  }
+
+  private async migrateActiveAccountId(helper: MigrationHelper) {
+    const activeAccountId = await helper.get<string>("activeUserId");
+    await helper.setToGlobal(ACCOUNT_ACTIVE_ACCOUNT_ID, activeAccountId);
+    await helper.remove("activeUserId");
+  }
+}

libs/common/src/tools/send/services/send.service.spec.ts

@@ -62,6 +62,7 @@ describe("SendService", () => {
     accountService.activeAccountSubject.next({
       id: mockUserId,
       email: "email",
+      emailVerified: false,
       name: "name",
     });
 

libs/common/src/vault/services/sync/sync.service.ts

@@ -326,7 +326,10 @@ export class SyncService implements SyncServiceAbstraction {
     await this.cryptoService.setOrgKeys(response.organizations, response.providerOrganizations);
     await this.avatarService.setSyncAvatarColor(response.id as UserId, response.avatarColor);
     await this.tokenService.setSecurityStamp(response.securityStamp, response.id as UserId);
-    await this.stateService.setEmailVerified(response.emailVerified);
+    await this.accountService.setAccountEmailVerified(
+      response.id as UserId,
+      response.emailVerified,
+    );
 
     await this.billingAccountProfileStateService.setHasPremium(
       response.premiumPersonally,