[AC-1045] add action to vault timeout policy (#4782)

libs/common/src/services/vaultTimeout/vaultTimeout.service.ts

@@ -11,6 +11,7 @@ import { CollectionService } from "../../admin-console/abstractions/collection.s
 import { AuthService } from "../../auth/abstractions/auth.service";
 import { KeyConnectorService } from "../../auth/abstractions/key-connector.service";
 import { AuthenticationStatus } from "../../auth/enums/authentication-status";
+import { VaultTimeoutAction } from "../../enums/vault-timeout-action.enum";
 import { CipherService } from "../../vault/abstractions/cipher.service";
 import { FolderService } from "../../vault/abstractions/folder/folder.service.abstraction";
 
@@ -132,7 +133,9 @@ export class VaultTimeoutService implements VaultTimeoutServiceAbstraction {
   }
 
   private async executeTimeoutAction(userId: string): Promise<void> {
-    const timeoutAction = await this.stateService.getVaultTimeoutAction({ userId: userId });
-    timeoutAction === "logOut" ? await this.logOut(userId) : await this.lock(userId);
+    const timeoutAction = await this.vaultTimeoutSettingsService.getVaultTimeoutAction(userId);
+    timeoutAction === VaultTimeoutAction.LogOut
+      ? await this.logOut(userId)
+      : await this.lock(userId);
   }
 }

libs/common/src/services/vaultTimeout/vaultTimeoutSettings.service.ts

@@ -4,6 +4,7 @@ import { VaultTimeoutSettingsService as VaultTimeoutSettingsServiceAbstraction }
 import { PolicyService } from "../../admin-console/abstractions/policy/policy.service.abstraction";
 import { PolicyType } from "../../admin-console/enums";
 import { TokenService } from "../../auth/abstractions/token.service";
+import { VaultTimeoutAction } from "../../enums/vault-timeout-action.enum";
 
 export class VaultTimeoutSettingsService implements VaultTimeoutSettingsServiceAbstraction {
   constructor(
@@ -13,7 +14,7 @@ export class VaultTimeoutSettingsService implements VaultTimeoutSettingsServiceA
     private stateService: StateService
   ) {}
 
-  async setVaultTimeoutOptions(timeout: number, action: string): Promise<void> {
+  async setVaultTimeoutOptions(timeout: number, action: VaultTimeoutAction): Promise<void> {
     await this.stateService.setVaultTimeout(timeout);
 
     // We swap these tokens from being on disk for lock actions, and in memory for logout actions
@@ -24,7 +25,11 @@ export class VaultTimeoutSettingsService implements VaultTimeoutSettingsServiceA
     const clientSecret = await this.tokenService.getClientSecret();
 
     const currentAction = await this.stateService.getVaultTimeoutAction();
-    if ((timeout != null || timeout === 0) && action === "logOut" && action !== currentAction) {
+    if (
+      (timeout != null || timeout === 0) &&
+      action === VaultTimeoutAction.LogOut &&
+      action !== currentAction
+    ) {
       // if we have a vault timeout and the action is log out, reset tokens
       await this.tokenService.clearToken();
     }
@@ -74,6 +79,29 @@ export class VaultTimeoutSettingsService implements VaultTimeoutSettingsServiceA
     return vaultTimeout;
   }
 
+  async getVaultTimeoutAction(userId?: string): Promise<VaultTimeoutAction> {
+    let vaultTimeoutAction = await this.stateService.getVaultTimeoutAction({ userId: userId });
+
+    if (
+      await this.policyService.policyAppliesToUser(PolicyType.MaximumVaultTimeout, null, userId)
+    ) {
+      const policy = await this.policyService.getAll(PolicyType.MaximumVaultTimeout, userId);
+      const action = policy[0].data.action;
+
+      if (action) {
+        // We really shouldn't need to set the value here, but multiple services relies on this value being correct.
+        if (action && vaultTimeoutAction !== action) {
+          await this.stateService.setVaultTimeoutAction(action, { userId: userId });
+        }
+        vaultTimeoutAction = action;
+      }
+    }
+
+    return vaultTimeoutAction === VaultTimeoutAction.LogOut
+      ? VaultTimeoutAction.LogOut
+      : VaultTimeoutAction.Lock;
+  }
+
   async clear(userId?: string): Promise<void> {
     await this.stateService.setEverBeenUnlocked(false, { userId: userId });
     await this.stateService.setDecryptedPinProtected(null, { userId: userId });