[PM-5064] Fix lock interaction between biometrics and vault timeout never

src/Core/Services/VaultTimeoutService.cs

@@ -63,12 +63,20 @@
         /// </param>
         public async Task<bool> IsLockedAsync(string userId = null)
         {
+            // If biometrics are used, we can use the flag to determine locked state taking into account the auto unlock key for vault timeout never.
+            var biometricSet = await IsBiometricLockSetAsync(userId);
+            var hasAutoUnlockKey = await _cryptoService.HasAutoUnlockKeyAsync(userId);
+            if (biometricSet && await _stateService.GetBiometricLockedAsync(userId) && !hasAutoUnlockKey)
+            {
+                return true;
+            }
+
             if (!await _cryptoService.HasUserKeyAsync(userId))
             {
                 try
                 {
                     // Filter out accounts without auto key
-                    if (!await _cryptoService.HasAutoUnlockKeyAsync(userId))
+                    if (!hasAutoUnlockKey)
                     {
                         return true;
                     }
@@ -84,7 +92,6 @@
                     // Legacy users must migrate on web vault before login
                     await LogOutAsync(false, userId);
                 }
-
             }
 
             // Check again to verify auto key was set
@@ -193,7 +200,7 @@
             {
                 var pinStatus = await GetPinLockTypeAsync(userId);
                 var ephemeralPinSet = await _stateService.GetPinKeyEncryptedUserKeyEphemeralAsync()
                     ?? await _stateService.GetPinProtectedKeyAsync();
                 var pinEnabled = (pinStatus == PinLockType.Transient && ephemeralPinSet != null) ||
                           pinStatus == PinLockType.Persistent;
 
@@ -253,7 +260,7 @@
             // versions only used it for MP on Restart
             var isPinEnabled = await _stateService.GetProtectedPinAsync(userId) != null;
             var hasUserKeyPin = await _stateService.GetPinKeyEncryptedUserKeyAsync(userId) != null;
             var hasOldUserKeyPin = await _stateService.GetPinProtectedAsync(userId) != null;
 
             if (hasUserKeyPin || hasOldUserKeyPin)
             {