diff --git a/src/datasources/db/cargobikeAPI.ts b/src/datasources/db/cargobikeAPI.ts
index 01307b4..5af5f4b 100644
--- a/src/datasources/db/cargobikeAPI.ts
+++ b/src/datasources/db/cargobikeAPI.ts
@@ -49,31 +49,49 @@ export class CargoBikeAPI extends DataSource {
     }
 
     async lockCargoBike (id: number, req: any, dataSources: any) {
-        console.log("token:");
-        console.log(req.headers.authorization);
         const token = req.headers.authorization?.replace('Bearer ', '');
         console.log(token);
-        console.log(await dataSources.userAPI.getUserId(token));
+        console.log(Date.now().toString());
+        const userId = await dataSources.userAPI.getUserId(token);
         const lock = await this.connection.getRepository(CargoBike)
-            .createQueryBuilder('cargoBike')
+            .createQueryBuilder('cargobike')
             .select([
-                'cargoBike.lockedUntil',
-                'cargoBike.lockedBy'
+                'cargobike.lockedUntil',
+                'cargobike.lockedBy'
             ])
             .where('id = :id', {
                 id: id
             })
+            .andWhere('cargobike.lockedUntil > CURRENT_TIMESTAMP')
             .getOne();
-        //console.log(req);
-        console.log(lock);
-        return false;
+        // eslint-disable-next-line eqeqeq
+        if (!lock?.lockedUntil || lock?.lockedBy == userId) {
+            // no lock -> set lock
+            console.log("no lock")
+            await this.connection.getRepository(CargoBike)
+                .createQueryBuilder('cargoBike')
+                .update()
+                .set({
+                    lockedUntil: () => 'CURRENT_TIMESTAMP + INTERVAL \'10 MINUTE\'',
+                    lockedBy: userId
+                })
+                .where('id = :id', { id: id })
+                .execute();
+            return true;
+        } else {
+            // lock was set
+            return false;
+        }
     }
 
     /**
      * Updates CargoBike and return updated cargoBike
      * @param param0 cargoBike to be updated
      */
-    async updateCargoBike ({ cargoBike }:{ cargoBike: any }) {
+    async updateCargoBike (cargoBike: any, req: any, dataSources: any) {
+        if (!await this.lockCargoBike(cargoBike.id, req, dataSources)) {
+            return new GraphQLError('Bike locked by other user');
+        }
         const bike = await this.connection.manager.createQueryBuilder()
             .select('cargoBike')
             .from(CargoBike, 'cargoBike')
diff --git a/src/datasources/userserver/userserviceAPI.ts b/src/datasources/userserver/userserviceAPI.ts
index 389aff7..b86a1c0 100644
--- a/src/datasources/userserver/userserviceAPI.ts
+++ b/src/datasources/userserver/userserviceAPI.ts
@@ -88,6 +88,9 @@ export class UserServerAPI extends DataSource {
      * @param token
      */
     async getUserId (token: String): Promise<number> {
+        if (process.env.NODE_ENV === 'develop') {
+            return 0;
+        }
         const response = await this.send<any>(new RPCMessage(Method.GetUserID, { token }));
         return response.data;
     }
diff --git a/src/resolvers/cargobikeResolver.ts b/src/resolvers/cargobikeResolver.ts
index 86e64e6..6fb6080 100644
--- a/src/resolvers/cargobikeResolver.ts
+++ b/src/resolvers/cargobikeResolver.ts
@@ -68,7 +68,6 @@ export default {
         },
         lockCargoBikeById: (_: any, { id }: { id: number }, { dataSources, req }:{dataSources: any, req: any }) => {
             if (req.permissions.includes(Permission.WriteBike)) {
-               
                 return dataSources.cargoBikeAPI.lockCargoBike(id, req, dataSources);
             } else {
                 return new GraphQLError('Insufficient Permissions');
@@ -76,7 +75,7 @@ export default {
         },
         updateCargoBike: (_: any, { cargoBike }: { cargoBike: any }, { dataSources, req }:{dataSources: any, req: any }) => {
             if (req.permissions.includes(Permission.WriteBike)) {
-                return dataSources.cargoBikeAPI.updateCargoBike({ cargoBike });
+                return dataSources.cargoBikeAPI.updateCargoBike(cargoBike, req, dataSources);
             } else {
                 return new GraphQLError('Insufficient Permissions');
             }
diff --git a/src/schema/type-defs.ts b/src/schema/type-defs.ts
index 56ef9ed..6d2e206 100644
--- a/src/schema/type-defs.ts
+++ b/src/schema/type-defs.ts
@@ -710,7 +710,7 @@ type Query {
 type Mutation {
     "creates new cargoBike and returns cargobike with new ID"
     createCargoBike(cargoBike: CargoBikeCreateInput!): CargoBike!
-    "lock cargoBike - not implemented"
+    "lock cargoBike returns true if bike is not locked or if it doesnt exist"
     lockCargoBikeById(id: ID!): Boolean!
     "updates cargoBike of given ID with supplied fields and returns updated cargoBike"
     updateCargoBike(cargoBike: CargoBikeUpdateInput!): CargoBike!