Vaultwarden: Set "vault timeout" policy globally

#!/bin/bash

# Check if sqlite3 is installed
if ! command -v sqlite3 &> /dev/null; then
   echo "Error: sqlite3 is not installed."
   echo "Please install sqlite3 before running this script."
   echo "On Debian-based systems, you can install it with:"
   echo "  sudo apt-get install sqlite3"
   echo "On Red Hat-based systems, you can install it with:"
   echo "  sudo yum install sqlite"
   exit 1
fi

# Function to remove all vault timeout entries
remove_atype_9_entries() {
   local remove_query="DELETE FROM org_policies WHERE atype='9';"
   sqlite3 "$DB_FILE" "$remove_query"
   echo "Disabled Enterprise Policy by deleting the DB entry"
}

# Get the SQLite database file path from the user with error handling
while true; do
   clear
   read -p $'Enter the path to the SQLite database file \n(Hint: /var/lib/docker/volumes/.../vw-data/db.sqlite3): ' DB_FILE
   if [ -f "$DB_FILE" ]; then
       break
   else
       clear
       echo "Error: The file does not exist. Please enter a valid file path."
   fi
done

# Get the vault timeout from the user with error handling
while true; do
   clear
   read -p "Enter the vault timeout [in minutes] you want to set for all organizations: " LOCK_TIMEOUT
   if [[ "$LOCK_TIMEOUT" =~ ^[0-9]+$ ]]; then
       break
   else
       clear
       echo "Error: Invalid input. Please enter a valid integer value."
   fi
done

# Get the vault timeout action from user
while true; do
   clear
   read -p "Select the vault timeout action that is performed after the timeout [0=null(UserDefined) or 1=logOut or 2=lock or 3=(disable enterprise policy by deleting the DB entry) ]: " LOCK_ACTION
   if [[ "$LOCK_ACTION" =~ ^[0-3]+$ ]]; then
       if [[ "$LOCK_ACTION" == 0 ]]; then
           LOCK_ACTION="null"
       elif [[ "$LOCK_ACTION" == 1 ]]; then
           LOCK_ACTION="logOut"
       elif [[ "$LOCK_ACTION" == 2 ]]; then
           LOCK_ACTION="lock"
       elif [[ "$LOCK_ACTION" == 3 ]]; then
           REMOVE_OPTION="yes"
       fi
       break
   else
       clear
       echo "Error: Invalid input. Please enter a valid lockout action [0=null(UserDefined) or 1=logOut or 2=lock or 3=(disable enterprise policy by deleting the DB entry)]."
   fi
done

# Perform removal if requested
if [ "$REMOVE_OPTION" == "yes" ]; then
   remove_atype_9_entries
   exit 0
fi

# SQL query to retrieve UUIDs from the organizations table
UUID_QUERY="SELECT uuid FROM organizations;"

# Execute the UUID query and store the result in an array
UUID_ARRAY=()
while IFS= read -r uuid; do
   UUID_ARRAY+=("$uuid")
done < <(sqlite3 "$DB_FILE" "$UUID_QUERY")

# Loop through the UUID array and execute the SQL insert or update query for each UUID
for uuid in "${UUID_ARRAY[@]}"; do
   # Check if org_uuid and atype combination already exists
   if [[ $(sqlite3 "$DB_FILE" "SELECT COUNT(*) FROM org_policies WHERE org_uuid='$uuid' AND atype='9';") -gt 0 ]]; then
       # Update existing row with new lock timeout
       UPDATE_QUERY="UPDATE org_policies SET data='{\"minutes\":$LOCK_TIMEOUT,\"action\":\"$LOCK_ACTION\"}' WHERE org_uuid='$uuid' AND atype='9';"
       sqlite3 "$DB_FILE" "$UPDATE_QUERY"
       echo "Vault timeout entry already exists for UUID: $uuid. Updated vault timeout to $LOCK_TIMEOUT minutes and lockout action to $LOCK_ACTION ."
   else
       # Create a random UUID for newly inserted org_policy
       RAND_UUID=$(cat /proc/sys/kernel/random/uuid)
       # Insert new row with lock timeout
       INSERT_QUERY="INSERT INTO org_policies (uuid, org_uuid, atype, enabled, data) VALUES ('$RAND_UUID', '$uuid', '9', '1', '{\"minutes\":$LOCK_TIMEOUT,\"action\":\"$LOCK_ACTION\"}');"
sqlite3 "$DB_FILE" "$INSERT_QUERY"
       sqlite3 "$DB_FILE" "$INSERT_QUERY"
       echo "Inserted new vault timeout entry for UUID: $uuid with a timeout of $LOCK_TIMEOUT minutes and lockout action to $LOCK_ACTION ."
   fi
done