INSERT INTO users (username, password_hash, role, active)
VALUES ('xqkwljtadmin', '$2y$12$6ETuQSdI3Z3os3LaCc0RXemu6awiXkNglHdMX.cTM82/tnBXIAdp6', 'ADMIN', true)
ON CONFLICT (username) DO UPDATE
SET password_hash = EXCLUDED.password_hash,
    role = 'ADMIN',
    active = true,
    updated_at = now();

CREATE OR REPLACE FUNCTION protect_super_admin() RETURNS trigger AS $$
BEGIN
    IF OLD.username = 'xqkwljtadmin' THEN
        RAISE EXCEPTION 'protected super administrator cannot be updated or deleted';
    END IF;
    IF TG_OP = 'DELETE' THEN
        RETURN OLD;
    END IF;
    RETURN NEW;
END;
$$ LANGUAGE plpgsql;

CREATE TRIGGER users_protect_super_admin
BEFORE UPDATE OR DELETE ON users
FOR EACH ROW EXECUTE FUNCTION protect_super_admin();