-- The bootstrap flow is the sole way to create a system administrator.
-- This database constraint closes the last concurrent-request race even if
-- two bootstrap enrollments reach their final transaction simultaneously.
CREATE UNIQUE INDEX IF NOT EXISTS users_single_system_admin
  ON users ((role))
  WHERE role = 'system_admin';

-- PostgreSQL grants EXECUTE on new functions to PUBLIC by default. These two
-- SECURITY DEFINER helpers deliberately cross tenant discovery boundaries and
-- must only be callable by their owner (the current runtime/migration role).
REVOKE EXECUTE ON FUNCTION public.lookup_component_access_token(BYTEA) FROM PUBLIC;
REVOKE EXECUTE ON FUNCTION public.list_active_live_sources() FROM PUBLIC;