fix(users): check before send update request if user is protected

db/users/update.go

@@ -47,6 +47,17 @@ func UpdateUser(ctx context.Context, app, addonUUID, username string) error {
 	if !userExists {
 		return errors.New(ctx, fmt.Sprintf("User \"%s\" does not exist", username))
 	}
+	// Check if the user is protected
+	var userIsProtected bool
+	for _, user := range l {
+		if user.Protected {
+			userIsProtected = true
+			break
+		}
+	}
+	if userIsProtected {
+		return errors.New(ctx, fmt.Sprintf("User \"%s\" is protected and cannot be updated", username))
+	}
 
 	password, confirmedPassword, err := askForPasswordWithRetry(ctx, 3)
 	if err != nil {