How to protect my metadata from users?

Short answer:

It's hard to do it once they have access to the database file.

You can hide or encrypt bodies of stored procedures and triggers, although they can be partialy reconstructed from BLR (binary representation) if someone really wants to do it.

If you just want to prevent casual users from peeking into your stored procedure, trigger and view code, you can run these statements to delete the source code:

update RDB$PROCEDURES
set RDB$PROCEDURE_SOURCE = null
where RDB$SYSTEM_FLAG is null or RDB$SYSTEM_FLAG = 0;

update RDB$TRIGGERS
set RDB$TRIGGER_SOURCE = null
where RDB$SYSTEM_FLAG is null or RDB$SYSTEM_FLAG = 0;

update RDB$RELATIONS
set RDB$VIEW_SOURCE = null
where (RDB$SYSTEM_FLAG is null or RDB$SYSTEM_FLAG = 0)
and RDB$VIEW_BLR is not null;

Make sure you do that only on production databases, and not on your development system. Also, please note that once you run ALTER command on those objects, the source will be restored.


Long answer and more details can be found here:

http://www.firebirdsql.org/manual/fbmetasecur.html