From 62016308651ca906ce16bafe95631d8a6d2ae168 Mon Sep 17 00:00:00 2001
From: Hamza-Ayed <hamzaayedflutter@gmail.com>
Date: Wed, 26 Aug 2026 23:24:35 +0300
Subject: [PATCH] fix: Resolve password_hash default value error and disable
 OTP autofill

---
 backend/app/Controllers/AuthController.php | 12 +++---------
 backend/app/Views/StudentPortal.php        |  8 ++++----
 backend/app/Views/TeacherPortal.php        |  8 ++++----
 backend/database_schema.sql                |  2 +-
 4 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/backend/app/Controllers/AuthController.php b/backend/app/Controllers/AuthController.php
index 0c29a27..c9e994d 100644
--- a/backend/app/Controllers/AuthController.php
+++ b/backend/app/Controllers/AuthController.php
@@ -129,10 +129,6 @@ class AuthController
             ]
         ];
 
-        if ($isDebug) {
-            $resData['debug_otp'] = $otp;
-        }
-
         $response->json($resData);
     }
 
@@ -181,9 +177,6 @@ class AuthController
         if ($storedHash && password_verify($inputOtp, $storedHash)) {
             $isValidOtp = true;
             $redis->del($otpKey); // Invalidate OTP after success
-        } elseif (getenv('APP_DEBUG') && $inputOtp === '123456') {
-            // Master debug OTP
-            $isValidOtp = true;
         }
 
         if (!$isValidOtp) {
@@ -209,10 +202,11 @@ class AuthController
 
             $encryptedPhone = Security::encrypt($cleanPhone);
             $encryptedName  = Security::encrypt($fullName ?: ($role === 'teacher' ? 'معلم جديد' : 'طالب جديد'));
+            $randomPassword = password_hash(bin2hex(random_bytes(16)), PASSWORD_BCRYPT);
 
             $userId = Database::insert(
-                "INSERT INTO users (uuid, full_name, phone_number, phone_hash, role, status, token_version) VALUES (?, ?, ?, ?, ?, 'active', 1)",
-                [$uuid, $encryptedName, $encryptedPhone, $phoneHash, $role]
+                "INSERT INTO users (uuid, full_name, phone_number, phone_hash, password_hash, role, status, token_version) VALUES (?, ?, ?, ?, ?, ?, 'active', 1)",
+                [$uuid, $encryptedName, $encryptedPhone, $phoneHash, $randomPassword, $role]
             );
 
             $user = [
diff --git a/backend/app/Views/StudentPortal.php b/backend/app/Views/StudentPortal.php
index 26fb45c..cb71370 100644
--- a/backend/app/Views/StudentPortal.php
+++ b/backend/app/Views/StudentPortal.php
@@ -786,13 +786,13 @@ class StudentPortal
             clearInterval(countdownTimer);
         }
 
-        function switchToOtpStep(maskedPhone, debugOtp) {
+        function switchToOtpStep(maskedPhone) {
             document.getElementById('step_phone_container').style.display = 'none';
             document.getElementById('step_otp_container').style.display = 'block';
             document.getElementById('otp_target_display').textContent = maskedPhone;
-            if (debugOtp) {
-                document.getElementById('student_otp_code').value = debugOtp;
-            }
+            const otpInput = document.getElementById('student_otp_code');
+            otpInput.value = '';
+            otpInput.focus();
             startTimer(60);
         }
 
diff --git a/backend/app/Views/TeacherPortal.php b/backend/app/Views/TeacherPortal.php
index 16eee5c..21183d3 100644
--- a/backend/app/Views/TeacherPortal.php
+++ b/backend/app/Views/TeacherPortal.php
@@ -724,13 +724,13 @@ class TeacherPortal
             clearInterval(countdownTimer);
         }
 
-        function switchToOtpStep(maskedPhone, debugOtp) {
+        function switchToOtpStep(maskedPhone) {
             document.getElementById('step_phone_container').style.display = 'none';
             document.getElementById('step_otp_container').style.display = 'block';
             document.getElementById('otp_target_display').textContent = maskedPhone;
-            if (debugOtp) {
-                document.getElementById('teacher_otp_code').value = debugOtp;
-            }
+            const otpInput = document.getElementById('teacher_otp_code');
+            otpInput.value = '';
+            otpInput.focus();
             startTimer(60);
         }
 
diff --git a/backend/database_schema.sql b/backend/database_schema.sql
index 827e2ca..ea2a8f1 100644
--- a/backend/database_schema.sql
+++ b/backend/database_schema.sql
@@ -53,7 +53,7 @@ CREATE TABLE `users` (
   `full_name` TEXT NOT NULL,
   `phone_number` TEXT NOT NULL,
   `phone_hash` VARCHAR(64) NOT NULL,
-  `password_hash` VARCHAR(255) NOT NULL,
+  `password_hash` VARCHAR(255) DEFAULT NULL,
   `role` ENUM('student', 'guardian', 'teacher', 'school_admin', 'super_admin') NOT NULL DEFAULT 'student',
   `school_id` BIGINT UNSIGNED DEFAULT NULL,
   `grade_level` VARCHAR(50) DEFAULT 'tawjihi_2007',