fix: Resolve password_hash default value error and disable OTP autofill

backend/app/Controllers/AuthController.php

@@ -129,10 +129,6 @@ class AuthController
             ]
         ];
 
-        if ($isDebug) {
-            $resData['debug_otp'] = $otp;
-        }
-
         $response->json($resData);
     }
 
@@ -181,9 +177,6 @@ class AuthController
         if ($storedHash && password_verify($inputOtp, $storedHash)) {
             $isValidOtp = true;
             $redis->del($otpKey); // Invalidate OTP after success
-        } elseif (getenv('APP_DEBUG') && $inputOtp === '123456') {
-            // Master debug OTP
-            $isValidOtp = true;
         }
 
         if (!$isValidOtp) {
@@ -209,10 +202,11 @@ class AuthController
 
             $encryptedPhone = Security::encrypt($cleanPhone);
             $encryptedName  = Security::encrypt($fullName ?: ($role === 'teacher' ? 'معلم جديد' : 'طالب جديد'));
+            $randomPassword = password_hash(bin2hex(random_bytes(16)), PASSWORD_BCRYPT);
 
             $userId = Database::insert(
-                "INSERT INTO users (uuid, full_name, phone_number, phone_hash, role, status, token_version) VALUES (?, ?, ?, ?, ?, 'active', 1)",
+                "INSERT INTO users (uuid, full_name, phone_number, phone_hash, password_hash, role, status, token_version) VALUES (?, ?, ?, ?, ?, ?, 'active', 1)",
-                [$uuid, $encryptedName, $encryptedPhone, $phoneHash, $role]
+                [$uuid, $encryptedName, $encryptedPhone, $phoneHash, $randomPassword, $role]
             );
 
             $user = [

backend/app/Views/StudentPortal.php

@@ -786,13 +786,13 @@ class StudentPortal
             clearInterval(countdownTimer);
         }
 
-        function switchToOtpStep(maskedPhone, debugOtp) {
+        function switchToOtpStep(maskedPhone) {
             document.getElementById('step_phone_container').style.display = 'none';
             document.getElementById('step_otp_container').style.display = 'block';
             document.getElementById('otp_target_display').textContent = maskedPhone;
-            if (debugOtp) {
+            const otpInput = document.getElementById('student_otp_code');
-                document.getElementById('student_otp_code').value = debugOtp;
+            otpInput.value = '';
-            }
+            otpInput.focus();
             startTimer(60);
         }
 

backend/app/Views/TeacherPortal.php

@@ -724,13 +724,13 @@ class TeacherPortal
             clearInterval(countdownTimer);
         }
 
-        function switchToOtpStep(maskedPhone, debugOtp) {
+        function switchToOtpStep(maskedPhone) {
             document.getElementById('step_phone_container').style.display = 'none';
             document.getElementById('step_otp_container').style.display = 'block';
             document.getElementById('otp_target_display').textContent = maskedPhone;
-            if (debugOtp) {
+            const otpInput = document.getElementById('teacher_otp_code');
-                document.getElementById('teacher_otp_code').value = debugOtp;
+            otpInput.value = '';
-            }
+            otpInput.focus();
             startTimer(60);
         }
 

backend/database_schema.sql

@@ -53,7 +53,7 @@ CREATE TABLE `users` (
   `full_name` TEXT NOT NULL,
   `phone_number` TEXT NOT NULL,
   `phone_hash` VARCHAR(64) NOT NULL,
-  `password_hash` VARCHAR(255) NOT NULL,
+  `password_hash` VARCHAR(255) DEFAULT NULL,
   `role` ENUM('student', 'guardian', 'teacher', 'school_admin', 'super_admin') NOT NULL DEFAULT 'student',
   `school_id` BIGINT UNSIGNED DEFAULT NULL,
   `grade_level` VARCHAR(50) DEFAULT 'tawjihi_2007',