supabase/functions/request-otp/index.ts

@@ -89,14 +89,11 @@ Deno.serve(async (request) => {
     const clientIp = getClientIp(request);
     const userAgent = request.headers.get("user-agent") || null;
 
-    // Insert with OTP hash for verification. otp_code (plaintext) is also stored
-    // because DB has it NOT NULL and the send_pin trigger (→ n8n webhook) emails
-    // this exact code to the user. verify-otp still compares the SHA-256 hash.
+    // Insert with OTP hash only — no plaintext in DB
     const { error: insertError } = await supabase.from("login_otps").insert({
       email,
       name: userName,
       role: userRole,
-      otp_code: otp,
       otp_code_hash: otpCodeHash,
       ip_address: clientIp,
       user_agent: userAgent,