Reactivate inactive users on successful OTP login or password reset.

OTP already proved phone ownership; treating is_active as a hard block made send-otp succeed while login-otp returned a misleading not-registered error.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/auth/auth.service.ts

@@ -367,6 +367,8 @@ export class AuthService {
     await this.prisma.user.update({
       where: { id: user.id },
       data: {
+        // OTP proves phone ownership — reactivate accounts left inactive (e.g. unfinished signup).
+        isActive: true,
         cellVerifiedAt: user.cellVerifiedAt ?? new Date(),
         lastLoginAt: new Date(),
       },
@@ -390,6 +392,7 @@ export class AuthService {
       where: { id: user.id },
       data: {
         passwordHash,
+        isActive: true,
         cellVerifiedAt: user.cellVerifiedAt ?? new Date(),
       },
     });
@@ -399,13 +402,13 @@ export class AuthService {
     };
   }
 
-  /** Validates OTP (or skips when SMS is disabled) and returns the active user. */
+  /** Validates OTP (or skips when SMS is disabled) and returns the user. */
   private async consumeOtp(cellNumber: string, code: string) {
     const user = await this.prisma.user.findUnique({
       where: { cellNumber },
     });
 
-    if (!user || !user.isActive) {
+    if (!user) {
       throw new UnauthorizedException('Cell number is not registered');
     }