AuthRepository.cs

public async Task ResetPassword(ResetPasswordRequest request)
        {
            var account = GetuserByOtp(request.Otp);

            if (account == null || account.OTPExpiresAt < DateTime.Now)
            {
                throw new BadHttpRequestException("Invalid OTP");
            }

            account.PasswordHash = BCrypt.Net.BCrypt.HashPassword(request.Password);
            account.PasswordResetAt = DateTime.Now;
            account.OTP = null;
            account.OTPExpiresAt = DateTime.MinValue;

            _context.Users.Update(account);
            await _context.SaveChangesAsync();
        }