test(auth): manual test for email/password + MFA/TOTP flow

took demo app from PR and ingested it here as local test

- added ability to sign up a new email/pass, not just login
- added ability to detect unverified email, send verify email, and reload user
- added QR code display for TOTP enroll flow

Author: mikehardy

packages/auth/lib/TotpMultiFactorGenerator.js

@@ -44,6 +44,7 @@ export default class TotpMultiFactorGenerator {
       // hashingAlgorithm, codeLength, codeIntervalSeconds, enrollmentCompletionDeadline
     } = await auth.native.generateTotpSecret(session);
 
-    return new TotpSecret(secretKey);
+    const totpSecret = new TotpSecret(secretKey, auth);
+    return totpSecret;
   }
 }

packages/auth/lib/TotpSecret.js

@@ -1,40 +1,17 @@
 export class TotpSecret {
-  constructor(
-    secretKey,
-    hashingAlgorithm,
-    codeLength,
-    codeIntervalSeconds,
-    enrollmentCompletionDeadline,
-  ) {
+  constructor(secretKey, auth) {
+    // The native TotpSecret has many more properties, but they are
+    // internal to the native SDKs, we only maintain the secret in JS layer
     this.secretKey = secretKey;
-    this.hashingAlgorithm = hashingAlgorithm;
-    this.codeLength = codeLength;
-    this.codeIntervalSeconds = codeIntervalSeconds;
-    this.enrollmentCompletionDeadline = enrollmentCompletionDeadline;
+
+    // we do need a handle to the correct auth instance to generate QR codes etc
+    this.auth = auth;
   }
 
-  sessionInfo = null;
-  auth = null;
   /**
    * Shared secret key/seed used for enrolling in TOTP MFA and generating OTPs.
    */
   secretKey = null;
-  /**
-   * Hashing algorithm used.
-   */
-  hashingAlgorithm = null;
-  /**
-   * Length of the one-time passwords to be generated.
-   */
-  codeLength = null;
-  /**
-   * The interval (in seconds) when the OTP codes should change.
-   */
-  codeIntervalSeconds = null;
-  /**
-   * The timestamp (UTC string) by which TOTP enrollment should be completed.
-   */
-  enrollmentCompletionDeadline = null;
 
   /**
    * Returns a QR code URL as described in