fix(graphql-api): remove verify_totp, a mutation that does not exist (#91)

The page documented a `verify_totp` mutation, an input type
`VerifyTOTPRequest`, a `token` param and a `recovery_code` response
field. None of them exist in the schema. TOTP is verified with
verify_otp(is_totp: true), the same mutation used for email and SMS.

Also on the login response table: `totp_base64_url` and `totp_token`
are not AuthResponse fields. The real ones are
authenticator_scanner_image, authenticator_secret and
authenticator_recovery_codes.

verify_otp's own params table was missing is_totp and state.

The {#verify_totp} anchor is kept so existing deep links resolve.

Author: lakhansamani

docs/core/graphql-api.md

@@ -426,7 +426,7 @@ A mutation to login users using email and password. It accepts `params` of type
 Either `email` or `phone_number` is required to login
 
 > Note: To enable MFA, go to dashboard and enable MFA for user. By default, TOTP MFA will be enabled. If SMTP details are provided then Mail OTP can also be enabled. One can only enable one MFA at a time.
-> For TOTP verification use `verify_totp` mutation, and for verifying mail OTP use `verify_otp` mutation.
+> Every second factor is verified with the same [`verify_otp`](#verify_otp) mutation — pass `is_totp: true` for an authenticator code, and omit it for an email or SMS code.
 
 **Request Params**
 
@@ -452,8 +452,9 @@ This mutation returns `AuthResponse` type with following keys
 | `id_token`                      | JWT token holding the user information                                                                                                            |
 | `refresh_token`                 | When scope includes `offline_access`, Long living token is returned which can be used to get new access tokens. This is rotated with each request |
 | `user`                          | User object with its profile keys mentioned [above](#profile).                                                                                  |
-| `totp_base64_url`               | If totp enabled, will get base64 url for QR code, which can be scanned on google authenticator                                                    |
-| `totp_token`                    | this token is for totp which need to passed in verify_totp mutation along with totp from your authenticator                                       |
+| `authenticator_scanner_image`   | If TOTP enrollment is in progress, a base64 QR image that can be scanned with an authenticator app                                                |
+| `authenticator_secret`          | The TOTP shared secret, for entering by hand when a QR code cannot be scanned                                                                    |
+| `authenticator_recovery_codes`  | Recovery codes, returned once when TOTP enrollment completes                                                                                     |
 
 **Sample Mutation**
 
@@ -734,6 +735,8 @@ Mutation to verify OTP sent to the user. It accepts `params` of type `VerifyOTPR
 | `email`        | Email address of user                              | false    |
 | `phone_number` | Phone number of user                               | false    |
 | `otp`          | OTP (One Time Password) sent to user email address | true     |
+| `is_totp`      | Set `true` when the code came from an authenticator app rather than email/SMS. Also completes TOTP enrollment after `totp_mfa_setup` | false |
+| `state`        | Authorization-code grant flow state, to obtain a `code` for an in-progress `/authorize` request | false |
 
 Either `email` or `phone_number` is required
 
@@ -922,16 +925,25 @@ Lists the authenticated caller's own registered passkeys. Returns `[WebauthnCred
 
 Deletes one of the authenticated caller's own passkeys by `id`. Returns `Response`. Requires authentication.
 
-### `verify_totp`
+### Verifying TOTP {#verify_totp}
 
-Mutation to verify TOTP generated by QR code. It accepts `params` of type `VerifyTOTPRequest` with following keys as parameter
+There is no separate `verify_totp` mutation. TOTP codes go through
+[`verify_otp`](#verify_otp) with `is_totp: true` — the same mutation that verifies
+email and SMS codes, so one code path handles every second factor.
 
-**Request Params**
+**Request Params** (`VerifyOTPRequest`)
 
-| Key     | Description                                  | Required |
-|---------|----------------------------------------------|----------|
-| `otp`   | totp generated on authenticator app          | true     |
-| `token` | will be generated at time of login, named `totp_token` | true     |
+| Key            | Description                                          | Required |
+|----------------|------------------------------------------------------|----------|
+| `email`        | Email address of user                                | false    |
+| `phone_number` | Phone number of user                                 | false    |
+| `otp`          | Code from the authenticator app                      | true     |
+| `is_totp`      | Must be `true` for an authenticator code             | true     |
+| `state`        | Authorization-code grant flow state                  | false    |
+
+Either `email` or `phone_number` is required — it identifies which pending login
+this code belongs to. The same call completes enrollment after
+[`totp_mfa_setup`](#totp_mfa_setup).
 
 This mutation returns `AuthResponse` type with following keys
 
@@ -945,13 +957,13 @@ This mutation returns `AuthResponse` type with following keys
 | `id_token`                      | JWT token holding the user information                                                                                                            |
 | `refresh_token`                 | When scope includes `offline_access`, Long living token is returned which can be used to get new access tokens. This is rotated with each request |
 | `user`                          | User object with its profile keys mentioned [above](#profile).                                                                                    |
-| `recovery_code`                 | One will get a recovery code when signed in first time using TOTP.                                                                                |
+| `authenticator_recovery_codes`  | Recovery codes, returned once when TOTP enrollment completes.                                                                                     |
 
 **Sample Mutation**
 
 ```graphql
 mutation {
-  verify_totp(params: { token: "token", otp: "AB123C" }) {
+  verify_otp(params: { email: "foo@bar.com", otp: "AB123C", is_totp: true }) {
     user {
       email
       given_name