graphql_devise 0.12.3 → 0.13.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3ddce4ffb15dd4eac50fd0756808ce5fdef81a2f5fcc3405e8c00e5a7c51b689
-  data.tar.gz: b47284dc35df29df8a9bd2ef17cb68dde81e4a183cae904220167a37efbd6a05
+  metadata.gz: c9dba7aa9a87c5c0953373fd59cb4648d066925ddf65220efeed6e3228cc72af
+  data.tar.gz: d2b5adb287e426bfed8d222301673123740e5495216c5ee1f6fb14e6aeb549f7
 SHA512:
-  metadata.gz: 7dfb908c7284d5aac400dac4424ab7b053cd9c2f8da6b684028d19fa651eb0bd9b76ac911063676bb923c71a882930aefb65c66f2081d441b0461fc226dddf7b
-  data.tar.gz: 5f49d0b6b687b32de66836f9617eeb344b6c7dd77045b7a3e936f570799f9076c88f6d1abf152ba5ae54d034b5a31a0f106b0593359b742da5b7898578675633
+  metadata.gz: 588b3fda6584de9db52e2a4b060c7ccd1915200e9711ca5b99046002daa47ecc0182aa4c392057a82883075a199adc89038a1ff7e0586c0b112af913f19cdf97
+  data.tar.gz: 6c6ffe1608ebc5eb18d1d3d000b2c4dc55ffc8cefd24f58f3078f307d2ebd4b9c8d32b213dadb589861c1c5d00f4d49dd96f97ac41941443ad1b25644b31cd73

data/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## [v0.13.4](https://github.com/graphql-devise/graphql_devise/tree/v0.13.4) (2020-08-15)
+
+[Full Changelog](https://github.com/graphql-devise/graphql_devise/compare/v0.13.3...v0.13.4)
+
+**Implemented enhancements:**
+
+- Allow resend of confirmation with unconfirmed email [\#127](https://github.com/graphql-devise/graphql_devise/pull/127) ([j15e](https://github.com/j15e))
+
+## [v0.13.3](https://github.com/graphql-devise/graphql_devise/tree/v0.13.3) (2020-08-13)
+
+[Full Changelog](https://github.com/graphql-devise/graphql_devise/compare/v0.13.2...v0.13.3)
+
+**Fixed bugs:**
+
+- Fix unconfirmed\_email confirmation. Ignore devise reconfirmable config. [\#126](https://github.com/graphql-devise/graphql_devise/pull/126) ([mcelicalderon](https://github.com/mcelicalderon))
+
+## [v0.13.2](https://github.com/graphql-devise/graphql_devise/tree/v0.13.2) (2020-08-12)
+
+[Full Changelog](https://github.com/graphql-devise/graphql_devise/compare/v0.13.1...v0.13.2)
+
+**Fixed bugs:**
+
+- Save resource after generating credentials in resource confirmation [\#125](https://github.com/graphql-devise/graphql_devise/pull/125) ([mcelicalderon](https://github.com/mcelicalderon))
+
+## [v0.13.1](https://github.com/graphql-devise/graphql_devise/tree/v0.13.1) (2020-07-29)
+
+[Full Changelog](https://github.com/graphql-devise/graphql_devise/compare/v0.13.0...v0.13.1)
+
+**Implemented enhancements:**
+
+- Add credentials field on signUp mutation [\#122](https://github.com/graphql-devise/graphql_devise/pull/122) ([mcelicalderon](https://github.com/mcelicalderon))
+
+**Closed issues:**
+
+- Checking for `performed?` when mounting into your graphql schema. [\#110](https://github.com/graphql-devise/graphql_devise/issues/110)
+- no query string for email reset [\#104](https://github.com/graphql-devise/graphql_devise/issues/104)
+
+## [v0.13.0](https://github.com/graphql-devise/graphql_devise/tree/v0.13.0) (2020-06-22)
+
+[Full Changelog](https://github.com/graphql-devise/graphql_devise/compare/v0.12.3...v0.13.0)
+
+**Breaking changes:**
+
+- Fix email reconfirmation feature [\#111](https://github.com/graphql-devise/graphql_devise/pull/111) ([mcelicalderon](https://github.com/mcelicalderon))
+
+**Implemented enhancements:**
+
+- Add frozen string literal to all relevant files [\#114](https://github.com/graphql-devise/graphql_devise/pull/114) ([mcelicalderon](https://github.com/mcelicalderon))
+
+**Fixed bugs:**
+
+- CookieOverflow for Own Schema Mount [\#112](https://github.com/graphql-devise/graphql_devise/issues/112)
+- Reconfirmable not setting unconfirmed\_email [\#102](https://github.com/graphql-devise/graphql_devise/issues/102)
+
 ## [v0.12.3](https://github.com/graphql-devise/graphql_devise/tree/v0.12.3) (2020-06-19)
 
 [Full Changelog](https://github.com/graphql-devise/graphql_devise/compare/v0.12.2...v0.12.3)

data/Gemfile

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 source 'https://rubygems.org'
 
 gemspec

data/README.md

@@ -14,19 +14,22 @@ GraphQL interface on top of the [Devise Token Auth](https://github.com/lynndylan
       * [Installation](#installation)
          * [Running the Generator](#running-the-generator)
             * [Mounting the Schema in a Separate Route](#mounting-the-schema-in-a-separate-route)
-            * [Mounting Operations in Your Own Schema](#mounting-operations-in-your-own-schema)
-         * [Important](#important)
+               * [Important](#important)
+            * [Mounting Operations in Your Own Schema (> v0.12.0)](#mounting-operations-in-your-own-schema--v0120)
+               * [Important](#important-1)
       * [Usage](#usage)
          * [Mounting Auth Schema on a Separate Route](#mounting-auth-schema-on-a-separate-route)
          * [Mounting Operations Into Your Own Schema](#mounting-operations-into-your-own-schema)
          * [Available Mount Options](#available-mount-options)
          * [Available Operations](#available-operations)
          * [Configuring Model](#configuring-model)
+         * [Email Reconfirmation](#email-reconfirmation)
          * [Customizing Email Templates](#customizing-email-templates)
          * [I18n](#i18n)
          * [Authenticating Controller Actions](#authenticating-controller-actions)
             * [Authenticate Before Reaching Your GQL Schema](#authenticate-before-reaching-your-gql-schema)
             * [Authenticate in Your GQL Schema](#authenticate-in-your-gql-schema)
+            * [Important](#important-2)
          * [Making Requests](#making-requests)
             * [Mutations](#mutations)
             * [Queries](#queries)
@@ -39,20 +42,19 @@ GraphQL interface on top of the [Devise Token Auth](https://github.com/lynndylan
       * [Contributing](#contributing)
       * [License](#license)
 
-<!-- Added by: mcelicalderon, at: Wed Jun 10 22:10:26 -05 2020 -->
+<!-- Added by: david, at: mar jul 14 08:08:02 -05 2020 -->
 
 <!--te-->
 
 ## Introduction
-This gem heavily relies on two gems, [Devise Token Auth](https://github.com/lynndylanhurley/devise_token_auth) (DTA)
-and [Devise](https://github.com/heartcombo/devise) which is a dependency of DTA.
-It provides a GraphQL interface on top of DTA which is designed to work with REST APIs. That's why
-things like token management, token expiration and everything up until using the actual GraphQL schema is
-still controlled by DTA. For that reason you will find that our generator runs these two gems generator and two
-initializer files are included. We'll provide more configuration details in the
-[configuration section](#more-configuration-options),
-but **we recommend you get familiar with [DTA and their docs](https://github.com/lynndylanhurley/devise_token_auth)
-in order to use this gem to its full potential**.
+Graphql-Devise heavily relies on two gems:
+- [Devise Token Auth](https://github.com/lynndylanhurley/devise_token_auth) (DTA)
+- [Devise](https://github.com/heartcombo/devise) (which is a DTA dependency)
+
+This gem provides a GraphQL interface on top of DTA which is designed for REST APIs. Features like token management, token expiration and everything up until using the actual GraphQL schema is still controlled by DTA. For that reason the gem's generator invokes DTA and Devise generators and creates initializer files for each one of them.
+
+**We strongly recommend getting familiar with [DTA documentation](https://github.com/lynndylanhurley/devise_token_auth) to use this gem to its full potential**.
+More configuration details available in [configuration section](#more-configuration-options)
 
 ## Installation
 
@@ -68,20 +70,21 @@ $ bundle
 ```
 
 ### Running the Generator
-Graphql Devise generator will execute `Devise` and `Devise Token Auth`
-generators for you. These will make the required changes for the gems to
-work correctly. All configurations for [Devise](https://github.com/plataformatec/devise) and
-[Devise Token Auth](https://github.com/lynndylanhurley/devise_token_auth) are available,
-so you can read the docs there to customize your options.
-Configurations are done via initializer files as usual, one per gem.
+Graphql Devise generator will execute `Devise` and `Devise Token Auth` generators to setup the gems in your project. You can customize them to your needs using their initializer files(one per gem) as usual.
 
-#### Mounting the Schema in a Separate Route
 ```bash
 $ bundle exec rails generate graphql_devise:install
 ```
+The generator accepts 2 params:
+- `user_class`: Model name in which `Devise` modules will be included. This uses a `find or create` strategy. Defaults to `User`.
+- `mount_path`: Path in which the dedicated graphql schema for devise will be mounted. Defaults to `/graphql_auth`.
 
-The generator accepts 2 params: `user_class` and `mount_path`. The params
-will be used to mount the route in `config/routes.rb`. For instance the executing:
+The option `mount` is available starting from `v0.12.0`. This option will allow you to mount the operations in your own schema instead of a dedicated one. When this option is provided `mount_path` param is not used.
+
+#### Mounting the Schema in a Separate Route
+
+To configure the gem to use a separate schema, the generator will use `user_class` and `mount_path` params.
+The route will be mounted in `config/routes.rb`. For instance the executing:
 
 ```bash
 $ bundle exec rails g graphql_devise:install Admin api/auth
@@ -99,32 +102,43 @@ Will do the following:
 `Admin` could be any model name you are going to be using for authentication,
 and `api/auth` could be any mount path you would like to use for auth.
 
-#### Mounting Operations in Your Own Schema
-Now you can provide to the generator an option specifying
-the name of your GQL schema. Doing this will skip the insertion of the mount method in the
-routes file and will also add our `SchemaPlugin` to the specified schema. `user_class` param is still optional (`Admin`) in the following example.
+##### Important
+ - Remember that by default this gem mounts a completely separate GraphQL schema on a separate controller in the route provided by the `at` option in the `mount_graphql_devise_for` method in the `config/routes.rb` file. If no `at` option is provided, the route will be `/graphql_auth`.
+ - Avoid passing the `--mount` option or the gem will try to use an existing schema.
+
+#### Mounting Operations in Your Own Schema (> v0.12.0)
+To configure the gem to use your own GQL schema use the `--mount` option. 
+For instance the executing:
 
 ```bash
 $ bundle exec rails g graphql_devise:install Admin --mount MySchema
 ```
 
-### Important
-Remember that by default this gem mounts a completely separate GraphQL schema on a separate controller in the route
-provided by the `at` option in the `mount_graphql_devise_for` method in the `config/routes.rb` file. If no `at`
-option is provided, the route will be `/graphql_auth`.
+Will do the following:
+- Execute `Devise` install generator
+- Execute `Devise Token Auth` install generator with `Admin` and `api/auth` as params
+  - Find or create `Admin` model
+  - Add `devise` modules to `Admin` model
+  - Other changes that you can find [here](https://devise-token-auth.gitbook.io/devise-token-auth/config)
+  - Add `SchemaPlugin` to the specified schema.
+
 
-**Starting with `v0.12.0`** you can opt-in to load this gem's queries and mutations into your
-own application's schema. You can actually mount a resource's auth schema in a separate route
-and in your app's schema at the same time, but that's probably not a common scenario. More on
-this in the next section.
+##### Important
+ - When using the `--mount` option the `mount_path` params is ignored.
+ - The generator will look for your schema under `app/graphql/` directory. We are expecting the name of the file is the same as the as the one passed in the mount option transformed with `underscore`. In the example, passing `MySchema`, will try to find the file `app/graphql/my_schema.rb`.
+ - You can actually mount a resource's auth schema in a separate route and in your app's schema at the same time, but that's probably not a common scenario.
 
 ## Usage
-### Mounting Auth Schema on a Separate Route
-The generator can do this step for you by default. Remember now you can mount this gem's
-auth operations into your own schema as described in [this section](#mounting-operations-into-your-own-schema).
+
+GraphqlDevise operations can be used in two ways:
+- Using a [separate schema](#mounting-auth-schema-on-a-separate-route) via `mount_graphql_devise_for` helper in the routes file.
+- Using [your own schema](#mounting-operations-into-your-own-schema) by adding a plugin in the class.
 
 
-Routes can be added using the generator or manually.
+Creating a separate schema is the default option, the generator will do that by default.
+
+### Mounting Auth Schema on a Separate Route
+
 You can mount this gem's GraphQL auth schema in your routes file like this:
 
 ```ruby
@@ -150,11 +164,13 @@ Rails.application.routes.draw do
   )
 end
 ```
+This can be done using the generator or manually.
 The second argument of the `mount_graphql_devise` method is a hash of options where you can
 customize how the queries and mutations are mounted into the schema. For a list of available
 options go [here](#available-mount-options)
 
 ### Mounting Operations Into Your Own Schema
+
 Starting with `v0.12.0` you can now mount the GQL operations provided by this gem into your
 app's main schema.
 
@@ -301,6 +317,46 @@ end
 The install generator can do this for you if you specify the `user_class` option.
 See [Installation](#installation) for details.
 
+### Email Reconfirmation
+Email reconfirmation is supported just like in Devise and DTA, but we want reconfirmable
+in this gem to work on model basis instead of having a global configuration like in Devise.
+**For this reason Devise's global `reconfirmable` setting is ignored.**
+
+For a resource to be considered reconfirmable it has to meet 2 conditions:
+1. Include the `:confirmable` module.
+1. Has an `unconfirmed_email` column in the resource's table.
+
+In order to trigger the reconfirmation email in a reconfirmable resource, you simply needi
+to call a different update method on your resource,`update_with_email`.
+When the resource is not reconfirmable or the email is not updated, this method behaves exactly
+the same as ActiveRecord's `update`.
+`update_with_email` requires two additional attributes when email will change or an error
+will be raised:
+
+1. `schema_url`: The full url where your GQL schema is mounted. You can get this value from the
+controller available in the context of your mutations and queries like this:
+```ruby
+  context[:controller].full_url_without_params
+```
+1. `confirmation_success_url`: This the full url where you want users to be redirected after
+the email has changed successfully (usually a front-end url). This value is mandatory
+unless you have set `default_confirm_success_url` in your devise_token_auth initializer.
+
+So, it's up to you where you require confirmation of changing emails.
+[Here's an example](https://github.com/graphql-devise/graphql_devise/blob/c4dcb17e98f8d84cc5ac002c66ed98a797d3bc82/spec/dummy/app/graphql/mutations/update_user.rb#L13)
+on how you might do this. And also a demonstration on the method usage:
+```ruby
+user.update_with_email(
+  name:                     'New Name',
+  email:                    'new@domain.com',
+  schema_url:               'http://localhost:3000/graphql',
+  confirmation_success_url: 'https://google.com'
+)
+```
+
+ We want reconfirmable in this gem to work separately
+ from DTA's or Devise (too much complexity in the model based on callbacks).
+
 ### Customizing Email Templates
 The approach of this gem is a bit different from DeviseTokenAuth. We have placed our templates in `app/views/graphql_devise/mailer`,
 so if you want to change them, place yours on the same dir structure on your Rails project. You can customize these two templates:
@@ -316,11 +372,10 @@ GraphQL Devise supports locales. For example, the `graphql_devise.confirmations.
 Keep in mind that if your app uses multiple locales, you should set the `I18n.locale` accordingly. You can learn how to do this [here](https://guides.rubyonrails.org/i18n.html).
 
 ### Authenticating Controller Actions
-Just like with Devise or DTA, you will need to authenticate users in your controllers.
-For this you have two alternatives.
+When mounting the operation is in you own schema instead of a dedicated one, you will need to authenticate users in your controllers, just like in DTA. There are 2 alternatives to accomplish this.
 
 #### Authenticate Before Reaching Your GQL Schema
-For this you need to call `authenticate_<model>!` in a before_action hook of your controller.
+For this you will need to call `authenticate_<model>!` in a `before_action` controller hook.
 In our example our model is `User`, so it would look like this:
 ```ruby
 # app/controllers/my_controller.rb
@@ -331,15 +386,14 @@ class MyController < ApplicationController
   before_action :authenticate_user!
 
   def my_action
-    render json: { current_user: current_user }
+    result = DummySchema.execute(params[:query], context: current_user: current_user)
+    render json: result unless performed?
   end
 end
 ```
 
-The install generator can do this for you because it executes DTA installer.
-See [Installation](#Installation) for details.
-If authentication fails for the request for whatever reason, execution of the request is halted
-and an error is returned in a REST format as the request never reaches your GQL schema.
+The install generator can include the concern in you application controller.
+If authentication fails for a request, execution will halt and a REST error will be returned since the request never reaches your GQL schema.
 
 #### Authenticate in Your GQL Schema
 For this you will need to add the `GraphqlDevise::SchemaPlugin` to your schema as described
@@ -352,7 +406,8 @@ class MyController < ApplicationController
   include GraphqlDevise::Concerns::SetUserByToken
 
   def my_action
-    render json: DummySchema.execute(params[:query], context: graphql_context(:user))
+    result = DummySchema.execute(params[:query], context: graphql_context(:user))
+    render json: result unless performed?
   end
 end
 ```
@@ -389,32 +444,28 @@ module Types
 end
 ```
 
+#### Important
+Remember to check `performed?` before rendering the result of the graphql operation. This is required because some operations perform a redirect and without this check you will get a `AbstractController::DoubleRenderError`.
+
 ### Making Requests
 Here is a list of the available mutations and queries assuming your mounted model is `User`.
 
 #### Mutations
-1. `userLogin(email: String!, password: String!): UserLoginPayload`
-
-    This mutation has a second field by default. `credentials` can be fetched directly on the mutation return type.
-    Credentials are still returned in the headers of the response.
-
-1. `userLogout: UserLogoutPayload`
-1. `userSignUp(email: String!, password: String!, passwordConfirmation: String!, confirmSuccessUrl: String): UserSignUpPayload`
-
-   The parameter `confirmSuccessUrl` is optional unless you are using the `confirmable` plugin from Devise in your `resource`'s model. If you have `confirmable` set up, you will have to provide it unless you have `config.default_confirm_success_url` set in `config/initializers/devise_token_auth.rb`.
-1. `userSendResetPassword(email: String!, redirectUrl: String!): UserSendReserPasswordPayload`
-1. `userUpdatePassword(password: String!, passwordConfirmation: String!, currentPassword: String): UserUpdatePasswordPayload`
-
-    The parameter `currentPassword` is optional if you have `config.check_current_password_before_update` set to
-    false (disabled by default) on your generated `config/initializers/devise_token_aut.rb` or if the `resource`
-    model supports the `recoverable` Devise plugin and the `resource`'s `allow_password_change` attribute is set to true (this is done in the `userCheckPasswordToken` query when you click on the sent email's link).
-1. `userResendConfirmation(email: String!, redirectUrl: String!): UserResendConfirmationPayload`
 
-    The `UserResendConfirmationPayload` will return the `authenticatable` resource that was sent the confirmation instructions but also has a `message: String!` that can be used to notify a user what to do after the instructions were sent to them
+Operation | Description | Example
+:--- | :--- | :------------------:
+login | This mutation has a second field by default. `credentials` can be fetched directly on the mutation return type.<br>Credentials are still returned in the headers of the response. | userLogin(email: String!, password: String!): UserLoginPayload
+logout | | userLogout: UserLogoutPayload
+signUp | The parameter `confirmSuccessUrl` is optional unless you are using the `confirmable` plugin from Devise in your `resource`'s model. If you have `confirmable` set up, you will have to provide it unless you have `config.default_confirm_success_url` set in `config/initializers/devise_token_auth.rb`. | userSignUp(email: String!, password: String!, passwordConfirmation: String!, confirmSuccessUrl: String): UserSignUpPayload
+sendResetPassword | | userSendResetPassword(email: String!, redirectUrl: String!): UserSendReserPasswordPayload
+updatePassword | The parameter `currentPassword` is optional if you have `config.check_current_password_before_update` set to false (disabled by default) on your generated `config/initializers/devise_token_aut.rb` or if the `resource` model supports the `recoverable` Devise plugin and the `resource`'s `allow_password_change` attribute is set to true (this is done in the `userCheckPasswordToken` query when you click on the sent email's link). | userUpdatePassword(password: String!, passwordConfirmation: String!, currentPassword: String): UserUpdatePasswordPayload
+resendConfirmation | The `UserResendConfirmationPayload` will return the `authenticatable` resource that was sent the confirmation instructions but also has a `message: String!` that can be used to notify a user what to do after the instructions were sent to them | userResendConfirmation(email: String!, redirectUrl: String!): UserResendConfirmationPayload
 
 #### Queries
-1. `userConfirmAccount(confirmationToken: String!, redirectUrl: String!): User`
-1. `userCheckPasswordToken(resetPasswordToken: String!, redirectUrl: String): User`
+Operation | Description | Example
+:--- | :--- | :------------------:
+confirmAccount | Performs a redirect using the `redirectUrl` param | userConfirmAccount(confirmationToken: String!, redirectUrl: String!): User
+checkPasswordToken | Performs a redirect using the `redirectUrl` param | userCheckPasswordToken(resetPasswordToken: String!, redirectUrl: String): User
 
 The reason for having 2 queries is that these 2 are going to be accessed when clicking on
 the confirmation and reset password email urls. There is no limitation for making mutation

data/Rakefile

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 begin
   require 'bundler/setup'
 rescue LoadError

data/app/controllers/graphql_devise/application_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module GraphqlDevise
   ApplicationController = if Rails::VERSION::MAJOR >= 5
     Class.new(ActionController::API)

data/app/controllers/graphql_devise/concerns/set_user_by_token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module GraphqlDevise
   module Concerns
     SetUserByToken = DeviseTokenAuth::Concerns::SetUserByToken
@@ -5,6 +7,10 @@ module GraphqlDevise
     SetUserByToken.module_eval do
       attr_accessor :client_id, :token, :resource
 
+      def full_url_without_params
+        request.base_url + request.path
+      end
+
       def set_resource_by_token(resource)
         set_user_by_token(resource)
       end

data/app/controllers/graphql_devise/graphql_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_dependency 'graphql_devise/application_controller'
 
 module GraphqlDevise

data/app/helpers/graphql_devise/application_helper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module GraphqlDevise
   module ApplicationHelper
   end

data/app/helpers/graphql_devise/mailer_helper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module GraphqlDevise
   module MailerHelper
     def confirmation_query(resource_name:, token:, redirect_url:)

data/app/models/graphql_devise/concerns/model.rb

@@ -1,5 +1,21 @@
+# frozen_string_literal: true
+
+require 'graphql_devise/model/with_email_updater'
+
 module GraphqlDevise
   module Concerns
     Model = DeviseTokenAuth::Concerns::User
+
+    Model.module_eval do
+      class_methods do
+        def reconfirmable
+          devise_modules.include?(:confirmable) && column_names.include?('unconfirmed_email')
+        end
+      end
+
+      def update_with_email(attributes = {})
+        GraphqlDevise::Model::WithEmailUpdater.new(self, attributes).call
+      end
+    end
   end
 end

data/app/views/graphql_devise/mailer/confirmation_instructions.html.erb

@@ -2,4 +2,4 @@
 
 <p><%= t('.confirm_link_msg') %></p>
 
-<p><%= link_to t('.confirm_account_link'), url_for(controller: message['controller'], action: message['action'], **confirmation_query(resource_name: @resource.class.to_s, redirect_url: message['redirect-url'], token: @token)) %></p>
+<p><%= link_to t('.confirm_account_link'), "#{message['schema_url']}?#{confirmation_query(resource_name: @resource.class.to_s, redirect_url: message['redirect-url'], token: @token).to_query}" %></p>