Document second password reset flow [ci skip]

Author: mcelicalderon

README.md

@@ -461,11 +461,11 @@ Operation | Description | Example
 login | This mutation has a second field by default. `credentials` can be fetched directly on the mutation return type.<br>Credentials are still returned in the headers of the response. | userLogin(email: String!, password: String!): UserLoginPayload
 logout | | userLogout: UserLogoutPayload
 signUp | The parameter `confirmSuccessUrl` is optional unless you are using the `confirmable` plugin from Devise in your `resource`'s model. If you have `confirmable` set up, you will have to provide it unless you have `config.default_confirm_success_url` set in `config/initializers/devise_token_auth.rb`. | userSignUp(email: String!, password: String!, passwordConfirmation: String!, confirmSuccessUrl: String): UserSignUpPayload
+sendPasswordResetWithToken | Sends an email to the provided address with a link to reset the password of the resource. First step of the most recently implemented password reset flow. | userSendPasswordResetWithToken(email: String!, redirectUrl: String!): UserSendPasswordResetWithTokenPayload
+updatePasswordWithToken | Uses a `resetPasswordToken` to update the password of a resource. Second and last step of the most recently implemented password reset flow. | userSendPasswordResetWithToken(resetPasswordToken: String!, password: String!, passwordConfirmation: String!): UserUpdatePasswordWithTokenPayload
+resendConfirmation | The `UserResendConfirmationPayload` will return the `authenticatable` resource that was sent the confirmation instructions but also has a `message: String!` that can be used to notify a user what to do after the instructions were sent to them | userResendConfirmation(email: String!, redirectUrl: String!): UserResendConfirmationPayload
 sendResetPassword | Sends an email to the provided address with a link to reset the password of the resource. **This mutation is part of the first and soon to be deprecated password reset flow.** | userSendResetPassword(email: String!, redirectUrl: String!): UserSendReserPasswordPayload
 updatePassword | The parameter `currentPassword` is optional if you have `config.check_current_password_before_update` set to false (disabled by default) on your generated `config/initializers/devise_token_aut.rb` or if the `resource` model supports the `recoverable` Devise plugin and the `resource`'s `allow_password_change` attribute is set to true (this is done in the `userCheckPasswordToken` query when you click on the sent email's link). **This mutation is part of the first and soon to be deprecated password reset flow.** | userUpdatePassword(password: String!, passwordConfirmation: String!, currentPassword: String): UserUpdatePasswordPayload
-resendConfirmation | The `UserResendConfirmationPayload` will return the `authenticatable` resource that was sent the confirmation instructions but also has a `message: String!` that can be used to notify a user what to do after the instructions were sent to them | userResendConfirmation(email: String!, redirectUrl: String!): UserResendConfirmationPayload
-userSendPasswordResetWithToken | Sends an email to the provided address with a link to reset the password of the resource. First step of the most recently implemented password reset flow. | userSendPasswordResetWithToken(email: String!, redirectUrl: String!): UserSendPasswordResetWithTokenPayload
-userUpdatePasswordWithToken | Uses a `resetPasswordToken` to update the password of a resource. Second and last step of the most recently implemented password reset flow. | userSendPasswordResetWithToken(resetPasswordToken: String!, password: String!, passwordConfirmation: String!): UserUpdatePasswordWithTokenPayload
 
 #### Queries
 Operation | Description | Example

docs/usage/reset_password_flow.md

@@ -8,7 +8,7 @@ to return a redirect on the response. Flow 2 might be deprecated in the future.
 This flow only has two steps. Each step name refers to the operation name you can use in the mount options to skip or override.
 
 ### 1. send_password_reset_with_token
-This operation on the gem will send an email to the specified address if it's found on the system. Returns an error if the email is not found. Here's an example assuming the resource used
+This mutation will send an email to the specified address if it's found on the system. Returns an error if the email is not found. Here's an example assuming the resource used
 for authentication is `User`:
 ```graphql
 mutation {
@@ -48,3 +48,43 @@ on how to extend the default behavior of mutations, but
 [here](https://github.com/graphql-devise/graphql_devise/blob/8c7c8a5ff1b35fb026e4c9499c70dc5f90b9187a/spec/dummy/app/graphql/mutations/reset_admin_password_with_token.rb)
 you can find an example mutation on what needs to be done in order for the mutation to return
 credentials after updating the password.
+
+## Flow 2 (Deprecated)
+This was the first flow to be implemented, requires an additional step and also to encode a GQL query in a url, so this is not the preferred method.
+Each step name refers to the operation name you can use in the mount options to skip or override.
+
+### 1. send_password_reset
+This mutation will send an email to the specified address if it's found on the system. Returns an error if the email is not found. Here's an example assuming the resource used
+for authentication is `User`:
+```graphql
+mutation {
+  userSendPasswordReset(
+    email:       "[email protected]",
+    redirectUrl: "https://google.com"
+  ) {
+    message
+  }
+}
+```
+The email will contain an encoded GraphQL query that holds the reset token and redirectUrl.
+The query is described in the next step.
+
+### 2. check_password_token
+This query checks the reset password token and if successful changes a column in the DB (`allow_password_change`) to true.
+This change will allow for the next step to update the password without providing the current password.
+Then, this query will redirect to the provided `redirectUrl` with credentials.
+
+### 3. update_password
+This step requires the request to include authentication headers and will allow the user to
+update the password if step 2 was successful.
+Here's an example assuming the resource used for authentication is `User`:
+```graphql
+mutation {
+  userUpdatePassword(
+    password: "password123",
+    passwordConfirmation: "password123"
+  ) {
+    authenticatable { email }
+  }
+}
+```