Defect #44343
open
Deleting a user who has authorized an OAuth2 application fails with ActiveRecord::InvalidForeignKey
Description
oauth_access_grants.resource_owner_id and oauth_access_tokens.resource_owner_id have foreign keys referencing users (added in
source:trunk/db/migrate/20250611092155_create_doorkeeper_tables.rb), but User has no association that removes these records. As a result, deleting a user who has ever authorized an OAuth2 application fails with an Internal Server Error:
ActiveRecord::InvalidForeignKey (PG::ForeignKeyViolation: ERROR: update or delete on table "users"
violates foreign key constraint "fk_rails_330c32d8d9" on table "oauth_access_grants"
DETAIL: Key (id)=(193) is still referenced from table "oauth_access_grants".)
Revoking the authorization on the client side does not help, because Doorkeeper only sets revoked_at and keeps the rows.
Steps to reproduce: 1. Register an OAuth2 application. 2. Authorize it as a user. 3. Delete that user from Administration > Users.
The attached patch adds the missing associations to User and tests for both grants and tokens. Based on r24882.
Files
No data to display