Redmine

oauth_access_grants.resource_owner_id and oauth_access_tokens.resource_owner_id have foreign keys referencing users (added in
source:trunk/db/migrate/20250611092155_create_doorkeeper_tables.rb), but User has no association that removes these records. As a result, deleting a user who has ever authorized an OAuth2 application fails with an Internal Server Error:

ActiveRecord::InvalidForeignKey (PG::ForeignKeyViolation: ERROR: update or delete on table "users"
violates foreign key constraint "fk_rails_330c32d8d9" on table "oauth_access_grants"
DETAIL: Key (id)=(193) is still referenced from table "oauth_access_grants".)

Revoking the authorization on the client side does not help, because Doorkeeper only sets revoked_at and keeps the rows.

Steps to reproduce: 1. Register an OAuth2 application. 2. Authorize it as a user. 3. Delete that user from Administration > Users.

The attached patch adds the missing associations to User and tests for both grants and tokens. Based on r24882.