Redmine

When an API request is authenticated with an OAuth access token and the Redmine user who authorized it is not active (for example, a locked user), Redmine responds with 500 Internal Server Error instead of 401 Unauthorized.

This happens because ApplicationController#find_current_user looks up the user with User.active.find_by_id, which returns nil for an inactive user, and then calls oauth_scope= on nil, raising a NoMethodError.

The attached patch skips setting the OAuth scope when no active user is found. The request is then treated as anonymous and receives 401, the same as an API key request made by a locked user.