Merge remote-tracking branch 'upstream/pull/5159'

diff --git a/app/abilities/api_capability.rb b/app/abilities/api_capability.rb
index 44e67634552599c861f9320209e8a7810a155edd..07345d25475ab976c38643788e04fe7369f32c0f 100644 (file)
--- a/app/abilities/api_capability.rb
+++ b/app/abilities/api_capability.rb
@@ -5,11 +5,7 @@ class ApiCapability
 
   def initialize(token)
     if Settings.status != "database_offline"
-      user = if token.respond_to?(:resource_owner_id)
-               User.find(token.resource_owner_id)
-             elsif token.respond_to?(:user)
-               token.user
-             end
+      user = User.find(token.resource_owner_id)
 
       if user&.active?
         can [:create, :comment, :close, :reopen], Note if scope?(token, :write_notes)

diff --git a/test/abilities/api_capability_test.rb b/test/abilities/api_capability_test.rb
index bcfcaf74e4d809ad0a8aba72af5c0837f8af062d..5e8396c676ac754543f5e08c27b5d82045b33e52 100644 (file)
--- a/test/abilities/api_capability_test.rb
+++ b/test/abilities/api_capability_test.rb
@@ -88,12 +88,6 @@ end
 
 class UserApiCapabilityTest < ActiveSupport::TestCase
   test "user preferences" do
-    # a user with no tokens
-    capability = ApiCapability.new nil
-    [:index, :show, :update_all, :update, :destroy].each do |act|
-      assert capability.cannot? act, UserPreference
-    end
-
     # A user with empty tokens
     token = create(:oauth_access_token)
     capability = ApiCapability.new token