Merge remote-tracking branch 'upstream/pull/5160'

diff --git a/app/abilities/api_capability.rb b/app/abilities/api_capability.rb
index 44e67634552599c861f9320209e8a7810a155edd..07345d25475ab976c38643788e04fe7369f32c0f 100644 (file)
--- a/app/abilities/api_capability.rb
+++ b/app/abilities/api_capability.rb
@@ -5,11 +5,7 @@ class ApiCapability
 
   def initialize(token)
     if Settings.status != "database_offline"
-      user = if token.respond_to?(:resource_owner_id)
-               User.find(token.resource_owner_id)
-             elsif token.respond_to?(:user)
-               token.user
-             end
+      user = User.find(token.resource_owner_id)
 
       if user&.active?
         can [:create, :comment, :close, :reopen], Note if scope?(token, :write_notes)

diff --git a/app/views/geocoder/search.html.erb b/app/views/geocoder/search.html.erb
index f87a4909dd3a4144bdae95a0505fcdc8b5d8817e..56f468f2f655a1303038a237173aca13550d7099 100644 (file)
--- a/app/views/geocoder/search.html.erb
+++ b/app/views/geocoder/search.html.erb
@@ -4,7 +4,7 @@
 
 <% @sources.each do |source| %>
   <h4>
-    <%= t(".title.results_from_html", :results_link => link_to(t(".title.#{source[:name]}"), source[:url].to_s)) %>
+    <%= link_to t(".title.#{source[:name]}"), source[:url].to_s %>
   </h4>
   <div class="search_results_entry mx-n3" data-href="<%= url_for @params.merge(:action => "search_#{source[:name]}") %>">
     <div class="text-center loader">

diff --git a/config/locales/en.yml b/config/locales/en.yml
index 39f425fbdec39a498ecab3090f8246ec8804d556..bdb57f54d806e238197916242dcff4cca6f1a703 100644 (file)
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -668,7 +668,6 @@ en:
   geocoder:
     search:
       title:
-        results_from_html: 'Results from %{results_link}'
         latlon: Internal
         osm_nominatim: OpenStreetMap Nominatim
         osm_nominatim_reverse: OpenStreetMap Nominatim
@@ -1749,7 +1748,6 @@ en:
     message_summary:
       unread_button: "Mark as unread"
       read_button: "Mark as read"
-      reply_button: "Reply"
       destroy_button: "Delete"
       unmute_button: "Move to Inbox"
     new:

diff --git a/test/abilities/api_capability_test.rb b/test/abilities/api_capability_test.rb
index bcfcaf74e4d809ad0a8aba72af5c0837f8af062d..5e8396c676ac754543f5e08c27b5d82045b33e52 100644 (file)
--- a/test/abilities/api_capability_test.rb
+++ b/test/abilities/api_capability_test.rb
@@ -88,12 +88,6 @@ end
 
 class UserApiCapabilityTest < ActiveSupport::TestCase
   test "user preferences" do
-    # a user with no tokens
-    capability = ApiCapability.new nil
-    [:index, :show, :update_all, :update, :destroy].each do |act|
-      assert capability.cannot? act, UserPreference
-    end
-
     # A user with empty tokens
     token = create(:oauth_access_token)
     capability = ApiCapability.new token

diff --git a/test/controllers/api/changeset_comments_controller_test.rb b/test/controllers/api/changeset_comments_controller_test.rb
index ca7fc3407966067c7cc225f0acf9f27caaa4e741..35e45e8c840f4eb2a17d71b6bb01928d3888447b 100644 (file)
--- a/test/controllers/api/changeset_comments_controller_test.rb
+++ b/test/controllers/api/changeset_comments_controller_test.rb
@@ -303,11 +303,11 @@ module Api
     # But writing oauth tests is hard, and so it's easier to put in a controller test.)
     def test_api_write_and_terms_agreed_via_token
       user = create(:user, :terms_agreed => nil)
-      token = create(:oauth_access_token, :resource_owner_id => user.id, :scopes => %w[write_api])
+      auth_header = bearer_authorization_header(user, :scopes => %w[write_api])
       changeset = create(:changeset, :closed)
 
       assert_difference "ChangesetComment.count", 0 do
-        post changeset_comment_path(changeset), :params => { :text => "This is a comment" }, :headers => bearer_authorization_header(token.token)
+        post changeset_comment_path(changeset), :params => { :text => "This is a comment" }, :headers => auth_header
       end
       assert_response :forbidden
 
@@ -316,7 +316,7 @@ module Api
       user.save!
 
       assert_difference "ChangesetComment.count", 1 do
-        post changeset_comment_path(changeset), :params => { :text => "This is a comment" }, :headers => bearer_authorization_header(token.token)
+        post changeset_comment_path(changeset), :params => { :text => "This is a comment" }, :headers => auth_header
       end
       assert_response :success
     end

diff --git a/test/controllers/api/messages_controller_test.rb b/test/controllers/api/messages_controller_test.rb
index 0b54be4dc2051fe33c1c8434d5ced5f823fb45f4..cbf8dc870294fc7362341c2c3700f0e2e6aecc56 100644 (file)
--- a/test/controllers/api/messages_controller_test.rb
+++ b/test/controllers/api/messages_controller_test.rb
@@ -59,10 +59,7 @@ module Api
       recipient = create(:user)
       sender = create(:user)
 
-      sender_token = create(:oauth_access_token,
-                            :resource_owner_id => sender.id,
-                            :scopes => %w[send_messages consume_messages])
-      sender_auth = bearer_authorization_header(sender_token.token)
+      sender_auth = bearer_authorization_header(sender, :scopes => %w[send_messages consume_messages])
 
       msg = build(:message)
 
@@ -101,10 +98,7 @@ module Api
       recipient = create(:user)
 
       sender = create(:user)
-      sender_token = create(:oauth_access_token,
-                            :resource_owner_id => sender.id,
-                            :scopes => %w[send_messages consume_messages])
-      sender_auth = bearer_authorization_header(sender_token.token)
+      sender_auth = bearer_authorization_header(sender, :scopes => %w[send_messages consume_messages])
 
       assert_no_difference "Message.count" do
         assert_no_difference "ActionMailer::Base.deliveries.size" do
@@ -160,20 +154,9 @@ module Api
       sender = create(:user)
       user3 = create(:user)
 
-      sender_token = create(:oauth_access_token,
-                            :resource_owner_id => sender.id,
-                            :scopes => %w[consume_messages])
-      sender_auth = bearer_authorization_header(sender_token.token)
-
-      recipient_token = create(:oauth_access_token,
-                               :resource_owner_id => recipient.id,
-                               :scopes => %w[consume_messages])
-      recipient_auth = bearer_authorization_header(recipient_token.token)
-
-      user3_token = create(:oauth_access_token,
-                           :resource_owner_id => user3.id,
-                           :scopes => %w[send_messages consume_messages])
-      user3_auth = bearer_authorization_header(user3_token.token)
+      sender_auth = bearer_authorization_header(sender, :scopes => %w[consume_messages])
+      recipient_auth = bearer_authorization_header(recipient, :scopes => %w[consume_messages])
+      user3_auth = bearer_authorization_header(user3, :scopes => %w[send_messages consume_messages])
 
       msg = create(:message, :unread, :sender => sender, :recipient => recipient)
 
@@ -264,15 +247,8 @@ module Api
       sender = create(:user)
       user3 = create(:user)
 
-      recipient_token = create(:oauth_access_token,
-                               :resource_owner_id => recipient.id,
-                               :scopes => %w[consume_messages])
-      recipient_auth = bearer_authorization_header(recipient_token.token)
-
-      user3_token = create(:oauth_access_token,
-                           :resource_owner_id => user3.id,
-                           :scopes => %w[send_messages consume_messages])
-      user3_auth = bearer_authorization_header(user3_token.token)
+      recipient_auth = bearer_authorization_header(recipient, :scopes => %w[consume_messages])
+      user3_auth = bearer_authorization_header(user3, :scopes => %w[send_messages consume_messages])
 
       msg = create(:message, :unread, :sender => sender, :recipient => recipient)
 
@@ -339,22 +315,13 @@ module Api
 
     def test_delete
       recipient = create(:user)
-      recipient_token = create(:oauth_access_token,
-                               :resource_owner_id => recipient.id,
-                               :scopes => %w[consume_messages])
-      recipient_auth = bearer_authorization_header(recipient_token.token)
+      recipient_auth = bearer_authorization_header(recipient, :scopes => %w[consume_messages])
 
       sender = create(:user)
-      sender_token = create(:oauth_access_token,
-                            :resource_owner_id => sender.id,
-                            :scopes => %w[send_messages consume_messages])
-      sender_auth = bearer_authorization_header(sender_token.token)
+      sender_auth = bearer_authorization_header(sender, :scopes => %w[send_messages consume_messages])
 
       user3 = create(:user)
-      user3_token = create(:oauth_access_token,
-                           :resource_owner_id => user3.id,
-                           :scopes => %w[send_messages consume_messages])
-      user3_auth = bearer_authorization_header(user3_token.token)
+      user3_auth = bearer_authorization_header(user3, :scopes => %w[send_messages consume_messages])
 
       msg = create(:message, :read, :sender => sender, :recipient => recipient)
 
@@ -407,22 +374,13 @@ module Api
 
     def test_list_messages
       user1 = create(:user)
-      user1_token = create(:oauth_access_token,
-                           :resource_owner_id => user1.id,
-                           :scopes => %w[send_messages consume_messages])
-      user1_auth = bearer_authorization_header(user1_token.token)
+      user1_auth = bearer_authorization_header(user1, :scopes => %w[send_messages consume_messages])
 
       user2 = create(:user)
-      user2_token = create(:oauth_access_token,
-                           :resource_owner_id => user2.id,
-                           :scopes => %w[send_messages consume_messages])
-      user2_auth = bearer_authorization_header(user2_token.token)
+      user2_auth = bearer_authorization_header(user2, :scopes => %w[send_messages consume_messages])
 
       user3 = create(:user)
-      user3_token = create(:oauth_access_token,
-                           :resource_owner_id => user3.id,
-                           :scopes => %w[send_messages consume_messages])
-      user3_auth = bearer_authorization_header(user3_token.token)
+      user3_auth = bearer_authorization_header(user3, :scopes => %w[send_messages consume_messages])
 
       # create some messages between users
       # user | inbox | outbox
@@ -523,10 +481,7 @@ module Api
 
     def test_paged_list_messages_asc
       recipient = create(:user)
-      recipient_token = create(:oauth_access_token,
-                               :resource_owner_id => recipient.id,
-                               :scopes => %w[consume_messages])
-      recipient_auth = bearer_authorization_header(recipient_token.token)
+      recipient_auth = bearer_authorization_header(recipient, :scopes => %w[consume_messages])
 
       sender = create(:user)
 
@@ -559,10 +514,7 @@ module Api
 
     def test_paged_list_messages_desc
       recipient = create(:user)
-      recipient_token = create(:oauth_access_token,
-                               :resource_owner_id => recipient.id,
-                               :scopes => %w[consume_messages])
-      recipient_auth = bearer_authorization_header(recipient_token.token)
+      recipient_auth = bearer_authorization_header(recipient, :scopes => %w[consume_messages])
 
       sender = create(:user)
 

diff --git a/test/controllers/api/old_nodes_controller_test.rb b/test/controllers/api/old_nodes_controller_test.rb
index 99c4dbb1b317acb8ffd7c2bcf2a2c236ac90fd64..64325fd28c5e4a7e3e4cba4a4301832864942d32 100644 (file)
--- a/test/controllers/api/old_nodes_controller_test.rb
+++ b/test/controllers/api/old_nodes_controller_test.rb
@@ -239,38 +239,38 @@ module Api
     end
 
     def test_redact_node_by_regular_with_read_prefs_scope
-      auth_header = create_bearer_auth_header(create(:user), %w[read_prefs])
+      auth_header = bearer_authorization_header(create(:user), :scopes => %w[read_prefs])
       do_redact_redactable_node(auth_header)
       assert_response :forbidden, "should need to be moderator to redact."
     end
 
     def test_redact_node_by_regular_with_write_api_scope
-      auth_header = create_bearer_auth_header(create(:user), %w[write_api])
+      auth_header = bearer_authorization_header(create(:user), :scopes => %w[write_api])
       do_redact_redactable_node(auth_header)
       assert_response :forbidden, "should need to be moderator to redact."
     end
 
     def test_redact_node_by_regular_with_write_redactions_scope
-      auth_header = create_bearer_auth_header(create(:user), %w[write_redactions])
+      auth_header = bearer_authorization_header(create(:user), :scopes => %w[write_redactions])
       do_redact_redactable_node(auth_header)
       assert_response :forbidden, "should need to be moderator to redact."
     end
 
     def test_redact_node_by_moderator_with_read_prefs_scope
-      auth_header = create_bearer_auth_header(create(:moderator_user), %w[read_prefs])
+      auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[read_prefs])
       do_redact_redactable_node(auth_header)
       assert_response :forbidden, "should need to have write_redactions scope to redact."
     end
 
     def test_redact_node_by_moderator_with_write_api_scope
-      auth_header = create_bearer_auth_header(create(:moderator_user), %w[write_api])
+      auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[write_api])
       do_redact_redactable_node(auth_header)
       assert_response :success, "should be OK to redact old version as moderator with write_api scope."
       # assert_response :forbidden, "should need to have write_redactions scope to redact."
     end
 
     def test_redact_node_by_moderator_with_write_redactions_scope
-      auth_header = create_bearer_auth_header(create(:moderator_user), %w[write_redactions])
+      auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[write_redactions])
       do_redact_redactable_node(auth_header)
       assert_response :success, "should be OK to redact old version as moderator with write_redactions scope."
     end
@@ -432,13 +432,6 @@ module Api
 
     private
 
-    def create_bearer_auth_header(user, scopes)
-      token = create(:oauth_access_token,
-                     :resource_owner_id => user.id,
-                     :scopes => scopes)
-      bearer_authorization_header(token.token)
-    end
-
     def do_redact_redactable_node(headers = {})
       node = create(:node, :with_history, :version => 4)
       node_v3 = node.old_nodes.find_by(:version => 3)

diff --git a/test/controllers/api/old_relations_controller_test.rb b/test/controllers/api/old_relations_controller_test.rb
index 446fb5f14011464b2380be80109860972b383c6e..8d750542f1ac41505b05e0da314b20b7dec9cce2 100644 (file)
--- a/test/controllers/api/old_relations_controller_test.rb
+++ b/test/controllers/api/old_relations_controller_test.rb
@@ -78,38 +78,38 @@ module Api
     end
 
     def test_redact_relation_by_regular_with_read_prefs_scope
-      auth_header = create_bearer_auth_header(create(:user), %w[read_prefs])
+      auth_header = bearer_authorization_header(create(:user), :scopes => %w[read_prefs])
       do_redact_redactable_relation(auth_header)
       assert_response :forbidden, "should need to be moderator to redact."
     end
 
     def test_redact_relation_by_regular_with_write_api_scope
-      auth_header = create_bearer_auth_header(create(:user), %w[write_api])
+      auth_header = bearer_authorization_header(create(:user), :scopes => %w[write_api])
       do_redact_redactable_relation(auth_header)
       assert_response :forbidden, "should need to be moderator to redact."
     end
 
     def test_redact_relation_by_regular_with_write_redactions_scope
-      auth_header = create_bearer_auth_header(create(:user), %w[write_redactions])
+      auth_header = bearer_authorization_header(create(:user), :scopes => %w[write_redactions])
       do_redact_redactable_relation(auth_header)
       assert_response :forbidden, "should need to be moderator to redact."
     end
 
     def test_redact_relation_by_moderator_with_read_prefs_scope
-      auth_header = create_bearer_auth_header(create(:moderator_user), %w[read_prefs])
+      auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[read_prefs])
       do_redact_redactable_relation(auth_header)
       assert_response :forbidden, "should need to have write_redactions scope to redact."
     end
 
     def test_redact_relation_by_moderator_with_write_api_scope
-      auth_header = create_bearer_auth_header(create(:moderator_user), %w[write_api])
+      auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[write_api])
       do_redact_redactable_relation(auth_header)
       assert_response :success, "should be OK to redact old version as moderator with write_api scope."
       # assert_response :forbidden, "should need to have write_redactions scope to redact."
     end
 
     def test_redact_relation_by_moderator_with_write_redactions_scope
-      auth_header = create_bearer_auth_header(create(:moderator_user), %w[write_redactions])
+      auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[write_redactions])
       do_redact_redactable_relation(auth_header)
       assert_response :success, "should be OK to redact old version as moderator with write_redactions scope."
     end
@@ -315,13 +315,6 @@ module Api
       end
     end
 
-    def create_bearer_auth_header(user, scopes)
-      token = create(:oauth_access_token,
-                     :resource_owner_id => user.id,
-                     :scopes => scopes)
-      bearer_authorization_header(token.token)
-    end
-
     def do_redact_redactable_relation(headers = {})
       relation = create(:relation, :with_history, :version => 4)
       relation_v3 = relation.old_relations.find_by(:version => 3)

diff --git a/test/controllers/api/old_ways_controller_test.rb b/test/controllers/api/old_ways_controller_test.rb
index 48265575459cd4a2e170ccc1e7f8ad6b664e09e4..c6596ec347c984cba560776dfcfe89a6bf63f330 100644 (file)
--- a/test/controllers/api/old_ways_controller_test.rb
+++ b/test/controllers/api/old_ways_controller_test.rb
@@ -119,38 +119,38 @@ module Api
     end
 
     def test_redact_way_by_regular_with_read_prefs_scope
-      auth_header = create_bearer_auth_header(create(:user), %w[read_prefs])
+      auth_header = bearer_authorization_header(create(:user), :scopes => %w[read_prefs])
       do_redact_redactable_way(auth_header)
       assert_response :forbidden, "should need to be moderator to redact."
     end
 
     def test_redact_way_by_regular_with_write_api_scope
-      auth_header = create_bearer_auth_header(create(:user), %w[write_api])
+      auth_header = bearer_authorization_header(create(:user), :scopes => %w[write_api])
       do_redact_redactable_way(auth_header)
       assert_response :forbidden, "should need to be moderator to redact."
     end
 
     def test_redact_way_by_regular_with_write_redactions_scope
-      auth_header = create_bearer_auth_header(create(:user), %w[write_redactions])
+      auth_header = bearer_authorization_header(create(:user), :scopes => %w[write_redactions])
       do_redact_redactable_way(auth_header)
       assert_response :forbidden, "should need to be moderator to redact."
     end
 
     def test_redact_way_by_moderator_with_read_prefs_scope
-      auth_header = create_bearer_auth_header(create(:moderator_user), %w[read_prefs])
+      auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[read_prefs])
       do_redact_redactable_way(auth_header)
       assert_response :forbidden, "should need to have write_redactions scope to redact."
     end
 
     def test_redact_way_by_moderator_with_write_api_scope
-      auth_header = create_bearer_auth_header(create(:moderator_user), %w[write_api])
+      auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[write_api])
       do_redact_redactable_way(auth_header)
       assert_response :success, "should be OK to redact old version as moderator with write_api scope."
       # assert_response :forbidden, "should need to have write_redactions scope to redact."
     end
 
     def test_redact_way_by_moderator_with_write_redactions_scope
-      auth_header = create_bearer_auth_header(create(:moderator_user), %w[write_redactions])
+      auth_header = bearer_authorization_header(create(:moderator_user), :scopes => %w[write_redactions])
       do_redact_redactable_way(auth_header)
       assert_response :success, "should be OK to redact old version as moderator with write_redactions scope."
     end
@@ -354,13 +354,6 @@ module Api
       end
     end
 
-    def create_bearer_auth_header(user, scopes)
-      token = create(:oauth_access_token,
-                     :resource_owner_id => user.id,
-                     :scopes => scopes)
-      bearer_authorization_header(token.token)
-    end
-
     def do_redact_redactable_way(headers = {})
       way = create(:way, :with_history, :version => 4)
       way_v3 = way.old_ways.find_by(:version => 3)

diff --git a/test/controllers/api/permissions_controller_test.rb b/test/controllers/api/permissions_controller_test.rb
index 1ee3365e70bd931e6189d547189c5b813054cf48..2a7ac5e121d9113b309fdc890a247852e92515d6 100644 (file)
--- a/test/controllers/api/permissions_controller_test.rb
+++ b/test/controllers/api/permissions_controller_test.rb
@@ -34,10 +34,8 @@ module Api
 
     def test_permissions_oauth2
       user = create(:user)
-      token = create(:oauth_access_token,
-                     :resource_owner_id => user.id,
-                     :scopes => %w[read_prefs write_api])
-      get permissions_path, :headers => bearer_authorization_header(token.token)
+      auth_header = bearer_authorization_header(user, :scopes => %w[read_prefs write_api])
+      get permissions_path, :headers => auth_header
       assert_response :success
       assert_select "osm > permissions", :count => 1 do
         assert_select "permission", :count => 2

diff --git a/test/controllers/api/user_preferences_controller_test.rb b/test/controllers/api/user_preferences_controller_test.rb
index e2c573532ecac7e0c0ae8c955de989e639948886..816be9b6e104d5c67aba52b23912079890e00983 100644 (file)
--- a/test/controllers/api/user_preferences_controller_test.rb
+++ b/test/controllers/api/user_preferences_controller_test.rb
@@ -252,10 +252,10 @@ module Api
     # read preferences
     def test_show_using_token
       user = create(:user)
-      token = create(:oauth_access_token, :resource_owner_id => user.id, :scopes => %w[read_prefs])
+      auth_header = bearer_authorization_header(user, :scopes => %w[read_prefs])
       create(:user_preference, :user => user, :k => "key", :v => "value")
 
-      get user_preference_path(:preference_key => "key"), :headers => bearer_authorization_header(token.token)
+      get user_preference_path(:preference_key => "key"), :headers => auth_header
       assert_response :success
     end
 
@@ -264,10 +264,10 @@ module Api
     # by other methods.
     def test_show_using_token_fail
       user = create(:user)
-      token = create(:oauth_access_token, :resource_owner_id => user.id)
+      auth_header = bearer_authorization_header(user, :scopes => %w[])
       create(:user_preference, :user => user, :k => "key", :v => "value")
 
-      get user_preference_path(:preference_key => "key"), :headers => bearer_authorization_header(token.token)
+      get user_preference_path(:preference_key => "key"), :headers => auth_header
       assert_response :forbidden
     end
   end

diff --git a/test/controllers/api/users_controller_test.rb b/test/controllers/api/users_controller_test.rb
index 5086a09b3c217b0010d198c1370d4596c7c656bc..874d9177105b6cba3b20bc7b8aef312914e47671 100644 (file)
--- a/test/controllers/api/users_controller_test.rb
+++ b/test/controllers/api/users_controller_test.rb
@@ -79,18 +79,14 @@ module Api
       user = create(:user,
                     :home_lat => 12.1, :home_lon => 23.4,
                     :languages => ["en"])
-      good_token = create(:oauth_access_token,
-                          :resource_owner_id => user.id,
-                          :scopes => %w[read_prefs])
-      bad_token = create(:oauth_access_token,
-                         :resource_owner_id => user.id,
-                         :scopes => %w[])
+      good_auth = bearer_authorization_header(user, :scopes => %w[read_prefs])
+      bad_auth = bearer_authorization_header(user, :scopes => %w[])
       other_user = create(:user,
                           :home_lat => 12.1, :home_lon => 23.4,
                           :languages => ["en"])
 
       # check that we can fetch our own details as XML with read_prefs
-      get api_user_path(:id => user.id), :headers => bearer_authorization_header(good_token.token)
+      get api_user_path(:id => user.id), :headers => good_auth
       assert_response :success
       assert_equal "application/xml", response.media_type
 
@@ -98,7 +94,7 @@ module Api
       check_xml_details(user, true, false)
 
       # check that we can fetch a different user's details as XML with read_prefs
-      get api_user_path(:id => other_user.id), :headers => bearer_authorization_header(good_token.token)
+      get api_user_path(:id => other_user.id), :headers => good_auth
       assert_response :success
       assert_equal "application/xml", response.media_type
 
@@ -106,7 +102,7 @@ module Api
       check_xml_details(other_user, false, false)
 
       # check that we can fetch our own details as XML without read_prefs
-      get api_user_path(:id => user.id), :headers => bearer_authorization_header(bad_token.token)
+      get api_user_path(:id => user.id), :headers => bad_auth
       assert_response :success
       assert_equal "application/xml", response.media_type
 
@@ -114,7 +110,7 @@ module Api
       check_xml_details(user, false, false)
 
       # check that we can fetch our own details as JSON with read_prefs
-      get api_user_path(:id => user.id, :format => "json"), :headers => bearer_authorization_header(good_token.token)
+      get api_user_path(:id => user.id, :format => "json"), :headers => good_auth
       assert_response :success
       assert_equal "application/json", response.media_type
 
@@ -126,7 +122,7 @@ module Api
       check_json_details(js, user, true, false)
 
       # check that we can fetch a different user's details as JSON with read_prefs
-      get api_user_path(:id => other_user.id, :format => "json"), :headers => bearer_authorization_header(good_token.token)
+      get api_user_path(:id => other_user.id, :format => "json"), :headers => good_auth
       assert_response :success
       assert_equal "application/json", response.media_type
 
@@ -138,7 +134,7 @@ module Api
       check_json_details(js, other_user, false, false)
 
       # check that we can fetch our own details as JSON without read_prefs
-      get api_user_path(:id => user.id, :format => "json"), :headers => bearer_authorization_header(bad_token.token)
+      get api_user_path(:id => user.id, :format => "json"), :headers => bad_auth
       assert_response :success
       assert_equal "application/json", response.media_type
 
@@ -190,21 +186,16 @@ module Api
       user = create(:user,
                     :home_lat => 12.1, :home_lon => 23.4,
                     :languages => ["en"])
-      good_token = create(:oauth_access_token,
-                          :resource_owner_id => user.id,
-                          :scopes => %w[read_prefs])
-      bad_token = create(:oauth_access_token,
-                         :resource_owner_id => user.id)
-      email_token = create(:oauth_access_token,
-                           :resource_owner_id => user.id,
-                           :scopes => %w[read_prefs read_email])
+      good_auth = bearer_authorization_header(user, :scopes => %w[read_prefs])
+      bad_auth = bearer_authorization_header(user, :scopes => %w[])
+      email_auth = bearer_authorization_header(user, :scopes => %w[read_prefs read_email])
 
       # check that we can't fetch details as XML without read_prefs
-      get user_details_path, :headers => bearer_authorization_header(bad_token.token)
+      get user_details_path, :headers => bad_auth
       assert_response :forbidden
 
       # check that we can fetch details as XML without read_email
-      get user_details_path, :headers => bearer_authorization_header(good_token.token)
+      get user_details_path, :headers => good_auth
       assert_response :success
       assert_equal "application/xml", response.media_type
 
@@ -212,7 +203,7 @@ module Api
       check_xml_details(user, true, false)
 
       # check that we can fetch details as XML with read_email
-      get user_details_path, :headers => bearer_authorization_header(email_token.token)
+      get user_details_path, :headers => email_auth
       assert_response :success
       assert_equal "application/xml", response.media_type
 
@@ -220,11 +211,11 @@ module Api
       check_xml_details(user, true, true)
 
       # check that we can't fetch details as JSON without read_prefs
-      get user_details_path(:format => "json"), :headers => bearer_authorization_header(bad_token.token)
+      get user_details_path(:format => "json"), :headers => bad_auth
       assert_response :forbidden
 
       # check that we can fetch details as JSON without read_email
-      get user_details_path(:format => "json"), :headers => bearer_authorization_header(good_token.token)
+      get user_details_path(:format => "json"), :headers => good_auth
       assert_response :success
       assert_equal "application/json", response.media_type
 
@@ -236,7 +227,7 @@ module Api
       check_json_details(js, user, true, false)
 
       # check that we can fetch details as JSON with read_email
-      get user_details_path(:format => "json"), :headers => bearer_authorization_header(email_token.token)
+      get user_details_path(:format => "json"), :headers => email_auth
       assert_response :success
       assert_equal "application/json", response.media_type
 
@@ -325,10 +316,10 @@ module Api
       user1 = create(:user, :description => "test1", :terms_agreed => Date.yesterday)
       user2 = create(:user, :description => "test2", :terms_agreed => Date.yesterday)
       user3 = create(:user, :description => "test3", :terms_agreed => Date.yesterday)
-      good_token = create(:oauth_access_token, :resource_owner_id => user1.id, :scopes => %w[read_prefs])
-      bad_token = create(:oauth_access_token, :resource_owner_id => user1.id, :scopes => %w[])
+      good_auth = bearer_authorization_header(user1, :scopes => %w[read_prefs])
+      bad_auth = bearer_authorization_header(user1, :scopes => %w[])
 
-      get api_users_path, :params => { :users => user1.id }, :headers => bearer_authorization_header(good_token.token)
+      get api_users_path, :params => { :users => user1.id }, :headers => good_auth
       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 1 do
@@ -337,7 +328,7 @@ module Api
         assert_select "user[id='#{user3.id}']", :count => 0
       end
 
-      get api_users_path, :params => { :users => user2.id }, :headers => bearer_authorization_header(good_token.token)
+      get api_users_path, :params => { :users => user2.id }, :headers => good_auth
       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 1 do
@@ -346,7 +337,7 @@ module Api
         assert_select "user[id='#{user3.id}']", :count => 0
       end
 
-      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :headers => bearer_authorization_header(good_token.token)
+      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :headers => good_auth
       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 2 do
@@ -355,7 +346,7 @@ module Api
         check_xml_details(user3, false, false)
       end
 
-      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :headers => bearer_authorization_header(bad_token.token)
+      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}" }, :headers => bad_auth
       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 2 do
@@ -364,7 +355,7 @@ module Api
         check_xml_details(user3, false, false)
       end
 
-      get api_users_path, :params => { :users => user1.id, :format => "json" }, :headers => bearer_authorization_header(good_token.token)
+      get api_users_path, :params => { :users => user1.id, :format => "json" }, :headers => good_auth
       assert_response :success
       assert_equal "application/json", response.media_type
       js = ActiveSupport::JSON.decode(@response.body)
@@ -372,7 +363,7 @@ module Api
       assert_equal 1, js["users"].count
       check_json_details(js["users"][0], user1, true, false)
 
-      get api_users_path, :params => { :users => user2.id, :format => "json" }, :headers => bearer_authorization_header(good_token.token)
+      get api_users_path, :params => { :users => user2.id, :format => "json" }, :headers => good_auth
       assert_response :success
       assert_equal "application/json", response.media_type
       js = ActiveSupport::JSON.decode(@response.body)
@@ -380,7 +371,7 @@ module Api
       assert_equal 1, js["users"].count
       check_json_details(js["users"][0], user2, false, false)
 
-      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :headers => bearer_authorization_header(good_token.token)
+      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :headers => good_auth
       assert_response :success
       assert_equal "application/json", response.media_type
       js = ActiveSupport::JSON.decode(@response.body)
@@ -389,7 +380,7 @@ module Api
       check_json_details(js["users"][0], user1, true, false)
       check_json_details(js["users"][1], user3, false, false)
 
-      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :headers => bearer_authorization_header(bad_token.token)
+      get api_users_path, :params => { :users => "#{user1.id},#{user3.id}", :format => "json" }, :headers => bad_auth
       assert_response :success
       assert_equal "application/json", response.media_type
       js = ActiveSupport::JSON.decode(@response.body)
@@ -398,17 +389,17 @@ module Api
       check_json_details(js["users"][0], user1, false, false)
       check_json_details(js["users"][1], user3, false, false)
 
-      get api_users_path, :params => { :users => create(:user, :suspended).id }, :headers => bearer_authorization_header(good_token.token)
+      get api_users_path, :params => { :users => create(:user, :suspended).id }, :headers => good_auth
       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 0
 
-      get api_users_path, :params => { :users => create(:user, :deleted).id }, :headers => bearer_authorization_header(good_token.token)
+      get api_users_path, :params => { :users => create(:user, :deleted).id }, :headers => good_auth
       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 0
 
-      get api_users_path, :params => { :users => 0 }, :headers => bearer_authorization_header(good_token.token)
+      get api_users_path, :params => { :users => 0 }, :headers => good_auth
       assert_response :success
       assert_equal "application/xml", response.media_type
       assert_select "user", :count => 0