Community

it seems like neither the

TaskService().takeTask([...]);

nor the

TaskService().assignTask([...]);

methods check if the assigned user is in the candidate list,

moreover you can even assign a user that doesn't exist:

TaskService().takeTask(task.getId(), "rumpelstiltskin");

and jBPM4 won't complain