byte[] dst = new byte[100];

        int length = name.writeWireFormat(dst, 0);

        // Scope should start at position 33 with a length byte (not '.')
        // The first byte after encoding would be the length of "scope"
        assertEquals(5, dst[33]); // Length of "scope"

        // Verify total length includes scope

## Abhängigkeitsbaum und Scopes

Sehen wir uns diesen Abhängigkeitsbaum und die Scopes noch einmal an.

Da die Abhängigkeit `get_current_active_user` von `get_current_user` abhängt, wird der bei `get_current_active_user` deklarierte Scope `"me"` in die Liste der erforderlichen Scopes in `security_scopes.scopes` aufgenommen, das an `get_current_user` übergeben wird.

Nevertheless, you still enforce those scopes, or any other security/authorization requirement, however you need, in your code.

In many cases, OAuth2 with scopes can be an overkill.

But if you know you need it, or you are curious, keep reading.

///

## OAuth2 scopes and OpenAPI { #oauth2-scopes-and-openapi }

Todavía estamos usando el mismo `OAuth2PasswordRequestForm`. Incluye una propiedad `scopes` con una `list` de `str`, con cada scope que recibió en el request.

Y devolvemos los scopes como parte del token JWT.

/// danger | Peligro

Para simplificar, aquí solo estamos añadiendo los scopes recibidos directamente al token.

                        * 👉 `security_scopes` 🔢 ✔️ 🏠 `scopes` ⏮️ `list` ⚗ 🌐 👫 ↔ 📣 🔛,:
                            * `security_scopes.scopes` 🔜 🔌 `["me", "items"]` *➡ 🛠️* `read_own_items`.
                            * `security_scopes.scopes` 🔜 🔌 `["me"]` *➡ 🛠️* `read_users_me`, ↩️ ⚫️ 📣 🔗 `get_current_active_user`.

/// tip | Dica

A coisa importante e "mágica" aqui é que `get_current_user` terá diferentes listas de `scopes` para validar para cada *operação de rota*.

        this.scopedVertices = scopedVertices;

        // scoped graph is versioned by definition
        if (scopedVertices) {
            versionedVertices = true;
        }
    }

    public ArtifactScopeEnum getScope() {
        return scope;
    }

    public void setScope(ArtifactScopeEnum scope) {
        this.scope = scope;
    }

The spec also states that the `username` and `password` must be sent as form data (so, no JSON here).

### `scope` { #scope }

The spec also says that the client can send another form field "`scope`".

The form field name is `scope` (in singular), but it is actually a long string with "scopes" separated by spaces.

Each "scope" is just a string (without spaces).

They are normally used to declare specific security permissions, for example:

            } catch (final Exception e) {
                logger.warn("Failed to update scores.", e);
                resultBuf.append(e.getMessage()).append('\n');
            }
        });
        return resultBuf.toString();
    }

    /**
     * Adds a score booster.
     * @param scoreBooster The score booster.
     */
    protected void addScoreBooster(final ScoreBooster scoreBooster) {

        private final String scope;

        TestNetbiosName(String name, int type, String scope) {
            // Ensure names are uppercase and limited to 15 characters
            this.name = name != null && name.length() > 15 ? name.substring(0, 15).toUpperCase() : (name != null ? name.toUpperCase() : "");
            this.type = type;
            this.scope = scope;
        }

        @Override