Now, when the clients **create a new hero**, they will send the `secret_name`, it will be stored in the database, but those secret names won't be returned in the API to the clients.

/// tip

This is how you would handle **passwords**. Receive them, but don't return them in the API.

You would also **hash** the values of the passwords before storing them, **never store them in plain text**.

///

The fields of `HeroCreate` are:

    }

    @Test
    @DisplayName("Null resourceLoc is accepted but may cause issues later")
    void constructorNullResourceLoc() {
        // Null resourceLoc doesn't throw NPE immediately - it's stored and may cause issues when used
        // This test documents the current behavior
        SmbTreeConnection freshConnection = mock(SmbTreeConnection.class);
        when(freshConnection.acquire()).thenReturn(freshConnection);

        src[srcIndex + 3] = (byte) 0xA8;
        src[srcIndex + 4] = (byte) 0x01;
        src[srcIndex + 5] = (byte) 0x01;

        // Set 'addrEntry' and 'addrIndex' fields in superclass for the response to be stored
        Field addrEntryField = NameServicePacket.class.getDeclaredField("addrEntry");
        addrEntryField.setAccessible(true);
        addrEntryField.set(nameQueryResponse, new NbtAddress[1]);

        // Decode
        smbInfoAllocation.decode(buffer, 0, buffer.length);

        // The implementation reads values as signed integers and stores them as long
        // Negative values remain negative when stored in long fields
        // The calculations will result in negative values
        long expectedCapacity = (long) alloc * sectPerAlloc * bytesPerSect;

        // When
        Smb2TransformHeader decodedHeader = Smb2TransformHeader.decode(buffer, 0);

        // Then
        // Note: Protocol ID is not stored in the transform header, it's part of the encrypted message
        assertArrayEquals(signature, decodedHeader.getSignature());
        assertArrayEquals(testNonce, decodedHeader.getNonce());

And be compatible with all of them at the same time.

///

Create a utility function to hash a password coming from the user.

And another utility to verify if a received password matches the hash stored.

And another one to authenticate and return a user.

{* ../../docs_src/security/tutorial004_an_py310.py hl[8,49,56:57,60:61,70:76] *}

/// note

          > 0) {
        threshold = buffer[i];
      }
    }
  }

  /**
   * Partitions the contents of buffer in the range [left, right] around the pivot element
   * previously stored in buffer[pivotValue]. Returns the new index of the pivot element,
   * pivotNewIndex, so that everything in [left, pivotNewIndex] is ≤ pivotValue and everything in
   * (pivotNewIndex, right] is greater than pivotValue.
   */

    /**
     * Gets the relative path for a locally installed artifact. Note that the artifact need not actually exist yet at
     * the returned location, the path merely indicates where the artifact would eventually be stored.
     * <p>
     * Shortcut for {@code getService(LocalArtifactManager.class).getPathForLocalArtitact(...)}.
     *
     * @param artifact the artifact for which to get a local path

* `tax: float = 10.5` has a default of `10.5`.
* `tags: List[str] = []` has a default of an empty list: `[]`.

but you might want to omit them from the result if they were not actually stored.

For example, if you have models with many optional attributes in a NoSQL database, but you don't want to send very long JSON responses full of default values.

        String sessionCountId1 = crawlingConfigHelper.store(sessionId, crawlingConfigHelper.getCrawlingConfig("W1"));
        assertEquals("testSession-1", sessionCountId1);

        String sessionCountId2 = crawlingConfigHelper.store(sessionId, crawlingConfigHelper.getCrawlingConfig("W2"));
        assertEquals("testSession-2", sessionCountId2);