interface PushObserver {
  /**
   * Describes the request that the server intends to push a response for.
   *
   * @param streamId server-initiated stream ID: an even number.
   * @param requestHeaders minimally includes `:method`, `:scheme`, `:authority`,
   * and `:path`.
   */
  fun onRequest(
    streamId: Int,
    requestHeaders: List<Header>,
  ): Boolean

  /**

		return args, err
	}
	return args, nil
}

// New - initializes opa policy engine connector.
func New(args Args) *Opa {
	// No opa args.
	if args.URL == nil || args.URL.Scheme == "" && args.AuthToken == "" {
		return nil
	}
	return &Opa{
		args:   args,
		client: &http.Client{Transport: args.Transport},
	}
}

{* ../../docs_src/security/tutorial005_an_py310.py hl[5,9,13,47,65,106,108:116,122:125,129:135,140,156] *}

Now let's review those changes step by step.

## OAuth2 Security scheme

The first change is that now we are declaring the OAuth2 security scheme with two available scopes, `me` and `items`.

The `scopes` parameter receives a `dict` with each scope as a key and the description as the value:

///

## `HTTPSRedirectMiddleware`

Enforces that all incoming requests must either be `https` or `wss`.

Any incoming request to `http` or `ws` will be redirected to the secure scheme instead.

{* ../../docs_src/advanced_middleware/tutorial001.py hl[2,6] *}

## `TrustedHostMiddleware`

      val host = request.header("Host")
      if (host != null) {
        result.add(Header(TARGET_AUTHORITY, host)) // Optional.
      }
      result.add(Header(TARGET_SCHEME, request.url.scheme))

      for (i in 0 until headers.size) {
        // header names must be lowercase.
        val name = headers.name(i).lowercase(Locale.US)
        if (name !in HTTP_2_SKIPPED_REQUEST_HEADERS ||

    val request = server.takeRequest()
    assertThat(request.requestLine).isEqualTo(
      "GET /a/deep/path?key=foo%20bar HTTP/1.1",
    )
    val requestUrl = request.requestUrl
    assertThat(requestUrl!!.scheme).isEqualTo("http")
    assertThat(requestUrl.host).isEqualTo(server.hostName)
    assertThat(requestUrl.port).isEqualTo(server.port)
    assertThat(requestUrl.encodedPath).isEqualTo("/a/deep/path")

    val request = server.takeRequest()
    assertThat(request.requestLine).isEqualTo(
      "GET /a/deep/path?key=foo%20bar HTTP/1.1",
    )
    val requestUrl = request.requestUrl
    assertThat(requestUrl!!.scheme).isEqualTo("http")
    assertThat(requestUrl.host).isEqualTo(server.hostName)
    assertThat(requestUrl.port).isEqualTo(server.port)
    assertThat(requestUrl.encodedPath).isEqualTo("/a/deep/path")

    assertThat(cache.hitCount()).isEqualTo(0)
  }

  @Test fun corruptedUrl() {
    val response =
      testCorruptingCache {
        corruptMetadata {
          // strip https scheme
          it.substring(5)
        }
      }

    assertThat(response.body.string()).isEqualTo("ABC.2") // not cached
    assertThat(cache.requestCount()).isEqualTo(2)

- [EK](#ek): An external secret key - either the SSE-C client-provided key or a secret key generated by the KMS.

#### Content Encryption

	default:
		return nil, errors.New("insufficient parameters for S3 backend authentication")
	}
	opts := &minio.Options{
		Creds:     creds,
		Secure:    u.Scheme == "https",
		Transport: globalRemoteTargetTransport,
	}
	client, err := minio.New(u.Host, opts)
	if err != nil {
		return nil, err
	}
	client.SetAppInfo(fmt.Sprintf("s3-tier-%s", tier), ReleaseTag)