@Test
    public void testFilterWithHeaderUpdatesClient() {
        final Client mockNewClient = mock(Client.class);
        final Map<String, String> headers = new HashMap<>();
        headers.put("Authorization", "Bearer token");

        when(mockClient.filterWithHeader(headers)).thenReturn(mockNewClient);

        final Client result = fesenClient.filterWithHeader(headers);

labels.purgeUserInfoDay=删除以前的用户日志
labels.reading=阅读
labels.roleTypeIds=角色ID
labels.scriptData=脚本
labels.scriptResult=结果
labels.scriptType=执行方法
labels.segmentation=分段
labels.startTime=开始时间
labels.target=目标
labels.token=令牌
labels.synonymFile=同义词文件
labels.stopwordsFile=停用词文件
labels.stemmerOverrideFile=词干覆盖文件
labels.mappingFile=映射文件
labels.protwordsFile=Protwords文件
labels.kuromojiFile=Kuromoji文件
labels.elevateWordFile=提升词文件

    /** The key of the configuration. e.g. 60 */
    String API_ACCESS_TOKEN_LENGTH = "api.access.token.length";

    /** The key of the configuration. e.g. false */
    String API_ACCESS_TOKEN_REQUIRED = "api.access.token.required";

    /** The key of the configuration. e.g.  */
    String API_ACCESS_TOKEN_REQUEST_PARAMETER = "api.access.token.request.parameter";

    /** The key of the configuration. e.g. Radmin-api */

因为我们现在声明了这些作用域，所以当你登录/授权时，它们会显示在 API 文档里。

你可以选择要授予访问权限的作用域：`me` 和 `items`。

这与使用 Facebook、Google、GitHub 等登录时授予权限的机制相同：

<img src="/img/tutorial/security/image11.png">

## 带作用域的 JWT 令牌 { #jwt-token-with-scopes }

现在，修改令牌的*路径操作*以返回请求的作用域。

我们仍然使用 `OAuth2PasswordRequestForm`。它包含 `scopes` 属性，其值是 `list[str]`，包含请求中接收到的每个作用域。

我们把这些作用域作为 JWT 令牌的一部分返回。

/// danger | 危险

为简单起见，此处我们只是把接收到的作用域直接添加到了令牌中。

        // Act + Assert (no exception expected)
        assertDoesNotThrow(() -> SmbCopyUtil.copyFile(src, dest, buffers, 1, new WriterThread(), sh, dh));

        // Verify that server-side path engaged at least the initial opens
        verify(src, times(1)).openUnshared(anyInt(), anyInt(), anyInt(), anyInt(), anyInt());
        verify(dest, times(1)).openUnshared(anyInt(), anyInt(), anyInt(), anyInt(), anyInt());
    }

Це той самий механізм, який використовується, коли ви надаєте дозволи під час входу через Facebook, Google, GitHub тощо:

<img src="/img/tutorial/security/image11.png">

## JWT токен зі scopes { #jwt-token-with-scopes }

Тепер змініть операцію шляху токена, щоб повертати запитані scopes.

		prometheus.HistogramOpts{
			Name:    "s3_ttfb_seconds",
			Help:    "Time taken by requests served by current MinIO server instance",
			Buckets: []float64{.05, .1, .25, .5, 1, 2.5, 5, 10},
		},
		[]string{"api"},
	)
	bucketHTTPRequestsDuration = prometheus.NewHistogramVec(
		prometheus.HistogramOpts{
			Name:    "s3_ttfb_seconds",
			Help:    "Time taken by requests served by current MinIO server instance per bucket",

errors.failed_to_download_mapping_file = Failed to download a mapping file.
errors.failed_to_upload_mapping_file = Failed to upload a mapping file.
errors.invalid_kuromoji_token={0} is invalid as a token.
errors.invalid_kuromoji_segmentation=The number of segmentation for {0} and {1} is different.
errors.invalid_str_is_included = {1} is invalid for {0}.
errors.blank_password = Password is required.

errors.failed_to_download_mapping_file = Failed to download a mapping file.
errors.failed_to_upload_mapping_file = Failed to upload a mapping file.
errors.invalid_kuromoji_token={0} is invalid as a token.
errors.invalid_kuromoji_segmentation=The number of segmentation for {0} and {1} is different.
errors.invalid_str_is_included = {1} is invalid for {0}.
errors.blank_password = Password is required.

* <abbr title="Getting Things Done - S'organiser pour réussir">GTD</abbr>
* <abbr title="less than - inférieur à"><code>lt</code></abbr>
* <abbr title="XML Web Token - Jeton Web XML">XWT</abbr>
* <abbr title="Parallel Server Gateway Interface - Interface passerelle serveur parallèle">PSGI</abbr>