次に、トークンの path operation を修正して、要求されたスコープを返すようにします。

引き続き同じ `OAuth2PasswordRequestForm` を使用します。これには、リクエストで受け取った各スコープを含む、`str` の `list` である `scopes` プロパティが含まれます。

そして、そのスコープを JWT トークンの一部として返します。

/// danger | 警告

簡単のため、ここでは受け取ったスコープをそのままトークンに追加しています。

しかし、本番アプリケーションではセキュリティのため、ユーザーが実際に持つことができるスコープ、または事前に定義したスコープだけを追加するようにしてください。

///

{* ../../docs_src/security/tutorial005_an_py310.py hl[157] *}

   * "two"=2, "three"=3}, and {@code keySet()} and {@code values()} respect the same order. If you
   * want a different order, consider using {@link #orderEntriesByValue(Comparator)}, which changes
   * this builder to sort entries by value.
   *
   * <p>Builder instances can be reused - it is safe to call {@link #buildOrThrow} multiple times to

   * maxLength} chars in length and will end with the given {@code truncationIndicator}. Otherwise,
   * the sequence will be returned as a string with no changes to the content.
   *
   * <p>Examples:
   *
   * {@snippet :
   * Ascii.truncate("foobar", 7, "..."); // returns "foobar"
   * Ascii.truncate("foobar", 5, "..."); // returns "fo..."
   * }
   *

 │  fastapi run                                        │
 │                                                     │
 ╰─────────────────────────────────────────────────────╯

INFO:     Will watch for changes in these directories: ['/home/user/code/awesomeapp']
INFO:     Uvicorn running on http://127.0.0.1:8000 (Press CTRL+C to quit)
INFO:     Started reloader process [2248755] using WatchFiles

而我們使用這個模型同時宣告輸入與輸出：

{* ../../docs_src/response_model/tutorial002_py310.py hl[16] *}

現在，當瀏覽器建立一個帶有密碼的使用者時，API 會在回應中回傳相同的密碼。

在這個例子中可能不是問題，因為是同一個使用者送出該密碼。

但如果我們對其他「路徑操作」使用相同的模型，我們可能會把使用者密碼送給所有用戶端。

/// danger | 警告

除非你非常清楚所有影響並確定自己在做什麼，否則永遠不要儲存使用者的明文密碼，也不要像這樣在回應中傳送。

///

## 新增一個輸出模型 { #add-an-output-model }

我們可以改為建立一個包含明文密碼的輸入模型，以及一個不含密碼的輸出模型：

  }

  /**
   * Returns a view of the elements of {@code unfiltered} that satisfy a predicate. The returned
   * multiset is a live view of {@code unfiltered}; changes to one affect the other.
   *
   * <p>The resulting multiset's iterators, and those of its {@code entrySet()} and {@code
   * elementSet()}, do not support {@code remove()}. However, all other multiset methods supported

  }

  /**
   * Returns a view of the elements of {@code unfiltered} that satisfy a predicate. The returned
   * multiset is a live view of {@code unfiltered}; changes to one affect the other.
   *
   * <p>The resulting multiset's iterators, and those of its {@code entrySet()} and {@code
   * elementSet()}, do not support {@code remove()}. However, all other multiset methods supported

    }

    /*
     * TODO(cpovirk): Consider making this implementation closer to the mainline implementation.
     * (The difference was introduced as part of Java-8-specific changes in cl/132882204, but we
     * could probably make *some* of those changes here in the backport, too.)
     */
    public LoadingValueReference(ValueReference<K, V> oldValue) {
      this.oldValue = oldValue;
    }

    @Override

 *
 * <h2>Prefer <a href="https://github.com/ben-manes/caffeine/wiki">Caffeine</a> over Guava's caching
 * API</h2>
 *
 * <p>The successor to Guava's caching API is <a
 * href="https://github.com/ben-manes/caffeine/wiki">Caffeine</a>. Its API is designed to make it a
 * nearly drop-in replacement. Note that it is not available for Android or GWT/J2CL and that it may
 * have <a href="https://github.com/ben-manes/caffeine/wiki/Guava">different (usually better)

 │  fastapi run                                        │
 │                                                     │
 ╰─────────────────────────────────────────────────────╯

INFO:     Will watch for changes in these directories: ['/home/user/code/awesomeapp']
INFO:     Uvicorn running on http://127.0.0.1:8000 (Press CTRL+C to quit)
INFO:     Started reloader process [2248755] using WatchFiles