* Normally, a token is set to expire after some time.
        * So, the user will have to log in again at some point later.
        * And if the token is stolen, the risk is less. It is not like a permanent key that will work forever (in most of the cases).
* The frontend stores that token temporarily somewhere.
* The user clicks in the frontend to go to another section of the frontend web app.

The first change is that now we are declaring the OAuth2 security scheme with two available scopes, `me` and `items`.

The `scopes` parameter receives a `dict` with each scope as a key and the description as the value:

{* ../../docs_src/security/tutorial005_an_py310.py hl[63:66] *}

Because we are now declaring those scopes, they will show up in the API docs when you log-in/authorize.

second_user_data = {
    "id": 4,
    "name": "Mary",
    "joined": "2018-11-30",
}

my_second_user: User = User(**second_user_data)
```


/// info

`**second_user_data` 意思是:

將 `second_user_data` 字典直接作為 key-value 引數傳遞，等同於：`User(id=4, name="Mary", joined="2018-11-30")`

///

### 多種編輯器支援

整個框架的設計是為了讓使用變得簡單且直觀，在開始開發之前，所有決策都在多個編輯器上進行了測試，以確保提供最佳的開發體驗。

	desc, ok := m.descriptors[name]
	if !ok {
		panic(fmt.Sprintf("metric has no description: %s", name))
	}

	if len(labels)%2 != 0 {
		panic("labels must be a list of ordered key-value pairs")
	}

	validLabels := desc.getLabelSet()
	labelMap := make(map[string]string, len(labels)/2)
	for i := 0; i < len(labels); i += 2 {
		if _, ok := validLabels[labels[i]]; !ok {

pkg os, func UserHomeDir() (string, error)
pkg os, method (*File) SyscallConn() (syscall.RawConn, error)
pkg os, method (*ProcessState) ExitCode() int
pkg os/exec, method (ExitError) ExitCode() int
pkg reflect, method (*MapIter) Key() Value
pkg reflect, method (*MapIter) Next() bool
pkg reflect, method (*MapIter) Value() Value
pkg reflect, method (Value) MapRange() *MapIter
pkg reflect, type MapIter struct

			expectedErr: nil,
			expectErr:   false,
		},
		// invalid Status key
		{
			value:       `<?xml version="1.0" encoding="UTF-8"?><ObjectLockLegalHold xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><MyStatus>ON</MyStatus></ObjectLockLegalHold>`,

{* ../../docs_src/security/tutorial003_an_py310.py hl[82:85] *}

#### About `**user_dict` { #about-user-dict }

`UserInDB(**user_dict)` means:

*Pass the keys and values of the `user_dict` directly as key-value arguments, equivalent to:*

```Python
UserInDB(
    username = user_dict["username"],
    email = user_dict["email"],
    full_name = user_dict["full_name"],
    disabled = user_dict["disabled"],

            // Use replace(key, null, value) to make sure the *main* session, i.e. the one used
            // to load the projects, is stored. This is to avoid the session being overwritten
            // if a plugin uses the ProjectBuilder.
            this.session
                    .getData()
                    .replace(SessionData.key(ModelBuilder.ModelBuilderSession.class), null, modelBuilderSession);

      <password>repopwd</password>
    </server>
    -->

    <!-- Another sample, using keys to authenticate.
    <server>
      <id>siteServer</id>
      <privateKey>/path/to/private/key</privateKey>
      <passphrase>optional; leave empty if not used.</passphrase>
    </server>
    -->
  </servers>

  <!-- mirrors

	@cp -af ./minio minio-release/$(GOOS)-$(GOARCH)/minio
	@cp -af ./minio minio-release/$(GOOS)-$(GOARCH)/minio.$(VERSION)
	@minisign -qQSm minio-release/$(GOOS)-$(GOARCH)/minio.$(VERSION) -s "${CRED_DIR}/minisign.key" < "${CRED_DIR}/minisign-passphrase"
	@sha256sum < minio-release/$(GOOS)-$(GOARCH)/minio.$(VERSION) | sed 's, -,minio.$(VERSION),g' > minio-release/$(GOOS)-$(GOARCH)/minio.$(VERSION).sha256sum