- 前端（在使用者的瀏覽器中執行）把 `username` 與 `password` 傳到我們 API 的特定 URL（在程式中宣告為 `tokenUrl="token"`）。
- API 檢查 `username` 與 `password`，並回傳一個「token（權杖）」（我們還沒實作這部分）。
    - 「token（權杖）」就是一段字串，之後可用來識別並驗證此使用者。
    - 通常 token 會設定一段時間後失效。
        - 因此使用者之後需要重新登入。
        - 若 token 被竊取，風險也較低；它不像永遠有效的萬用鑰匙（多數情況下）。
- 前端會暫存這個 token。
- 使用者在前端點擊前往其他頁面/區段。
- 前端需要再向 API 取得資料。
    - 但該端點需要驗證。

    @Nested
    @DisplayName("Protocol Information Tests")
    class ProtocolInfoTests {

        @Test
        @DisplayName("Should return correct syntax string")
        void testGetSyntax() {
            // When/Then: Verify the protocol syntax identifier
            assertEquals("12345778-1234-abcd-ef00-0123456789ac:1.0", samr.getSyntax());
        }
    }

    @Nested
    @DisplayName("Constants Tests")
    class ConstantsTests {

def test_read_nonexistent_item():
    response = client.get("/items/baz", headers={"X-Token": "coneofsilence"})
    assert response.status_code == 404
    assert response.json() == {"detail": "Item not found"}


def test_create_item():
    response = client.post(
        "/items/",
        headers={"X-Token": "coneofsilence"},

{* ../../docs_src/security/tutorial001_an_py310.py hl[8] *}

/// tip | İpucu

Burada `tokenUrl="token"`, henüz oluşturmadığımız göreli bir URL olan `token`’ı ifade eder. Göreli URL olduğu için `./token` ile eşdeğerdir.

        int expectedLength = 100;

        when(messageBlock.decode(buffer, bufferIndex)).thenReturn(expectedLength);

        // When
        int actualLength = messageBlock.decode(buffer, bufferIndex);

        // Then
        assertEquals(expectedLength, actualLength);
        verify(messageBlock).decode(buffer, bufferIndex);
    }

    @Test
    @DisplayName("Test decode method throws SMBProtocolDecodingException")

 * governing permissions and limitations under the License.
 */
package org.codelibs.fess.exception;

/**
 * Exception thrown when an invalid access token is encountered.
 * This exception is typically used in authentication and authorization contexts
 * where a provided access token is invalid, expired, or malformed.
 */
public class InvalidAccessTokenException extends FessSystemException {

    /** Serial version UID for serialization */

    /**
     * Generate the access token.
     * @return The access token.
     */
    public String generateAccessToken() {
        return RandomStringUtils.random(ComponentUtil.getFessConfig().getApiAccessTokenLengthAsInteger(), 0, 0, true, true, null, random);
    }

    /**
     * Get the access token from the request.
     * @param request The request.
     * @return The access token.
     */

        // Then
        assertTrue((type1.getFlags() & flag) != 0);
    }

    @Test
    @DisplayName("Should include NTLMSSP signature")
    void testNTLMSSPSignature() throws IOException {
        // When
        Type1Message type1 = new Type1Message(mockContext);
        byte[] messageBytes = type1.toByteArray();

        // Then
        assertTrue(messageBytes.length >= 8);

        // Given
        Configuration mockConfig = mock(Configuration.class);

        // When
        Smb2TreeDisconnectRequest req = new Smb2TreeDisconnectRequest(mockConfig);

        // Then - verify command is set correctly using reflection
        Field commandField = ServerMessageBlock2.class.getDeclaredField("command");
        commandField.setAccessible(true);
        int command = (int) commandField.get(req);

        // Then
        assertNotNull(resp);
        assertTrue(resp instanceof ServerMessageBlock2Response);
        assertTrue(resp instanceof ServerMessageBlock2);
    }

    @Test
    @DisplayName("Should return correct OVERHEAD constant value")
    void testOverheadConstant() {
        // Then