public static final String ERRORS_APP_DB_ALREADY_EXISTS = "{errors.app.db.already.exists}";

    /** The key of the message: It may have been processed before this request. Please try again. */
    public static final String ERRORS_APP_DOUBLE_SUBMIT_REQUEST = "{errors.app.double.submit.request}";

    /** The key of the message: Invalid username or password. */
    public static final String ERRORS_login_error = "{errors.login_error}";

    }

    private static class StubLifecycleBindingsInjector implements LifecycleBindingsInjector {

        @Override
        public void injectLifecycleBindings(
                Model model, ModelBuildingRequest request, ModelProblemCollector problems) {}
    }

O middleware responde a dois tipos específicos de solicitação HTTP...

### Requisições CORS pré-voo (preflight) { #cors-preflight-requests }

Estas são quaisquer solicitações `OPTIONS` com cabeçalhos `Origin` e `Access-Control-Request-Method`.

Nesse caso, o middleware interceptará a solicitação recebida e responderá com cabeçalhos CORS apropriados e uma resposta `200` ou `400` para fins informativos.

### Requisições Simples { #simple-requests }

    void injectAuthentication(RepositorySystemSession session, List<ArtifactRepository> repositories);

    ArtifactResolutionResult resolve(ArtifactResolutionRequest request);

    // Install

    // Deploy

    // Map types of artifacts

    //
    // Raw file transfers
    //
    void publish(

// error returned in IAM subsystem when groups doesn't exist.
var errNoSuchGroup = errors.New("Specified group does not exist")

// error returned in IAM subsystem when a policy attach/detach request has no
// net effect, i.e. it is already applied.
var errNoPolicyToAttachOrDetach = errors.New("Specified policy update has no net effect")

// error returned in IAM subsystem when a non-empty group needs to be
// deleted.

If the behavior is threatening or harassing, or for other reasons requires immediate escalation, please see below.

     * @return the 8-byte ciphertext block
     */
    public byte[] encrypt(final byte[] clearText) {

        final int length = clearText.length;

        if (length % 8 != 0) {
            // DES requires 8-byte blocks
            throw new IllegalArgumentException("Array must be a multiple of 8 bytes for DES encryption");
        }

        final byte[] cipherText = new byte[length];

这里使用的也是之前创建的 OAuth2 方案，并把它声明为依赖项：`oauth2_scheme`。

该依赖项函数本身不需要作用域，因此，可以使用 `Depends` 和 `oauth2_scheme`。不需要指定安全作用域时，不必使用 `Security`。

此处还声明了从 `fastapi.security` 导入的 `SecurityScopes` 类型的特殊参数。

`SecuriScopes` 类与 `Request` 类似（`Request` 用于直接提取请求对象）。

{* ../../docs_src/security/tutorial005.py hl[8,105] *}

## 使用 `scopes`

参数 `security_scopes` 的类型是 `SecurityScopes`。

它的属性 `scopes`  是作用域列表，所有依赖项都把它作为子依赖项。也就是说所有**依赖**……这听起来有些绕，后文会有解释。

sequenceDiagram
    participant Client
    participant Proxy as Proxy/Load Balancer
    participant Server as FastAPI Server

    Client->>Proxy: HTTPS Request<br/>Host: mysuperapp.com<br/>Path: /items

    Note over Proxy: Proxy adds forwarded headers

    Proxy->>Server: HTTP Request<br/>X-Forwarded-For: [client IP]<br/>X-Forwarded-Proto: https<br/>X-Forwarded-Host: mysuperapp.com<br/>Path: /items

    // Search Execute
    //

    /**
     * Performs bulk document operations (index multiple documents).
     * Validates document fields and adds default values where necessary.
     *
     * @param body the bulk request body containing documents to process
     * @return JSON response with bulk operation results
     */
    // PUT /api/admin/documents/bulk
    @Execute
    public JsonResponse<ApiResult> put$bulk(final BulkBody body) {