我真的很困惑，在Fastapi下面的oauth代码中需要OAuth2 PasswordRequestForm和OAuth2 PasswordBearer。我有以下两个疑问
1.谁负责在Swagger UI中创建授权按钮？

from typing import Optional
from fastapi import Depends, FastAPI, HTTPException, status
from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm
from pydantic import BaseModel
import uvicorn

fake_users_db = {
    "johndoe": {
        "username": "johndoe",
        "full_name": "John Doe",
        "email": "johndoe@example.com",
        "hashed_password": "fakehashedsecret",
        "disabled": False,
    }
}

app = FastAPI()
def fake_hash_password(password: str):
    return "fakehashed" + password
    
oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")
    
class User(BaseModel):
    username: str
    email: Optional[str] = None
    full_name: Optional[str] = None
    disabled: Optional[bool] = None
    
class UserInDB(User):
    hashed_password: str

def get_user(db, username: str):
    if username in db:
        user_dict = db[username]
        return UserInDB(**user_dict)

def fake_decode_token(token):
    # This doesn't provide any security at all
    # Check the next version
    user = get_user(fake_users_db, token)
    return user

async def get_current_user(token: str = Depends(oauth2_scheme)):
    print("token value is....%s\n" % token)
    user = fake_decode_token(token)
    if not user:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid authentication credentials",
            headers={"WWW-Authenticate": "Bearer"},
        )
    return user

async def get_current_active_user(current_user: User = Depends(get_current_user)):
    if current_user.disabled:
        raise HTTPException(status_code=400, detail="Inactive user")
    return current_user
    
@app.post("/token")
async def login(form_data: OAuth2PasswordRequestForm = Depends()):
    user_dict = fake_users_db.get(form_data.username)
    if not user_dict:
        raise HTTPException(status_code=400, detail="Incorrect username or password")
    user = UserInDB(**user_dict)
    hashed_password = fake_hash_password(form_data.password)
    if not hashed_password == user.hashed_password:
        raise HTTPException(status_code=400, detail="Incorrect username or password")

    return {"access_token": user.username, "token_type": "bearer"}
    
@app.get("/protected_hi")
async def protected_hi(current_user: User = Depends(get_current_active_user)):
    return "Hi! How are you? You are in a protected Zone."
   
if __name__ == "__main__":
    import uvicorn
    uvicorn.run('test:app', host="0.0.0.0", port=5000, reload=True)

1.当我通过点击“授权”按钮登录时，我能够访问名为“/protected_hi”的保护API，而不是“授权”按钮，如果我点击“/token”URL并填写user/pass。我无法访问受保护的API。为什么会这样？在swagger UI中，“授权”按钮和“/token”URL有什么用？我已经看过fastapi文档了，但还是看不懂这部分。