Repository: tiangolo/fastapi

Issue:
dependency_overrides does not play well with scopes
**Describe the bug**
When working with `Security()` dependencies, the scopes disappear when `app.dependency_overrides` is executed. The callable dealing with the scopes gets an empty list instead of the scopes.

**To Reproduce**

```python
from fastapi import FastAPI, Header, Security, Depends
from fastapi.security import SecurityScopes

from starlette.testclient import TestClient

app = FastAPI()

def get_user(required_scopes: SecurityScopes):
    print(required_scopes.scopes)

    return "John Doe"

def data():
    return [1,2,3]

def other_data():
    return [3,4,5]


@app.get("/test")
def test(user: str = Security(get_user, scopes=["foo", "bar"]), data = Depends(data)):
    return data

client = TestClient(app)
response = client.get("/test")

app.dependency_overrides[data] = other_data
response = client.get("/test")

# prints: ["foo", "bar"] and [] instead of ["foo", "bar"] and ["foo", "bar"]
```

**Expected behavior**
In the above example I expect `get_user()` to print the same scopes twice. Instead, before the `dependency_overrides` it prints the correct scpoes, but an empty list afterwards.

**Environment:**
 - OS: Linux
 - FastAPI Version 0.43.0
- Python 3.7.4



Discussion:
Hello,

I was reading your [comment](https://github.com/tiangolo/fastapi/issues/738#issuecomment-558795651) in the other thread. In my case, I am using `dependency_overrides` to mock the connection to database.

```python
class TransactionTestCaseMixin:
    db_session: Session

    @pytest.fixture(autouse=True)
    def receive_db_session(self, dbsession: Session):
        self.db_session = dbsession

        app.dependency_overrides[get_db] = lambda: self.db_session
```

That's causing us an issue using `SecurityScopes` when we are testing our service endpoint where we include a `Dependant` (Security) to manage the permissions of our endpoints.


Resolving patch:
diff --git a/fastapi/dependencies/utils.py b/fastapi/dependencies/utils.py
--- a/fastapi/dependencies/utils.py
+++ b/fastapi/dependencies/utils.py
@@ -478,6 +478,7 @@ async def solve_dependencies(
                 name=sub_dependant.name,
                 security_scopes=sub_dependant.security_scopes,
             )
+            use_sub_dependant.security_scopes = sub_dependant.security_scopes
 
         solved_result = await solve_dependencies(
             request=request,


Test patch:
diff --git a/tests/test_dependency_security_overrides.py b/tests/test_dependency_security_overrides.py
new file mode 100644
--- /dev/null
+++ b/tests/test_dependency_security_overrides.py
@@ -0,0 +1,65 @@
+from typing import List, Tuple
+
+from fastapi import Depends, FastAPI, Security
+from fastapi.security import SecurityScopes
+from fastapi.testclient import TestClient
+
+app = FastAPI()
+
+
+def get_user(required_scopes: SecurityScopes):
+    return "john", required_scopes.scopes
+
+
+def get_user_override(required_scopes: SecurityScopes):
+    return "alice", required_scopes.scopes
+
+
+def get_data():
+    return [1, 2, 3]
+
+
+def get_data_override():
+    return [3, 4, 5]
+
+
+@app.get("/user")
+def read_user(
+    user_data: Tuple[str, List[str]] = Security(get_user, scopes=["foo", "bar"]),
+    data: List[int] = Depends(get_data),
+):
+    return {"user": user_data[0], "scopes": user_data[1], "data": data}
+
+
+client = TestClient(app)
+
+
+def test_normal():
+    response = client.get("/user")
+    assert response.json() == {
+        "user": "john",
+        "scopes": ["foo", "bar"],
+        "data": [1, 2, 3],
+    }
+
+
+def test_override_data():
+    app.dependency_overrides[get_data] = get_data_override
+    response = client.get("/user")
+    assert response.json() == {
+        "user": "john",
+        "scopes": ["foo", "bar"],
+        "data": [3, 4, 5],
+    }
+    app.dependency_overrides = {}
+
+
+def test_override_security():
+    app.dependency_overrides[get_user] = get_user_override
+    response = client.get("/user")
+    assert response.json() == {
+        "user": "alice",
+        "scopes": ["foo", "bar"],
+        "data": [1, 2, 3],
+    }
+    app.dependency_overrides = {}