Merge commit from fork

* fix oauth scopes

* fix typing

docs/docs/api/index.md

@@ -154,10 +154,17 @@ Examples:
 ```bash
 a:superuser
 g:read
+g:write
 r:change:part
 r:delete:stock
 ```
 
+The general scopes `g:read` and `g:write` cover endpoints which are not associated with a specific role - `g:read` only grants read access (`GET`, `HEAD`, `OPTIONS`), write operations require `g:write`.
+
+!!! warning "Scopes restrict - they do not grant"
+    A request with an oAuth2 token must satisfy both the scopes of the token *and* the permissions of the user who authorized the application. A token can therefore never do more than the user is allowed to do.
+    oAuth2 tokens are only accepted by the API - they can not be used to log in to the web interface, or to issue (or manage) API tokens.
+
 !!! info "Read the API docs"
     The API [documentation](#documentation) and [schema](./schema.md) list the required scopes for every API endpoint / interaction in the security sections.
 

docs/docs/settings/error_codes.md

@@ -262,6 +262,13 @@ The `middleware` list provided in the configuration file does not include the au
 
 The middleware has been added automatically. To remove this warning, add it to the `middleware` list in your configuration file (after `django_structlog.middlewares.RequestMiddleware`).
 
+#### INVE-W21
+**Unsupported class removed from configuration - Backend**
+
+The `middleware` or `authentication_backends` list provided in the configuration file includes a class which is not supported, as it would bypass security checks.
+
+The class has been removed automatically. To remove this warning, remove it from the list in your configuration file.
+
 
 ### INVE-I (InvenTree Information)
 Information — These are not errors but information messages. They might point out potential issues or just provide information.