def METHOD_NAME(user: "User", roles: Optional[Set[str]], session) -> None:
    get_structured_logger("api_user_models").info("setting roles", roles=roles, user_id=user.id, api_key=user.api_key)
    db_user = session.query(User).filter(User.id == user.id).first()
    # TODO: would it be sufficient to use the passed-in `user` instead of looking up this `db_user`?
    #       or even use this as a bound method instead of a static??
    #       same goes for `update_user()` and `delete_user()` below...
    if roles:
        db_user.roles = session.query(UserRole).filter(UserRole.name.in_(roles)).all()
    else:
        db_user.roles = []
    session.commit()
    # retrieve the newly updated User object
    return session.query(User).filter(User.id == user.id).first()