code: def test_ntsc_iface_access() -> None:
      def can_access_logs(
          creds: authentication.Credentials, ntsc_id: str
      ) -> bool:
          session = api_utils.determined_test_session(creds)
          try:
              list(bindings.get_TaskLogs(session, taskId=ntsc_id))
              return True
          except errors.APIException as e:
              if e.status_code != 404 and "not found" not in e.message:
                  # FIXME: the endpoint should respond with 404.
                  raise e
              return False
  
      with create_workspaces_with_users(
          [
              [
                  (0, ["Viewer", "Editor"]),
                  (1, ["Viewer"]),
              ],
              [
                  (2, ["Viewer"]),
                  (0, ["Viewer"]),
              ],
              [
                  (0, ["Editor"]),
              ],
          ]
      ) as (workspaces, creds):
          # launch one of each ntsc in the first workspace
          for typ in conf.ALL_NTSC:
              experiment_id = None
              if typ == api.NTSC_Kind.tensorboard:
                  pid = bindings.post_PostProject(
                      api_utils.determined_test_session(creds[0]),
                      body=bindings.v1PostProjectRequest(
                          name="test", workspaceId=workspaces[0].id
                      ),
                      workspaceId=workspaces[0].id,
                  ).project.id
  
                  with logged_in_user(creds[0]):
                      # experiment for tensorboard
                      experiment_id = exp.create_experiment(
                          conf.fixtures_path("no_op/single.yaml"),
                          conf.fixtures_path("no_op"),
                          ["--project_id", str(pid)],
                      )
  
              created_id = api_utils.launch_ntsc(
                  api_utils.determined_test_session(creds[0]),
                  workspaces[0].id,
                  typ,
                  experiment_id,
              ).id
  
              # user 0
              assert can_access_logs(
                  creds[0], created_id
              ), f"user 0 should be able to access {typ} logs"
              session = api_utils.determined_test_session(creds[0])
              # user 0 should be able to get details.
              api.get_ntsc_details(session, typ, created_id)
              # user 0 should be able to kill.
              api_utils.kill_ntsc(session, typ, created_id)
              # user 0 should be able to set priority.
              api_utils.set_prio_ntsc(session, typ, created_id, 1)
              # user 0 should be able to launch in workspace 0.
              api_utils.launch_ntsc(
                  session, workspaces[0].id, typ, experiment_id
              )
  
              # user 0 should be able to launch tensorboards and not NSCs in workspace 1.
              only_tensorboard_can_launch(
                  session, workspaces[1].id, typ, experiment_id
              )
  
              # user 1
              assert can_access_logs(
                  creds[1], created_id
              ), f"user 1 should be able to access {typ} logs"
              session = api_utils.determined_test_session(creds[1])
              # user 1 should be able to get details.
              api.get_ntsc_details(session, typ, created_id)
              with pytest.raises(errors.ForbiddenException) as fe:
                  # user 1 should not be able to kill.
                  api_utils.kill_ntsc(session, typ, created_id)
              assert "access denied" in fe.value.message
              with pytest.raises(errors.ForbiddenException) as fe:
                  # user 1 should not be able to set priority.
                  api_utils.set_prio_ntsc(session, typ, created_id, 1)
              assert "access denied" in fe.value.message
              # user 1 should be able to launch tensorboards but not NSCs in workspace 0.
              only_tensorboard_can_launch(
                  session, workspaces[0].id, typ, experiment_id
              )
              # tensorboard requires workspace access so returns workspace not found if
              # the user does not have access to the workspace.
              if typ == api.NTSC_Kind.tensorboard:
                  with pytest.raises(errors.NotFoundException):
                      api_utils.launch_ntsc(
                          session, workspaces[1].id, typ, experiment_id
                      )
              else:
                  with pytest.raises(errors.ForbiddenException):
                      api_utils.launch_ntsc(
                          session, workspaces[1].id, typ, experiment_id
                      )
  
              # user 2
              assert not can_access_logs(
                  creds[2], created_id
              ), f"user 2 should not be able to access {typ} logs"
              session = api_utils.determined_test_session(creds[2])
              with pytest.raises(errors.APIException) as e:
                  # user 2 should not be able to get details.
                  api.get_ntsc_details(session, typ, created_id)
              assert (
                  e.value.status_code == 404
              ), f"user 2 should not be able to get details for {typ}"
              with pytest.raises(errors.APIException) as e:
                  # user 2 should not be able to kill or know it exists.
                  api_utils.kill_ntsc(session, typ, created_id)
              assert (
                  e.value.status_code == 404
              ), f"user 2 should not be able to kill {typ}"
              with pytest.raises(errors.APIException) as e:
                  # user 2 should not be able to set priority or know it exists.
                  api_utils.set_prio_ntsc(session, typ, created_id, 1)
              assert (
                  e.value.status_code == 404
              ), f"user 2 should not be able to set priority {typ}"
              if typ == api.NTSC_Kind.tensorboard:
                  with pytest.raises(errors.NotFoundException):
                      api_utils.launch_ntsc(
                          session, workspaces[0].id, typ, experiment_id
                      )
              else:
                  with pytest.raises(errors.ForbiddenException):
                      api_utils.launch_ntsc(
                          session, workspaces[0].id, typ, experiment_id
                      )
              # user 2 has view access to workspace 1 so gets forbidden instead of not found.
              with pytest.raises(errors.ForbiddenException):
                  api_utils.launch_ntsc(
                      session, workspaces[1].id, typ, experiment_id
                  )
  
              # test visibility
              created_id2 = api_utils.launch_ntsc(
                  api_utils.determined_test_session(creds[0]),
                  workspaces[2].id,
                  typ,
                  experiment_id,
              ).id
  
              # none of the users should be able to get details
              for cred in [creds[1], creds[2]]:
                  session = api_utils.determined_test_session(cred)
                  # exception for creds[1], who can access the experiment and tensorboard
                  if (
                      typ != api.NTSC_Kind.tensorboard
                      and cred == creds[2]
                  ):
                      with pytest.raises(errors.APIException) as e:
                          api.get_ntsc_details(
                              session, typ, created_id2
                          )
                  assert e.value.status_code == 404
                  results = api_utils.list_ntsc(session, typ)
                  for r in results:
                      if r.id == created_id2:
                          pytest.fail(
                              f"should not be able to see {typ} {r.id} in the list results"
                          )
                  with pytest.raises(errors.APIException) as e:
                      api_utils.list_ntsc(
                          session, typ, workspace_id=workspaces[2].id
                      )
                  # FIXME only notebooks return the correct 404.
                  assert (
                      e.value.status_code == 404
                  ), f"{typ} should fail with 404"
                  with pytest.raises(errors.APIException) as e:
                      api_utils.list_ntsc(
                          session, typ, workspace_id=12532459
                      )
                  assert (
                      e.value.status_code == 404
                  ), f"{typ} should fail with 404"
  
              # kill the ntsc
              api_utils.kill_ntsc(
                  api_utils.determined_test_session(creds[0]),
                  typ,
                  created_id,
              )
  
file_path: determined/e2e_tests/tests/cluster/test_rbac_ntsc.py
imports: import contextlib
  from typing import Generator, List, Optional, Sequence
  import pytest
  import tests.config
  from determined.common import api
  from determined.common.api import authentication, bindings, errors
  from tests import api_utils
  from tests import experiment
  from tests.cluster.test_rbac import create_workspaces_with_users, rbac_disabled
  from tests.cluster.test_workspace_org import setup_workspaces
  from .test_groups import det_cmd_json
  from .test_users import logged_in_user
label_desc: Use image node_id 5 for calling a global function with example usage: test_ntsc_iface_access() and returns: True, False