code: def test_rbac_permission_assignment() -> None:
      api_utils.configure_token_store(conf.ADMIN_CREDENTIALS)
      test_user_creds = api_utils.create_test_user()
  
      # User has no permissions.
      with logged_in_user(test_user_creds):
          assert (
              "no permissions"
              in det_cmd(
                  ["rbac", "my-permissions"], check=True
              ).stdout.decode()
          )
          json_out = det_cmd_json(["rbac", "my-permissions", "--json"])
          assert json_out["roles"] == []
          assert json_out["assignments"] == []
  
      group_name = api_utils.get_random_string()
      with logged_in_user(conf.ADMIN_CREDENTIALS):
          # Assign user to role directly.
          det_cmd(
              [
                  "rbac",
                  "assign-role",
                  "WorkspaceCreator",
                  "--username-to-assign",
                  test_user_creds.username,
              ],
              check=True,
          )
          det_cmd(
              [
                  "rbac",
                  "assign-role",
                  "Viewer",
                  "--username-to-assign",
                  test_user_creds.username,
                  "--workspace-name",
                  "Uncategorized",
              ],
              check=True,
          )
  
          # Assign user to a group with roles.
          det_cmd(
              [
                  "user-group",
                  "create",
                  group_name,
                  "--add-user",
                  test_user_creds.username,
              ],
              check=True,
          )
          det_cmd(
              [
                  "rbac",
                  "assign-role",
                  "WorkspaceCreator",
                  "--group-name-to-assign",
                  group_name,
              ],
              check=True,
          )
          det_cmd(
              [
                  "rbac",
                  "assign-role",
                  "Editor",
                  "--group-name-to-assign",
                  group_name,
              ],
              check=True,
          )
          det_cmd(
              [
                  "rbac",
                  "assign-role",
                  "Editor",
                  "--group-name-to-assign",
                  group_name,
                  "--workspace-name",
                  "Uncategorized",
              ],
              check=True,
          )
  
      # User has those roles assigned.
      with logged_in_user(test_user_creds):
          assert (
              "no permissions"
              not in det_cmd(
                  ["rbac", "my-permissions"], check=True
              ).stdout.decode()
          )
          json_out = det_cmd_json(["rbac", "my-permissions", "--json"])
          assert len(json_out["roles"]) == 3
          assert len(json_out["assignments"]) == 3
  
          creator = [
              role
              for role in json_out["roles"]
              if role["name"] == "WorkspaceCreator"
          ]
          assert len(creator) == 1
          creator_assignment = [
              a
              for a in json_out["assignments"]
              if a["roleId"] == creator[0]["roleId"]
          ]
          assert creator_assignment[0]["scopeWorkspaceIds"] == []
          assert creator_assignment[0]["scopeCluster"]
  
          viewer = [
              role
              for role in json_out["roles"]
              if role["name"] == "Viewer"
          ]
          assert len(viewer) == 1
          viewer_assignment = [
              a
              for a in json_out["assignments"]
              if a["roleId"] == viewer[0]["roleId"]
          ]
          assert viewer_assignment[0]["scopeWorkspaceIds"] == [1]
          assert not viewer_assignment[0]["scopeCluster"]
  
          editor = [
              role
              for role in json_out["roles"]
              if role["name"] == "Editor"
          ]
          assert len(editor) == 1
          editor_assignment = [
              a
              for a in json_out["assignments"]
              if a["roleId"] == editor[0]["roleId"]
          ]
          assert editor_assignment[0]["scopeWorkspaceIds"] == [1]
          assert editor_assignment[0]["scopeCluster"]
  
      # Remove from the group.
      with logged_in_user(conf.ADMIN_CREDENTIALS):
          det_cmd(
              [
                  "user-group",
                  "remove-user",
                  group_name,
                  test_user_creds.username,
              ],
              check=True,
          )
  
      # User doesn't have any group roles assigned.
      with logged_in_user(test_user_creds):
          assert (
              "no permissions"
              not in det_cmd(
                  ["rbac", "my-permissions"], check=True
              ).stdout.decode()
          )
          json_out = det_cmd_json(["rbac", "my-permissions", "--json"])
  
          assert len(json_out["roles"]) == 2
          assert len(json_out["assignments"]) == 2
          assert (
              len(
                  [
                      role
                      for role in json_out["roles"]
                      if role["name"] == "Editor"
                  ]
              )
              == 0
          )
  
      # Remove user assignments.
      with logged_in_user(conf.ADMIN_CREDENTIALS):
          # Assign user to role directly.
          det_cmd(
              [
                  "rbac",
                  "unassign-role",
                  "WorkspaceCreator",
                  "--username-to-assign",
                  test_user_creds.username,
              ],
              check=True,
          )
          det_cmd(
              [
                  "rbac",
                  "unassign-role",
                  "Viewer",
                  "--username-to-assign",
                  test_user_creds.username,
                  "--workspace-name",
                  "Uncategorized",
              ],
              check=True,
          )
  
      # User has no permissions.
      with logged_in_user(test_user_creds):
          assert (
              "no permissions"
              in det_cmd(
                  ["rbac", "my-permissions"], check=True
              ).stdout.decode()
          )
          json_out = det_cmd_json(["rbac", "my-permissions", "--json"])
          assert json_out["roles"] == []
          assert json_out["assignments"] == []
  
imports: import contextlib
  from typing import Any, Callable, Dict, Generator, List, NamedTuple, Optional, Tuple
  import pytest
  from determined.common import api
  from determined.common.api import authentication, bindings, errors
  from tests import api_utils
  from tests import config
  from tests.cluster.test_workspace_org import setup_workspaces
  from .test_groups import det_cmd, det_cmd_expect_error, det_cmd_json
  from .test_users import logged_in_user
label_desc: Use image node_id 9 for calling a global function with example usage: test_rbac_permission_assignment() without return types