code: def test_rbac_list_roles() -> None:
      with logged_in_user(conf.ADMIN_CREDENTIALS):
          det_cmd(["rbac", "list-roles"], check=True)
          all_roles = det_cmd_json(["rbac", "list-roles", "--json"])[
              "roles"
          ]
  
          # Test list-roles excluding global roles properly.
          non_excluded_roles = det_cmd_json(
              ["rbac", "list-roles", "--exclude-global-roles", "--json"]
          )["roles"]
          non_excluded_role_ids = {
              r["roleId"] for r in non_excluded_roles
          }
          for role in all_roles:
              is_excluded = role["roleId"] not in non_excluded_role_ids
              is_global = any(
                  not p["scopeTypeMask"]["workspace"]
                  for p in role["permissions"]
              )
              assert is_excluded == is_global
  
          # Test list-roles pagination.
          json_out = det_cmd_json(
              ["rbac", "list-roles", "--limit=2", "--json"]
          )
          assert len(json_out["roles"]) == 2
          assert json_out["pagination"]["limit"] == 2
          assert json_out["pagination"]["total"] == len(all_roles)
          assert json_out["pagination"]["offset"] == 0
  
          json_out = det_cmd_json(
              [
                  "rbac",
                  "list-roles",
                  "--offset=1",
                  "--limit=199",
                  "--json",
              ]
          )
          assert len(json_out["roles"]) == len(all_roles) - 1
          assert json_out["pagination"]["limit"] == 199
          assert json_out["pagination"]["total"] == len(all_roles)
          assert json_out["pagination"]["offset"] == 1
  
          # Set up group/user to test with.
          api_utils.configure_token_store(conf.ADMIN_CREDENTIALS)
          test_user_creds = api_utils.create_test_user()
          group_name = api_utils.get_random_string()
          det_cmd(
              [
                  "user-group",
                  "create",
                  group_name,
                  "--add-user",
                  test_user_creds.username,
              ],
              check=True,
          )
  
          # No roles should be returned since no assignmnets have happened.
          list_user_roles = [
              "rbac",
              "list-users-roles",
              test_user_creds.username,
          ]
          list_group_roles = ["rbac", "list-groups-roles", group_name]
  
          assert (
              det_cmd_json(list_user_roles + ["--json"])["roles"] == []
          )
          assert (
              "user has no role assignments"
              in det_cmd(list_user_roles, check=True).stdout.decode()
          )
  
          assert (
              det_cmd_json(list_group_roles + ["--json"])["roles"] == []
          )
          assert (
              "group has no role assignments"
              in det_cmd(list_group_roles, check=True).stdout.decode()
          )
  
          # Assign roles.
          det_cmd(
              [
                  "rbac",
                  "assign-role",
                  "Viewer",
                  "--username-to-assign",
                  test_user_creds.username,
              ],
              check=True,
          )
          det_cmd(
              [
                  "rbac",
                  "assign-role",
                  "Viewer",
                  "--username-to-assign",
                  test_user_creds.username,
                  "--workspace-name",
                  "Uncategorized",
              ],
              check=True,
          )
  
          det_cmd(
              [
                  "rbac",
                  "assign-role",
                  "Editor",
                  "--group-name-to-assign",
                  group_name,
              ],
              check=True,
          )
          det_cmd(
              [
                  "rbac",
                  "assign-role",
                  "Editor",
                  "--group-name-to-assign",
                  group_name,
                  "--workspace-name",
                  "Uncategorized",
              ],
              check=True,
          )
  
          # Test list-users-roles.
          det_cmd(list_user_roles, check=True)
          json_out = det_cmd_json(list_user_roles + ["--json"])
          assert len(json_out["roles"]) == 2
          json_out["roles"].sort(
              key=lambda x: -1 if x["role"]["name"] == "Viewer" else 1
          )
          assert json_out["roles"][0]["role"]["name"] == "Viewer"
  
          assert len(json_out["roles"][0]["groupRoleAssignments"]) == 0
          workspace_ids = [
              a["roleAssignment"]["scopeWorkspaceId"]
              for a in json_out["roles"][0]["userRoleAssignments"]
          ]
          assert len(workspace_ids) == 2
          assert 1 in workspace_ids
          assert None in workspace_ids
  
          assert json_out["roles"][1]["role"]["name"] == "Editor"
          assert len(json_out["roles"][1]["groupRoleAssignments"]) == 2
          workspace_ids = [
              a["roleAssignment"]["scopeWorkspaceId"]
              for a in json_out["roles"][1]["groupRoleAssignments"]
          ]
          assert len(workspace_ids) == 2
          assert len(json_out["roles"][1]["userRoleAssignments"]) == 0
  
          # Test list-groups-roles.
          det_cmd(list_group_roles, check=True)
          json_out = det_cmd_json(list_group_roles + ["--json"])
          assert len(json_out["roles"]) == 1
          assert len(json_out["assignments"]) == 1
          assert json_out["roles"][0]["name"] == "Editor"
          assert (
              json_out["assignments"][0]["roleId"]
              == json_out["roles"][0]["roleId"]
          )
          assert json_out["assignments"][0]["scopeWorkspaceIds"] == [1]
          assert json_out["assignments"][0]["scopeCluster"]
  
imports: import contextlib
  from typing import Any, Callable, Dict, Generator, List, NamedTuple, Optional, Tuple
  import pytest
  from determined.common import api
  from determined.common.api import authentication, bindings, errors
  from tests import api_utils
  from tests import config
  from tests.cluster.test_workspace_org import setup_workspaces
  from .test_groups import det_cmd, det_cmd_expect_error, det_cmd_json
  from .test_users import logged_in_user
label_desc: Use image node_id 11 for calling a global function with example usage: test_rbac_list_roles() without return types