code: func NewUserContext(user services.User, userRoles services.RoleSet) (*userContext, error) {
  	ctx := &services.Context{User: user}
  	sessionAccess := newAccess(userRoles, ctx, services.KindSession)
  	roleAccess := newAccess(userRoles, ctx, services.KindRole)
  	authConnectors := newAccess(userRoles, ctx, services.KindAuthConnector)
  	trustedClusterAccess := newAccess(userRoles, ctx, services.KindTrustedCluster)
  	logins := getLogins(userRoles)
  
  	acl := userACL{
  		AuthConnectors:  authConnectors,
  		TrustedClusters: trustedClusterAccess,
  		Sessions:        sessionAccess,
  		Roles:           roleAccess,
  		SSHLogins:       logins,
  	}
  
  	// local user
  	authType := authLocal
  
  	// check for any SSO identities
  	isSSO := len(user.GetOIDCIdentities()) > 0 ||
  		len(user.GetGithubIdentities()) > 0 ||
  		len(user.GetSAMLIdentities()) > 0
  
  	if isSSO {
  		// SSO user
  		authType = authSSO
  	}
  
  	return &userContext{
  		Name:     user.GetName(),
  		ACL:      acl,
  		AuthType: authType,
  		Version:  teleport.Version,
  	}, nil
  }
docs: // NewUserContext constructs user context from roles assigned to user