def get_roles(decoded_token):
    """Get roles declared in the input token

    Note: returns both the realm roles and client roles

    Args:
        decoded_token (dict): The user's decoded bearer token

    Returns:
        list[str]: List of role names
    """

    # Extract realm scoped roles
    try:
        # Session logins and Bearer tokens from password Grant Types
        if 'realm_access' in decoded_token:
            roles = decoded_token['realm_access']['roles']
        else: #  Bearer tokens from authorization_code Grant Types
              # DP ???: a session login uses an authorization_code code, not sure
              #         about the difference
            roles = decoded_token['resource_access']['account']['roles']
    except KeyError:
        roles = []

    # Extract all client scoped roles
    for name, client in decoded_token.get('resource_access', {}).items():
        if name is 'account':
            continue

        try:
            roles.extend(client['roles'])
        except KeyError: # pragma no cover
            pass

    return roles