Merge remote-tracking branch 'origin/development' into jac/1046-remove-old-namespace

# Conflicts:
#	tableauserverclient/server/endpoint/auth_endpoint.py

Author: jacalata

CHANGELOG.md

@@ -5,6 +5,31 @@
   hierarchy path (e.g. `"Marketing/Q1 Reports"`). The walk is performed level by
   level using the REST API name filter, so a path with *n* components issues *n*
   requests. Returns the matching `ProjectItem` or `None` if no project is found.
+* Preserve HTTP method and body across 3xx redirects. Previously `requests`
+  followed 301/302/303 by converting POST to GET and dropping the body, so
+  endpoints like `users.add`, `workbooks.publish`, and any write hitting a
+  server behind a redirect would 405. TSC now disables `requests`'s
+  auto-redirect and walks the chain manually, up to `session.max_redirects`
+  hops (default 30). Refuses HTTPS -> HTTP scheme downgrades and raises
+  `RedirectError` with a clear message on missing `Location` headers or hop
+  overflow. Fixes #1127 and #1828.
+* `UserItem.CSVImport.create_user_from_line` no longer
+  lowercases the entire CSV line before parsing. Previously the whole line,
+  including the username, display name, fullname, and email fields, was
+  lowercased destructively (e.g. `JSmith` became `jsmith`). Case is now
+  preserved for those fields; only the comparison-relevant fields (license,
+  admin_level, publisher, auth_setting) are normalized internally for
+  validation. Callers relying on the previous lowercased output -- e.g. dict
+  lookups keyed on `user.name`, or assertions against lowercased values --
+  need to update. This unblocks CSV imports for LDAP and other case-sensitive
+  auth backends where mixed-case usernames must be preserved.
+* `UserItem.CSVImport._validate_attribute_value` and the too-many-columns
+  branch of `_validate_import_line_or_throw` now raise `ValueError` instead
+  of `AttributeError` for invalid CSV input. `AttributeError` was the wrong
+  exception type for input validation and inconsistent with
+  `create_user_from_line`. `validate_file_for_import` catches `Exception` so
+  it is unaffected; direct callers who caught `AttributeError` specifically
+  need to widen their handler.
 * Added `JobItem.status_notes` for the structured `<statusNotes><statusNote
   type=".." value=".." text=".."/></statusNotes>` block documented on the Query
   Job REST endpoint. Populated for UserImport and other multi-row jobs where

tableauserverclient/models/user_item.py

@@ -308,6 +308,14 @@ def _set_values(
         if email:
             self.email = email
         if auth_setting:
+            # Write directly to _auth_setting rather than going through the
+            # @property_is_enum(Auth) setter. This method is called from both
+            # CSV import and server response parsing (from_xml, populate, etc.);
+            # if the server ever returns an auth type we don't yet know about
+            # (a new Auth value in a future Tableau release), the enum guard
+            # would raise ValueError during response parsing. CSV callers
+            # already validate the auth string against CSVImport._AUTH_CANONICAL
+            # before calling here, so this write is safe.
             self._auth_setting = auth_setting
         if domain_name:
             self._domain_name = domain_name
@@ -432,36 +440,59 @@ class ColumnType(IntEnum):
             EMAIL = 6
             AUTH = 7
 
-            MAX = 7
+        # Total number of columns supported by the import format. Held outside
+        # the ColumnType enum so it can't be mistaken for a real column index.
+        COLUMN_COUNT = 8
+
+        # Lowercase -> canonical form mapping for the AUTH column. Class-level
+        # so the dict isn't rebuilt on every call to create_user_from_line /
+        # _validate_import_line_or_throw. The set of accepted values is derived
+        # from this map (see _valid_attributes[AUTH]) so there's a single
+        # source of truth.
+        _AUTH_CANONICAL: dict[str, str] = {
+            "saml": "SAML",
+            "openid": "OpenID",
+            "serverdefault": "ServerDefault",
+            "tableauidwithmfa": "TableauIDWithMFA",
+        }
 
         # Read a csv line and create a user item populated by the given attributes
         @staticmethod
         def create_user_from_line(line: str):
             if line is None or line is False or line == "\n" or line == "":
                 return None
-            line = line.strip().lower()
-            values: list[str] = list(map(str.strip, line.split(",")))
-            user = UserItem(values[UserItem.CSVImport.ColumnType.USERNAME])
+            values: list[str] = list(map(str.strip, line.strip().split(",")))
+            if len(values) > UserItem.CSVImport.COLUMN_COUNT:
+                raise ValueError("Too many attributes for user import")
+            username = values[UserItem.CSVImport.ColumnType.USERNAME]
+            user = UserItem(username)
             if len(values) > 1:
-                if len(values) > UserItem.CSVImport.ColumnType.MAX:
-                    raise ValueError("Too many attributes for user import")
-                while len(values) <= UserItem.CSVImport.ColumnType.MAX:
+                while len(values) < UserItem.CSVImport.COLUMN_COUNT:
                     values.append("")
                 site_role = UserItem.CSVImport._evaluate_site_role(
                     values[UserItem.CSVImport.ColumnType.LICENSE],
                     values[UserItem.CSVImport.ColumnType.ADMIN],
                     values[UserItem.CSVImport.ColumnType.PUBLISHER],
                 )
-
+                raw_auth = values[UserItem.CSVImport.ColumnType.AUTH]
+                if raw_auth:
+                    auth = UserItem.CSVImport._AUTH_CANONICAL.get(raw_auth.lower())
+                    if auth is None:
+                        raise ValueError(
+                            f"Unknown auth setting: {raw_auth!r}. "
+                            f"Valid values: {sorted(UserItem.CSVImport._AUTH_CANONICAL.values())}"
+                        )
+                else:
+                    auth = None
                 user._set_values(
                     None,
-                    values[UserItem.CSVImport.ColumnType.USERNAME],
+                    username,
                     site_role,
                     None,
                     None,
                     values[UserItem.CSVImport.ColumnType.DISPLAY_NAME],
                     values[UserItem.CSVImport.ColumnType.EMAIL],
-                    values[UserItem.CSVImport.ColumnType.AUTH],
+                    auth,
                     None,
                     None,
                     None,
@@ -493,6 +524,8 @@ def validate_file_for_import(csv_file: io.TextIOWrapper, logger) -> tuple[int, l
         # Iterate through each field and validate the given value against hardcoded constraints
         @staticmethod
         def _validate_import_line_or_throw(incoming, logger) -> None:
+            # AUTH column's valid set is derived from _AUTH_CANONICAL so there's
+            # one source of truth for the accepted values.
             _valid_attributes: list[list[str]] = [
                 [],
                 [],
@@ -501,20 +534,26 @@ def _validate_import_line_or_throw(incoming, logger) -> None:
                 ["system", "site", "none", "no"],  # admin
                 ["yes", "true", "1", "no", "false", "0"],  # publisher
                 [],
-                [UserItem.Auth.SAML, UserItem.Auth.OpenID, UserItem.Auth.ServerDefault],  # auth
+                list(UserItem.CSVImport._AUTH_CANONICAL.values()),  # auth - normalized before comparison
             ]
 
             line = list(map(str.strip, incoming.split(",")))
-            if len(line) > UserItem.CSVImport.ColumnType.MAX:
-                raise AttributeError("Too many attributes in line")
+            if len(line) > UserItem.CSVImport.COLUMN_COUNT:
+                raise ValueError("Too many attributes for user import")
             username = line[UserItem.CSVImport.ColumnType.USERNAME.value]
             logger.debug(f"> details - {username}")
             UserItem.validate_username_or_throw(username)
             for i in range(1, len(line)):
-                logger.debug(f"column {UserItem.CSVImport.ColumnType(i).name}: {line[i]}")
-                UserItem.CSVImport._validate_attribute_value(
-                    line[i], _valid_attributes[i], UserItem.CSVImport.ColumnType(i)
-                )
+                value = line[i]
+                valid = _valid_attributes[i]
+                # normalize case for fields with a restricted value set
+                if valid:
+                    if i == UserItem.CSVImport.ColumnType.AUTH:
+                        value = UserItem.CSVImport._AUTH_CANONICAL.get(value.lower(), value)
+                    else:
+                        value = value.lower()
+                logger.debug(f"column {UserItem.CSVImport.ColumnType(i).name}: {value}")
+                UserItem.CSVImport._validate_attribute_value(value, valid, UserItem.CSVImport.ColumnType(i))
 
         # Given a restricted set of possible values, confirm the item is in that set
         @staticmethod
@@ -524,7 +563,7 @@ def _validate_attribute_value(item: str, possible_values: list[str], column_type
                 return
             if item in possible_values or possible_values == []:
                 return
-            raise AttributeError(f"Invalid value {item} for {column_type}")
+            raise ValueError(f"Invalid value {item} for {column_type}")
 
         # https://help.tableau.com/current/server/en-us/csvguidelines.htm#settings_and_site_roles
         # This logic is hardcoded to match the existing rules for import csv files

tableauserverclient/server/endpoint/auth_endpoint.py

@@ -4,7 +4,7 @@
 
 from defusedxml.ElementTree import fromstring
 
-from tableauserverclient.server.endpoint.endpoint import Endpoint, api
+from tableauserverclient.server.endpoint.endpoint import Endpoint, XML_CONTENT_TYPE, api
 from tableauserverclient.server.endpoint.exceptions import ServerResponseError
 from tableauserverclient.server.request_factory import RequestFactory
 
@@ -68,19 +68,18 @@ def sign_in(self, auth_req: "Credentials") -> contextmgr:
         """
         url = f"{self.baseurl}/signin"
         signin_req = RequestFactory.Auth.signin_req(auth_req)
-        server_response = self.parent_srv.session.post(
-            url, data=signin_req, **self.parent_srv.http_options, allow_redirects=False
+        # Route through _make_request so signin gets the same redirect handling
+        # (multi-hop, HTTPS->HTTP scheme guard, missing-Location diagnostic,
+        # hop limit) that every other endpoint uses. Explicit auth_token=None
+        # because we don't have one yet -- and self.parent_srv.auth_token
+        # raises NotSignedInError pre-signin, so post_request can't help here.
+        server_response = self._make_request(
+            self.parent_srv.session.post,
+            url,
+            content=signin_req,
+            auth_token=None,
+            content_type=XML_CONTENT_TYPE,
         )
-        # manually handle a redirect so that we send the correct POST request instead of GET
-        # this will make e.g http://online.tableau.com work to redirect to http://east.online.tableau.com
-        if server_response.status_code == 301:
-            server_response = self.parent_srv.session.post(
-                server_response.headers["Location"],
-                data=signin_req,
-                **self.parent_srv.http_options,
-                allow_redirects=False,
-            )
-        self._check_status(server_response, url)
         parsed_response = fromstring(server_response.content)
         site_id = parsed_response.find(".//t:site", namespaces=self.parent_srv.namespace).get("id", None)
         site_url = parsed_response.find(".//t:site", namespaces=self.parent_srv.namespace).get("contentUrl", None)