Merge branch 'tableau:development' into development

Author: dxdc

.github/dependabot.yml

@@ -3,11 +3,16 @@ updates:
   - package-ecosystem: "pip"
     directory: "/"
     target-branch: "development"
+    # Security advisories fire independently of the weekly schedule as long
+    # as the repo has "Dependabot security updates" enabled under
+    # Settings -> Code security. Weekly = non-security updates.
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 10
 
   - package-ecosystem: "github-actions"
     directory: "/"
     target-branch: "development"
     schedule:
       interval: "weekly"
+    open-pull-requests-limit: 10

.github/workflows/link-issues-to-prs.yml

@@ -0,0 +1,104 @@
+name: Mark linked issues in-progress
+
+# When an open PR references an issue with Closes/Fixes/Resolves, apply the
+# 'in-progress' label to that issue so the stale bot leaves it alone (the
+# stale workflow already exempts 'in-progress'). Remove the label when the
+# PR closes without merging, so a genuinely abandoned PR does not keep its
+# referenced issues shielded forever.
+#
+# actions/stale looks at issue-level events only; a PR that references an
+# issue does not reset the issue's stale timer or move it off the stale
+# label. This workflow bridges that gap.
+#
+# Security note: the script only reads pr.body, extracts decimal issue
+# numbers via a fixed regex, and passes those numbers to the REST API.
+# Body content is never expanded into a run: command or a shell.
+
+on:
+  pull_request_target:
+    types: [opened, edited, reopened, synchronize, ready_for_review, closed]
+
+permissions:
+  issues: write
+  pull-requests: read
+
+jobs:
+  link:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/github-script@v7
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const body = pr.body || '';
+            const re = /\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+#(\d+)/gi;
+            // Cross-repo references (owner/repo#123) are intentionally skipped;
+            // this workflow only labels issues in the current repo.
+            const MAX_REFS = 50; // cap runaway PR bodies from forks (pull_request_target).
+            const extract = (text) => [...new Set(
+              [...(text || '').matchAll(re)].map(m => Number(m[1]))
+            )].slice(0, MAX_REFS);
+
+            const current = extract(body);
+
+            // On `edited`, compute which references were REMOVED so their
+            // labels come off. Without this, a PR that once said "Closes #42"
+            // and no longer does would leave #42 shielded indefinitely.
+            let removed = [];
+            if (context.payload.action === 'edited') {
+              const prevBody = context.payload.changes?.body?.from;
+              if (prevBody !== undefined) {
+                const previous = extract(prevBody);
+                const now = new Set(current);
+                removed = previous.filter(n => !now.has(n));
+              }
+            }
+
+            // Apply the label while the PR is open. Remove it when the PR
+            // closes without merging (merged PRs also close, but the issue
+            // will be auto-closed by GitHub once the merge lands, so the
+            // in-progress label on it is harmless). Also remove on `edited`
+            // when a reference was deleted from the body.
+            const shouldLabel = pr.state === 'open';
+            const closeUnlabel = pr.state === 'closed' && !pr.merged ? current : [];
+            const toUnlabel = [...new Set([...removed, ...closeUnlabel])];
+
+            if (current.length === 0 && toUnlabel.length === 0) {
+              core.info('No Closes/Fixes/Resolves references to process; nothing to do.');
+              return;
+            }
+
+            const removeLabelSafe = async (n) => {
+              await github.rest.issues.removeLabel({
+                ...context.repo,
+                issue_number: n,
+                name: 'in-progress',
+              }).catch(err => {
+                // 404 just means the label was not present; not an error.
+                if (err.status !== 404) throw err;
+              });
+              core.info(`#${n}: removed in-progress`);
+            };
+
+            if (shouldLabel) {
+              for (const n of current) {
+                try {
+                  await github.rest.issues.addLabels({
+                    ...context.repo,
+                    issue_number: n,
+                    labels: ['in-progress'],
+                  });
+                  core.info(`#${n}: added in-progress`);
+                } catch (err) {
+                  core.warning(`#${n}: ${err.message}`);
+                }
+              }
+            }
+
+            for (const n of toUnlabel) {
+              try {
+                await removeLabelSafe(n);
+              } catch (err) {
+                core.warning(`#${n}: ${err.message}`);
+              }
+            }

.github/workflows/stale.yml

@@ -18,7 +18,7 @@ jobs:
         with:
           stale-issue-label: 'stale'
           stale-pr-label: 'stale'
-          exempt-issue-labels: 'good first issue,Design Proposal,in-progress'
+          exempt-issue-labels: 'good first issue,Design Proposal,in-progress,Server-Side Enhancement'
           exempt-pr-labels: 'in-progress'
 
           days-before-issue-stale: 60

CHANGELOG.md

@@ -1,6 +1,13 @@
 
 ## Unreleased
 
+* Bumped the urllib3 floor to 2.6.3 to pick up the fix for CVE-2026-21441
+  (GHSA-38jv-5279-wg99, 8.9 High): urllib3's streaming decompression
+  safeguards were bypassed when HTTP redirects were followed. TSC's manual
+  redirect walker (#1848) disables urllib3's built-in follower on new code
+  paths, but downstream callers using urllib3 directly (and TSC endpoints
+  that predate #1848) still relied on the built-in path, so the floor bump
+  closes the gap for all callers. The existing `<3` upper bound is unchanged.
 * Added `Projects.get_by_path(path)` to look up a project by its slash-separated
   hierarchy path (e.g. `"Marketing/Q1 Reports"`). The walk is performed level by
   level using the REST API name filter, so a path with *n* components issues *n*

pyproject.toml

@@ -16,7 +16,7 @@ dependencies = [
     'defusedxml>=0.7.1',  # latest as at 7/31/23
     'packaging>=23.1',   # latest as at 7/31/23
     'requests>=2.32',  # latest as at 7/31/23
-    'urllib3>=2.6.0,<3',
+    'urllib3>=2.6.3,<3',
     'typing_extensions>=4.0',
 ]
 requires-python = ">=3.10"

tableauserverclient/models/user_item.py

@@ -1,4 +1,5 @@
 import io
+import warnings
 import xml.etree.ElementTree as ET
 from datetime import datetime
 from enum import IntEnum
@@ -476,12 +477,23 @@ def create_user_from_line(line: str):
                 )
                 raw_auth = values[UserItem.CSVImport.ColumnType.AUTH]
                 if raw_auth:
-                    auth = UserItem.CSVImport._AUTH_CANONICAL.get(raw_auth.lower())
-                    if auth is None:
-                        raise ValueError(
-                            f"Unknown auth setting: {raw_auth!r}. "
-                            f"Valid values: {sorted(UserItem.CSVImport._AUTH_CANONICAL.values())}"
+                    canonical = UserItem.CSVImport._AUTH_CANONICAL.get(raw_auth.lower())
+                    if canonical is None:
+                        # Unknown auth value: pass it through instead of raising.
+                        # TSC's _AUTH_CANONICAL is a hardcoded list that will lag
+                        # server-side additions; refusing to build the UserItem
+                        # here would block CSV imports against newer servers as
+                        # soon as Tableau ships a new auth type. If it is a
+                        # typo, the server rejects the row when the request
+                        # posts. Warn so the caller has a shot at noticing.
+                        warnings.warn(
+                            f"Unknown auth setting {raw_auth!r}; passing through unchanged. "
+                            f"Known values: {sorted(UserItem.CSVImport._AUTH_CANONICAL.values())}",
+                            stacklevel=2,
                         )
+                        auth = raw_auth
+                    else:
+                        auth = canonical
                 else:
                     auth = None
                 user._set_values(
@@ -546,14 +558,33 @@ def _validate_import_line_or_throw(incoming, logger) -> None:
             for i in range(1, len(line)):
                 value = line[i]
                 valid = _valid_attributes[i]
+                column = UserItem.CSVImport.ColumnType(i)
                 # normalize case for fields with a restricted value set
+                skip_validation = False
                 if valid:
                     if i == UserItem.CSVImport.ColumnType.AUTH:
-                        value = UserItem.CSVImport._AUTH_CANONICAL.get(value.lower(), value)
+                        canonical = UserItem.CSVImport._AUTH_CANONICAL.get(value.lower())
+                        if canonical is not None:
+                            value = canonical
+                        elif value:
+                            # Unknown auth value: warn and pass through instead
+                            # of raising. TSC's _AUTH_CANONICAL is a hardcoded
+                            # list that lags server-side additions; refusing
+                            # would block CSV imports against newer servers as
+                            # soon as Tableau ships a new auth type. Skip the
+                            # allowlist check so the row still validates.
+                            # Matches create_user_from_line's warn-and-pass.
+                            warnings.warn(
+                                f"Unknown auth setting {value!r}; passing through unchanged. "
+                                f"Known values: {sorted(UserItem.CSVImport._AUTH_CANONICAL.values())}",
+                                stacklevel=2,
+                            )
+                            skip_validation = True
                     else:
                         value = value.lower()
-                logger.debug(f"column {UserItem.CSVImport.ColumnType(i).name}: {value}")
-                UserItem.CSVImport._validate_attribute_value(value, valid, UserItem.CSVImport.ColumnType(i))
+                logger.debug(f"column {column.name}: {value}")
+                if not skip_validation:
+                    UserItem.CSVImport._validate_attribute_value(value, valid, column)
 
         # Given a restricted set of possible values, confirm the item is in that set
         @staticmethod
@@ -565,6 +596,49 @@ def _validate_attribute_value(item: str, possible_values: list[str], column_type
                 return
             raise ValueError(f"Invalid value {item} for {column_type}")
 
+        # Inverse of _evaluate_site_role: decompose a site role back to (license, admin_level, publish)
+        # for writing the CSV import format.
+        @staticmethod
+        def _decompose_site_role(site_role: str) -> tuple[str, str, str]:
+            """Return (license, admin_level, publish) CSV column values for a given site role.
+
+            Legacy `UserItem.Roles` values are handled in two ways depending on whether
+            the server has a sensible modern equivalent:
+
+            - **Mapped to modern equivalents** (row emitted, server accepts): the legacy
+              roles `SiteAdministrator`, `Publisher`, `Interactor`, and `ReadOnly` each
+              map to the current-model role that best matches their historical intent
+              (SiteAdministratorExplorer, ExplorerCanPublish, Explorer, Viewer).
+            - **Emitted as `license="Invalid"`** (row rejected server-side with
+              USER_CSV_INVALID_LICENSE): the legacy roles `UnlicensedWithPublish`,
+              `ViewerWithPublish`, `Guest`, and `SupportUser` have no equivalent in the
+              current server model (`RestApiSiteRole` does not accept them on any code
+              path). Emitting `"Invalid"` preserves the per-row error semantics callers
+              of `bulk_add` had before this refactor, rather than silently coercing
+              those users to a valid-but-wrong Unlicensed account.
+
+            Round-trip note: `_evaluate_site_role(*_decompose_site_role(r)) == r` for
+            every current-model role. Two label asymmetries: `ServerAdministrator`
+            round-trips through the legacy label `SiteAdministrator` (that's the only
+            label `_evaluate_site_role` emits for `admin="System"`), and the legacy
+            roles above are folded into their modern equivalents by design.
+            """
+            _role_map: dict[str, tuple[str, str, str]] = {
+                "ServerAdministrator": ("Creator", "System", "1"),
+                "SiteAdministratorCreator": ("Creator", "Site", "1"),
+                "SiteAdministratorExplorer": ("Explorer", "Site", "1"),
+                "SiteAdministrator": ("Explorer", "Site", "1"),  # legacy, mapped to SiteAdministratorExplorer
+                "Creator": ("Creator", "None", "1"),
+                "ExplorerCanPublish": ("Explorer", "None", "1"),
+                "Explorer": ("Explorer", "None", "0"),
+                "Viewer": ("Viewer", "None", "0"),
+                "Unlicensed": ("Unlicensed", "None", "0"),
+                "ReadOnly": ("Viewer", "None", "0"),  # legacy, mapped to Viewer
+                "Publisher": ("Explorer", "None", "1"),  # legacy, mapped to ExplorerCanPublish
+                "Interactor": ("Explorer", "None", "0"),  # legacy, mapped to Explorer
+            }
+            return _role_map.get(site_role, ("Invalid", "None", "0"))
+
         # https://help.tableau.com/current/server/en-us/csvguidelines.htm#settings_and_site_roles
         # This logic is hardcoded to match the existing rules for import csv files
         @staticmethod
@@ -586,14 +660,14 @@ def _evaluate_site_role(license_level, admin_level, publisher):
                 else:
                     site_role = "SiteAdministratorExplorer"
             else:  # if it wasn't 'system' or 'site' then we can treat it as 'none'
-                if publisher == "yes":
+                if publisher in ("yes", "true", "1"):
                     if license_level == "creator":
                         site_role = "Creator"
                     elif license_level == "explorer":
                         site_role = "ExplorerCanPublish"
                     else:
                         site_role = "Unlicensed"  # is this the expected outcome?
-                else:  # publisher == 'no':
+                else:  # publisher is "no" / "false" / "0" / any other value:
                     if license_level == "explorer" or license_level == "creator":
                         site_role = "Explorer"
                     elif license_level == "viewer":

tableauserverclient/server/endpoint/endpoint.py

@@ -554,6 +554,9 @@ def fields(self: Self, *fields: str) -> QuerySet:
         queryset.request_options.fields |= set(fields) | set(("_default_",))
         return queryset
 
+    def find_by_name(self, name: str) -> list[T]:
+        return list(self.filter(name=name))
+
     def only_fields(self: Self, *fields: str) -> QuerySet:
         """
         Add fields to the request options. If no fields are provided, the

tableauserverclient/server/endpoint/users_endpoint.py

@@ -527,7 +527,7 @@ def create_from_file(self, filepath: str) -> tuple[list[UserItem], list[tuple[Us
         warnings.warn("This method is deprecated, use bulk_add instead", DeprecationWarning)
         created = []
         failed = []
-        if not filepath.find("csv"):
+        if "csv" not in filepath:
             raise ValueError("Only csv files are accepted")
 
         with open(filepath) as csv_file:
@@ -536,11 +536,9 @@ def create_from_file(self, filepath: str) -> tuple[list[UserItem], list[tuple[Us
             while line and line != "":
                 user: UserItem = UserItem.CSVImport.create_user_from_line(line)
                 try:
-                    print(user)
                     result = self.add(user)
                     created.append(result)
                 except ServerResponseError as serverError:
-                    print("failed")
                     failed.append((user, serverError))
                 line = csv_file.readline()
         return created, failed
@@ -751,6 +749,7 @@ def create_users_csv(users: Iterable[UserItem]) -> bytes:
     - Admin Level
     - Publish capability
     - Email
+    - Auth setting
 
     Parameters
     ----------
@@ -765,22 +764,7 @@ def create_users_csv(users: Iterable[UserItem]) -> bytes:
     with io.StringIO() as output:
         writer = csv.writer(output, quoting=csv.QUOTE_MINIMAL)
         for user in users:
-            site_role = user.site_role or "Unlicensed"
-            if site_role == "ServerAdministrator":
-                license = "Creator"
-                admin_level = "System"
-            elif site_role.startswith("SiteAdministrator"):
-                admin_level = "Site"
-                license = site_role.replace("SiteAdministrator", "")
-            else:
-                license = site_role
-                admin_level = ""
-
-            if any(x in site_role for x in ("Creator", "Admin", "Publish")):
-                publish = 1
-            else:
-                publish = 0
-
+            license, admin_level, publish = UserItem.CSVImport._decompose_site_role(user.site_role or "Unlicensed")
             writer.writerow(
                 (
                     f"{user.domain_name}\\{user.name}" if user.domain_name else user.name,
@@ -790,6 +774,7 @@ def create_users_csv(users: Iterable[UserItem]) -> bytes:
                     admin_level,
                     publish,
                     user.email,
+                    user.auth_setting or "",
                 )
             )
         output.seek(0)

test/test_user.py

@@ -405,7 +405,7 @@ def test_create_users_csv() -> None:
         "ServerAdministrator": "System",
     }
 
-    csv_columns = ["name", "password", "fullname", "license", "admin", "publish", "email"]
+    csv_columns = ["name", "password", "fullname", "license", "admin", "publish", "email", "auth"]
     csv_data = create_users_csv(users)
     csv_file = io.StringIO(csv_data.decode("utf-8"))
     csv_reader = csv.reader(csv_file)
@@ -417,8 +417,23 @@ def test_create_users_csv() -> None:
         assert (user.fullname or "") == csv_user["fullname"]
         assert (user.email or "") == csv_user["email"]
         assert license_map[site_role] == csv_user["license"]
-        assert admin_map.get(site_role, "") == csv_user["admin"]
+        assert admin_map.get(site_role, "None") == csv_user["admin"]
         assert publish_map[site_role] == int(csv_user["publish"])
+        assert (user.auth_setting or "") == csv_user["auth"]
+
+
+def test_decompose_unsupported_role_emits_invalid_license() -> None:
+    # UnlicensedWithPublish and ViewerWithPublish are in UserItem.Roles for
+    # historical reasons but the server-side CSV license parser has never
+    # accepted them. _decompose_site_role emits license="Invalid" for these
+    # (and any other unmapped role) so the server rejects the row with
+    # USER_CSV_INVALID_LICENSE, preserving the per-row error semantics
+    # callers of bulk_add had before this refactor.
+    for role in ("UnlicensedWithPublish", "ViewerWithPublish", "Guest", "SupportUser"):
+        license, admin, publish = TSC.UserItem.CSVImport._decompose_site_role(role)
+        assert license == "Invalid"
+        assert admin == "None"
+        assert publish == "0"
 
 
 def test_bulk_add(server: TSC.Server) -> None: