Warn (don't raise) on unknown auth values during CSV import

Post-merge follow-up on #1811 -- the strict behavior it introduced
(create_user_from_line raises ValueError on any auth value not in
_AUTH_CANONICAL) would block CSV imports against newer servers as
soon as Tableau ships an auth type TSC's hardcoded list doesn't yet
know about. This is the same category of stale-list problem the
_set_values enum-guard bypass exists to avoid on the server-parse
path.

Both entry points now warn and pass the value through:

- create_user_from_line: unknown values raise a UserWarning naming
  the value and known set, then get assigned to auth_setting as-is.
  If the value really is a typo, the server rejects the row when
  the request posts -- a slightly-later error, but the import stays
  possible against forward-compatible servers.

- _validate_import_line_or_throw: same shape. Skips the allowlist
  check for the AUTH column when the value isn't in _AUTH_CANONICAL,
  so validate_file_for_import doesn't return the row as invalid.

Server-version-aware validation would be the cleaner long-term fix
here (and for the enum-guard bypass in _set_values); noted for
planning, not filing an issue.

Tests updated: two former "raises ValueError" cases now assert
pytest.warns(UserWarning) and confirm the raw value round-trips
onto UserItem.auth_setting.

Author: jacalata

tableauserverclient/models/user_item.py

@@ -1,4 +1,5 @@
 import io
+import warnings
 import xml.etree.ElementTree as ET
 from datetime import datetime
 from enum import IntEnum
@@ -476,12 +477,23 @@ def create_user_from_line(line: str):
                 )
                 raw_auth = values[UserItem.CSVImport.ColumnType.AUTH]
                 if raw_auth:
-                    auth = UserItem.CSVImport._AUTH_CANONICAL.get(raw_auth.lower())
-                    if auth is None:
-                        raise ValueError(
-                            f"Unknown auth setting: {raw_auth!r}. "
-                            f"Valid values: {sorted(UserItem.CSVImport._AUTH_CANONICAL.values())}"
+                    canonical = UserItem.CSVImport._AUTH_CANONICAL.get(raw_auth.lower())
+                    if canonical is None:
+                        # Unknown auth value: pass it through instead of raising.
+                        # TSC's _AUTH_CANONICAL is a hardcoded list that will lag
+                        # server-side additions; refusing to build the UserItem
+                        # here would block CSV imports against newer servers as
+                        # soon as Tableau ships a new auth type. If it is a
+                        # typo, the server rejects the row when the request
+                        # posts. Warn so the caller has a shot at noticing.
+                        warnings.warn(
+                            f"Unknown auth setting {raw_auth!r}; passing through unchanged. "
+                            f"Known values: {sorted(UserItem.CSVImport._AUTH_CANONICAL.values())}",
+                            stacklevel=2,
                         )
+                        auth = raw_auth
+                    else:
+                        auth = canonical
                 else:
                     auth = None
                 user._set_values(
@@ -546,14 +558,35 @@ def _validate_import_line_or_throw(incoming, logger) -> None:
             for i in range(1, len(line)):
                 value = line[i]
                 valid = _valid_attributes[i]
+                column = UserItem.CSVImport.ColumnType(i)
                 # normalize case for fields with a restricted value set
+                skip_validation = False
                 if valid:
                     if i == UserItem.CSVImport.ColumnType.AUTH:
-                        value = UserItem.CSVImport._AUTH_CANONICAL.get(value.lower(), value)
+                        canonical = UserItem.CSVImport._AUTH_CANONICAL.get(value.lower())
+                        if canonical is not None:
+                            value = canonical
+                        elif value:
+                            # Unknown auth value: warn and pass through instead
+                            # of raising. TSC's _AUTH_CANONICAL is a hardcoded
+                            # list that lags server-side additions; refusing
+                            # would block CSV imports against newer servers as
+                            # soon as Tableau ships a new auth type. Skip the
+                            # allowlist check so the row still validates.
+                            # Matches create_user_from_line's warn-and-pass.
+                            warnings.warn(
+                                f"Unknown auth setting {value!r}; passing through unchanged. "
+                                f"Known values: {sorted(UserItem.CSVImport._AUTH_CANONICAL.values())}",
+                                stacklevel=2,
+                            )
+                            skip_validation = True
                     else:
                         value = value.lower()
-                logger.debug(f"column {UserItem.CSVImport.ColumnType(i).name}: {value}")
-                UserItem.CSVImport._validate_attribute_value(value, valid, UserItem.CSVImport.ColumnType(i))
+                # Mask the password column so it never reaches log handlers.
+                safe_value = "***" if column == UserItem.CSVImport.ColumnType.PASS else value
+                logger.debug(f"column {column.name}: {safe_value}")
+                if not skip_validation:
+                    UserItem.CSVImport._validate_attribute_value(value, valid, column)
 
         # Given a restricted set of possible values, confirm the item is in that set
         @staticmethod

test/test_user_model.py

@@ -204,11 +204,18 @@ def test_too_many_columns_raises() -> None:
         TSC.UserItem.CSVImport.create_user_from_line("u, p, n, creator, none, yes, email, SAML, extra")
 
 
-def test_create_user_with_unknown_auth_raises() -> None:
-    # Unknown AUTH values must raise, not silently produce a UserItem with auth_setting=None.
-    # A caller can catch this if lenient behavior is wanted.
-    with pytest.raises(ValueError, match="Unknown auth setting"):
-        TSC.UserItem.CSVImport.create_user_from_line("username, pword, fname, creator, none, yes, email, NotAnAuthType")
+def test_create_user_with_unknown_auth_passes_through_with_warning() -> None:
+    # Unknown AUTH values pass through with a UserWarning rather than raising.
+    # TSC's _AUTH_CANONICAL is a hardcoded list that lags server-side auth-type
+    # additions; refusing would block CSV imports against newer servers as
+    # soon as Tableau ships a new auth type. If the value really is a typo,
+    # the server rejects the row when the request posts.
+    with pytest.warns(UserWarning, match="Unknown auth setting"):
+        user = TSC.UserItem.CSVImport.create_user_from_line(
+            "username, pword, fname, creator, none, yes, email, NotAnAuthType"
+        )
+    assert user is not None
+    assert user.auth_setting == "NotAnAuthType"
 
 
 def test_create_user_with_lowercase_auth_accepted() -> None:
@@ -218,12 +225,11 @@ def test_create_user_with_lowercase_auth_accepted() -> None:
     assert user.auth_setting == "SAML"
 
 
-def test_validate_import_line_rejects_unknown_auth() -> None:
-    # _validate_import_line_or_throw shares the AUTH canonicalization with
-    # create_user_from_line -- confirm both paths reject unknown auth values so
-    # that validate_file_for_import (which uses this path) doesn't silently
-    # accept rows create_user_from_line would refuse.
-    with pytest.raises(ValueError, match="Invalid value"):
+def test_validate_import_line_warns_on_unknown_auth() -> None:
+    # _validate_import_line_or_throw matches create_user_from_line's warn-and-
+    # pass behavior on unknown auth values: the same row shouldn't be accepted
+    # by one path and rejected by the other.
+    with pytest.warns(UserWarning, match="Unknown auth setting"):
         TSC.UserItem.CSVImport._validate_import_line_or_throw(
             "username, pword, fname, creator, none, yes, email, NotAnAuthType",
             logger,