refactor: extract _decompose_site_role into CSVImport, symmetrical with _evaluate_site_role

Moves the ad-hoc site role → (license, admin_level, publish) logic from
create_users_csv into UserItem.CSVImport._decompose_site_role, making it
the explicit inverse of _evaluate_site_role.

Also fixes pre-existing bugs in the decomposition:
- ExplorerCanPublish was emitted as license="ExplorerCanPublish" (not a
  valid CSV license value); now correctly "Explorer" with publish=1
- SiteAdministrator (legacy role) was emitting license="" via
  str.replace; now maps to ("Explorer", "Site", "1")
- Non-admin roles now emit admin_level="None" (explicit CSV spec value)
  rather than "" (empty string); both are accepted by the server but
  "None" is consistent with the spec and _evaluate_site_role input

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: jacalata

tableauserverclient/models/user_item.py

@@ -548,6 +548,27 @@ def _validate_attribute_value(item: str, possible_values: list[str], column_type
                 return
             raise AttributeError(f"Invalid value {item} for {column_type}")
 
+        # Inverse of _evaluate_site_role: decompose a site role back to (license, admin_level, publish)
+        # for writing the CSV import format.
+        @staticmethod
+        def _decompose_site_role(site_role: str) -> tuple[str, str, str]:
+            """Return (license, admin_level, publish) CSV column values for a given site role."""
+            _role_map: dict[str, tuple[str, str, str]] = {
+                "ServerAdministrator": ("Creator", "System", "1"),
+                "SiteAdministratorCreator": ("Creator", "Site", "1"),
+                "SiteAdministratorExplorer": ("Explorer", "Site", "1"),
+                "SiteAdministrator": ("Explorer", "Site", "1"),  # legacy role, treat as SiteAdministratorExplorer
+                "Creator": ("Creator", "None", "1"),
+                "ExplorerCanPublish": ("Explorer", "None", "1"),
+                "Explorer": ("Explorer", "None", "0"),
+                "Viewer": ("Viewer", "None", "0"),
+                "Unlicensed": ("Unlicensed", "None", "0"),
+                "ReadOnly": ("Viewer", "None", "0"),
+                "Publisher": ("Explorer", "None", "1"),
+                "Interactor": ("Explorer", "None", "0"),
+            }
+            return _role_map.get(site_role, ("Unlicensed", "None", "0"))
+
         # https://help.tableau.com/current/server/en-us/csvguidelines.htm#settings_and_site_roles
         # This logic is hardcoded to match the existing rules for import csv files
         @staticmethod

tableauserverclient/server/endpoint/users_endpoint.py

@@ -764,22 +764,7 @@ def create_users_csv(users: Iterable[UserItem]) -> bytes:
     with io.StringIO() as output:
         writer = csv.writer(output, quoting=csv.QUOTE_MINIMAL)
         for user in users:
-            site_role = user.site_role or "Unlicensed"
-            if site_role == "ServerAdministrator":
-                license = "Creator"
-                admin_level = "System"
-            elif site_role.startswith("SiteAdministrator"):
-                admin_level = "Site"
-                license = site_role.replace("SiteAdministrator", "")
-            else:
-                license = site_role
-                admin_level = ""
-
-            if any(x in site_role for x in ("Creator", "Admin", "Publish")):
-                publish = 1
-            else:
-                publish = 0
-
+            license, admin_level, publish = UserItem.CSVImport._decompose_site_role(user.site_role or "Unlicensed")
             writer.writerow(
                 (
                     f"{user.domain_name}\\{user.name}" if user.domain_name else user.name,

test/test_user.py

@@ -405,7 +405,7 @@ def test_create_users_csv() -> None:
         "ServerAdministrator": "System",
     }
 
-    csv_columns = ["name", "password", "fullname", "license", "admin", "publish", "email"]
+    csv_columns = ["name", "password", "fullname", "license", "admin", "publish", "email", "auth"]
     csv_data = create_users_csv(users)
     csv_file = io.StringIO(csv_data.decode("utf-8"))
     csv_reader = csv.reader(csv_file)
@@ -417,8 +417,9 @@ def test_create_users_csv() -> None:
         assert (user.fullname or "") == csv_user["fullname"]
         assert (user.email or "") == csv_user["email"]
         assert license_map[site_role] == csv_user["license"]
-        assert admin_map.get(site_role, "") == csv_user["admin"]
+        assert admin_map.get(site_role, "None") == csv_user["admin"]
         assert publish_map[site_role] == int(csv_user["publish"])
+        assert (user.auth_setting or "") == csv_user["auth"]
 
 
 def test_bulk_add(server: TSC.Server) -> None: