refactor: CSVImport MAX/auth cleanup from adversarial review

Three small cleanups on UserItem.CSVImport surfaced by an adversarial
code review of the earlier bug fixes:

- MAX renamed to COLUMN_COUNT and moved out of the ColumnType IntEnum.
  ColumnType(8) used to return ColumnType.MAX, a fake column mixed in
  with real column indices. Now the count is a class-level constant.
- _auth_canonical() no longer rebuilds its dict on every call. Promoted
  to _AUTH_CANONICAL class attribute.
- _valid_attributes[AUTH] no longer hardcodes the accepted auth values.
  Derived from _AUTH_CANONICAL.values() instead so there's a single
  source of truth for what AUTH strings are accepted.

No behavior change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jacalata

tableauserverclient/models/user_item.py

@@ -435,20 +435,34 @@ class ColumnType(IntEnum):
             EMAIL = 6
             AUTH = 7
 
-            MAX = 8  # total number of columns (not last index)
+        # Total number of columns supported by the import format. Held outside
+        # the ColumnType enum so it can't be mistaken for a real column index.
+        COLUMN_COUNT = 8
+
+        # Lowercase -> canonical form mapping for the AUTH column. Class-level
+        # so the dict isn't rebuilt on every call to create_user_from_line /
+        # _validate_import_line_or_throw. The set of accepted values is derived
+        # from this map (see _valid_attributes[AUTH]) so there's a single
+        # source of truth.
+        _AUTH_CANONICAL: dict[str, str] = {
+            "saml": "SAML",
+            "openid": "OpenID",
+            "serverdefault": "ServerDefault",
+            "tableauidwithmfa": "TableauIDWithMFA",
+        }
 
         # Read a csv line and create a user item populated by the given attributes
         @staticmethod
         def create_user_from_line(line: str):
             if line is None or line is False or line == "\n" or line == "":
                 return None
             values: list[str] = list(map(str.strip, line.strip().split(",")))
-            if len(values) > UserItem.CSVImport.ColumnType.MAX:
+            if len(values) > UserItem.CSVImport.COLUMN_COUNT:
                 raise ValueError("Too many attributes for user import")
             username = values[UserItem.CSVImport.ColumnType.USERNAME]
             user = UserItem(username)
             if len(values) > 1:
-                while len(values) < UserItem.CSVImport.ColumnType.MAX:
+                while len(values) < UserItem.CSVImport.COLUMN_COUNT:
                     values.append("")
                 site_role = UserItem.CSVImport._evaluate_site_role(
                     values[UserItem.CSVImport.ColumnType.LICENSE],
@@ -457,11 +471,11 @@ def create_user_from_line(line: str):
                 )
                 raw_auth = values[UserItem.CSVImport.ColumnType.AUTH]
                 if raw_auth:
-                    auth = UserItem.CSVImport._auth_canonical().get(raw_auth.lower())
+                    auth = UserItem.CSVImport._AUTH_CANONICAL.get(raw_auth.lower())
                     if auth is None:
                         raise ValueError(
                             f"Unknown auth setting: {raw_auth!r}. "
-                            f"Valid values: {sorted(UserItem.CSVImport._auth_canonical().values())}"
+                            f"Valid values: {sorted(UserItem.CSVImport._AUTH_CANONICAL.values())}"
                         )
                 else:
                     auth = None
@@ -503,18 +517,10 @@ def validate_file_for_import(csv_file: io.TextIOWrapper, logger) -> tuple[int, l
 
         # Some fields in the import file are restricted to specific values
         # Iterate through each field and validate the given value against hardcoded constraints
-        @staticmethod
-        def _auth_canonical() -> dict[str, str]:
-            """Lowercase → canonical form mapping for Auth values."""
-            return {
-                "saml": "SAML",
-                "openid": "OpenID",
-                "serverdefault": "ServerDefault",
-                "tableauidwithmfa": "TableauIDWithMFA",
-            }
-
         @staticmethod
         def _validate_import_line_or_throw(incoming, logger) -> None:
+            # AUTH column's valid set is derived from _AUTH_CANONICAL so there's
+            # one source of truth for the accepted values.
             _valid_attributes: list[list[str]] = [
                 [],
                 [],
@@ -523,16 +529,11 @@ def _validate_import_line_or_throw(incoming, logger) -> None:
                 ["system", "site", "none", "no"],  # admin
                 ["yes", "true", "1", "no", "false", "0"],  # publisher
                 [],
-                [
-                    "SAML",
-                    "OpenID",
-                    "ServerDefault",
-                    "TableauIDWithMFA",
-                ],  # auth — normalized by _auth_canonical before comparison
+                list(UserItem.CSVImport._AUTH_CANONICAL.values()),  # auth — normalized before comparison
             ]
 
             line = list(map(str.strip, incoming.split(",")))
-            if len(line) > UserItem.CSVImport.ColumnType.MAX:
+            if len(line) > UserItem.CSVImport.COLUMN_COUNT:
                 raise AttributeError("Too many attributes in line")
             username = line[UserItem.CSVImport.ColumnType.USERNAME.value]
             logger.debug(f"> details - {username}")
@@ -543,7 +544,7 @@ def _validate_import_line_or_throw(incoming, logger) -> None:
                 # normalize case for fields with a restricted value set
                 if valid:
                     if i == UserItem.CSVImport.ColumnType.AUTH:
-                        value = UserItem.CSVImport._auth_canonical().get(value.lower(), value)
+                        value = UserItem.CSVImport._AUTH_CANONICAL.get(value.lower(), value)
                     else:
                         value = value.lower()
                 logger.debug(f"column {UserItem.CSVImport.ColumnType(i).name}: {value}")