diff --git a/backend/db/models/user.js b/backend/db/models/user.js
index b56cb3b83..0b528f627 100644
--- a/backend/db/models/user.js
+++ b/backend/db/models/user.js
@@ -641,7 +641,7 @@ module.exports = (sequelize, DataTypes) => {
                 afterUpdate: async (user, options) => {
                     const {context, transaction} = options;
                     const {userRoles, roleMap} = context || {};
-                    if (userRoles && roleMap) {
+                    if (userRoles) {
                         await assignUserRoles(user, userRoles, roleMap, true, transaction);
                     }
                 },
diff --git a/backend/webserver/sockets/user.js b/backend/webserver/sockets/user.js
index 1fbb6aa2d..895926e6f 100644
--- a/backend/webserver/sockets/user.js
+++ b/backend/webserver/sockets/user.js
@@ -221,6 +221,7 @@ class UserSocket extends Socket {
      */
     async bulkCreateUsers(data) {
         const users = data["users"];
+        const roleMap = data["roleMap"];
 
         const createdUsers = [];
         const errors = [];
@@ -233,7 +234,7 @@ class UserSocket extends Socket {
                 if (!user.exists) {
                     createdUser = await this.models["user"].add(user, {
                         transaction, context: {
-                            userRoles: user.roles, roleMap: data["moodleCareRoleMap"],
+                            userRoles: user.roles, roleMap,
                         },
                     })
 
@@ -244,7 +245,7 @@ class UserSocket extends Socket {
                             firstName: user.firstName, lastName: user.lastName, extId: user.extId, emailVerified: true,
                         }, {
                             transaction, context: {
-                                userRoles: user.roles, roleMap: data["moodleCareRoleMap"],
+                                userRoles: user.roles, roleMap,
                             }
                         });
                     } else {
@@ -525,4 +526,4 @@ class UserSocket extends Socket {
     }
 };
 
-module.exports = UserSocket;
\ No newline at end of file
+module.exports = UserSocket;
diff --git a/backend/webserver/utils/settingSave.js b/backend/webserver/utils/settingSave.js
index 10526259f..371b1cba4 100644
--- a/backend/webserver/utils/settingSave.js
+++ b/backend/webserver/utils/settingSave.js
@@ -3,6 +3,19 @@
 const { assertStableEmailTemplateContent } = require("../../utils/helper/templateResolver");
 
 const MAIL_SERVICE_KEY_PREFIX = "system.mailService.";
+// Only list setting types where leading/trailing whitespace has no semantic value.
+// Unknown or newly added types preserve whitespace by default.
+const TRIM_WHITESPACE_SETTING_TYPES = new Set(["boolean", "color", "integer", "number", "string"]);
+
+/**
+ * Returns whether a setting value should be trimmed before saving.
+ *
+ * @param {Object} setting setting entry
+ * @returns {boolean}
+ */
+function shouldTrimSetting(setting) {
+    return TRIM_WHITESPACE_SETTING_TYPES.has(setting?.type);
+}
 
 /**
  * Reject email.template.* settings that point at a missing or incomplete template.
@@ -66,16 +79,48 @@ function payloadTouchesMailService(settings) {
  * Normalize setting values to string payload format expected by the settings model.
  *
  * @param {*} value setting value
+ * @param {Object} [setting] setting entry
  * @returns {string}
  */
-function normalizeSettingValue(value) {
+function normalizeSettingValue(value, setting = {}) {
+    let normalized;
     if (value === null || value === undefined) {
-        return "";
+        normalized = "";
+    } else if (typeof value === "object") {
+        // NOTE: Coerce object/array payloads to JSON; persisted settings are always strings.
+        normalized = JSON.stringify(value);
+    } else {
+        normalized = String(value);
+    }
+    return shouldTrimSetting(setting) ? normalized.trim() : normalized;
+}
+
+/**
+ * Load persisted setting types for payload entries that do not include type metadata.
+ *
+ * @param {Object} Setting setting model
+ * @param {Object[]} settings setting entries
+ * @param {Object} [options] additional options
+ * @returns {Promise<Map<string, string>>}
+ */
+async function getSettingTypeByKey(Setting, settings, options = {}) {
+    const keys = [...new Set(settings
+        .filter((setting) => setting && typeof setting.key === "string" && !setting.type)
+        .map((setting) => setting.key))];
+    if (!keys.length) {
+        return new Map();
     }
-    if (typeof value === "object") {
-        return JSON.stringify(value);
+    if (!Setting || typeof Setting.findAll !== "function") {
+        throw new TypeError("getSettingTypeByKey requires a Setting model with findAll.");
     }
-    return String(value);
+
+    const rows = await Setting.findAll({
+        where: { key: keys },
+        attributes: ["key", "type"],
+        raw: true,
+        transaction: options.transaction,
+    });
+    return new Map(rows.map((row) => [row.key, row.type]));
 }
 
 /**
@@ -96,11 +141,16 @@ async function saveSettings(Setting, settings, options = {}) {
         await validateEmailTemplateSettings(options.models, list, options);
     }
     const touchesMailService = payloadTouchesMailService(list);
+    const settingTypeByKey = await getSettingTypeByKey(Setting, list, options);
     for (const setting of list) {
         if (!setting || typeof setting.key !== "string" || setting.key.trim() === "") {
             continue;
         }
-        await Setting.set(setting.key, normalizeSettingValue(setting.value), {
+        const settingWithType = setting.type ? setting : {
+            ...setting,
+            type: settingTypeByKey.get(setting.key),
+        };
+        await Setting.set(setting.key, normalizeSettingValue(setting.value, settingWithType), {
             transaction: options.transaction,
         });
     }
@@ -108,7 +158,9 @@ async function saveSettings(Setting, settings, options = {}) {
 }
 
 module.exports = {
+    getSettingTypeByKey,
     payloadTouchesMailService,
     normalizeSettingValue,
     saveSettings,
+    shouldTrimSetting,
 };
diff --git a/docs/source/for_researchers/moodle_usage.rst b/docs/source/for_researchers/moodle_usage.rst
index 1bdb4384b..c90c18335 100644
--- a/docs/source/for_researchers/moodle_usage.rst
+++ b/docs/source/for_researchers/moodle_usage.rst
@@ -77,7 +77,9 @@ Before using this feature, make sure Moodle API access is configured as describe
 User data can be imported from Moodle using the course ID:
 
 1. In the Dashboard navigate to ``Users > Import via Moodle``
-2. CARE will match users by email address
+2. After CARE retrieves the Moodle users, review the role mapping step
+3. Map each Moodle role label to the corresponding CARE role, or choose ``Do not assign additional role`` if the role should not grant additional CARE permissions
+4. CARE will match users by email address
 
 CARE handles three scenarios:
 
@@ -85,6 +87,10 @@ CARE handles three scenarios:
 - Duplicate users are merged based on email match
 - Conflicts (e.g., mismatched emails) require manual correction
 
+Moodle role labels can vary by Moodle instance and may include multilingual markup such as ``{mlang de}Lehrende{mlang}{mlang other}Lecturer{mlang}``. CARE hides this markup in the mapping step while keeping the original Moodle role string for the import.
+
+CSV user import also includes a role mapping step. CARE reads the distinct values from the CSV ``roles`` column and asks you to map each value to a CARE role before previewing the import. Multiple roles in one CSV cell should be separated by commas.
+
 .. warning::
 
    Never delete a user with an ``extId`` unless you are certain it won't be needed. This could prevent future updates or synchronization.
diff --git a/frontend/src/components/dashboard/Settings.vue b/frontend/src/components/dashboard/Settings.vue
index 48932b91d..3ca201afe 100644
--- a/frontend/src/components/dashboard/Settings.vue
+++ b/frontend/src/components/dashboard/Settings.vue
@@ -356,15 +356,12 @@ export default {
     save() {
       this.$socket.emit("settingSave", this.settings, (res) => {
         if (res.success) {
-          this.settings.forEach((s) => {
-            this.$store.commit("settings/set", { key: s.key, value: s.value });
-          });
           this.eventBus.emit("toast", {
             title: "Success",
             message: res.data,
             variant: "success",
           });
-          this.setSettingsSnapshot();
+          this.load(false);
         } else {
           this.eventBus.emit("toast", {
             title: "Error Saving Settings",
diff --git a/frontend/src/components/dashboard/users/ImportModal.vue b/frontend/src/components/dashboard/users/ImportModal.vue
index 4d03cc82e..66ae567d7 100644
--- a/frontend/src/components/dashboard/users/ImportModal.vue
+++ b/frontend/src/components/dashboard/users/ImportModal.vue
@@ -10,10 +10,9 @@
     <template #title>
       <span>Bulk Import Users</span>
     </template>
-    <!-- Step1: Upload -->
-    <template #step-1>
+    <template #step="{ step }">
       <div class="file-upload-container">
-        <template v-if="importType === 'csv'">
+        <template v-if="step.key === 'source' && importType === 'csv'">
           <div
             class="drag-drop-area"
             @dragover.prevent
@@ -78,17 +77,26 @@
             </div>
           </template>
         </template>
-        <template v-else>
+        <template v-else-if="step.key === 'source'">
           <MoodleOptions
             ref="moodleOptionsForm"
             v-model="moodleOptions"
           />
         </template>
       </div>
-    </template>
-    <!-- Step2: Preview -->
-    <template #step-2>
-      <div class="preview-table-container">
+
+      <RoleMappingStep
+        v-if="step.key === 'roleMapping'"
+        v-model="roleMappings"
+        :users="users"
+        :system-roles="systemRoles"
+        :source-label="importSourceLabel"
+      />
+
+      <div
+        v-if="step.key === 'preview'"
+        class="preview-table-container"
+      >
         <BasicTable
           v-model="selectedUsers"
           :columns="columns"
@@ -97,10 +105,11 @@
           :max-table-height="400"
         />
       </div>
-    </template>
-    <!-- Step3: Confirm -->
-    <template #step-3>
-      <div class="confirm-container">
+
+      <div
+        v-if="step.key === 'confirm'"
+        class="confirm-container"
+      >
         <BasicIcon
           icon-name="person-fill-up"
           size="64"
@@ -110,12 +119,18 @@
           and overwrite <strong>{{ userCount.duplicate }}</strong> users?
         </p>
       </div>
-    </template>
-    <!-- Step3: Result -->
-    <template #step-4>
-      <div class="result-container">
-        <div v-if="updatedUserCount">
-          Successfully created <strong>{{ updatedUserCount.new }}</strong> users and overwrote <strong>{{ updatedUserCount.updated }}</strong> users
+
+      <div
+        v-if="step.key === 'result'"
+        class="result-container"
+      >
+        <div
+          v-if="updatedUserCount"
+          class="result-status"
+        >
+          <p class="result-summary">
+            Successfully created <strong>{{ updatedUserCount.new }}</strong> users and overwrote <strong>{{ updatedUserCount.updated }}</strong> users
+          </p>
           <div
             v-if="createdErrors.length > 0"
             class="error-container"
@@ -129,6 +144,17 @@
             </ul>
           </div>
         </div>
+        <div
+          v-if="importType === 'moodle'"
+          class="moodle-publish-intro"
+        >
+          <h3>Send login credentials to Moodle</h3>
+          <p>
+            CARE generated usernames and initial passwords for the imported users.
+            Select the Moodle assignment where these credentials should be posted as feedback,
+            or download them as a CSV file.
+          </p>
+        </div>
         <MoodleOptions
           v-if="importType === 'moodle'"
           ref="moodleOptionsForm"
@@ -139,12 +165,12 @@
           <BasicButton
             v-if="importType === 'moodle'"
             class="btn btn-outline-info"
-            title="Upload to Moodle"
+            title="Send to Moodle"
             @click="uploadToMoodle"
           />
           <BasicButton
             class="btn btn-outline-primary"
-            title="Download Result CSV"
+            title="Download CSV"
             @click="downloadFileAsCSV"
           />
         </div>
@@ -161,6 +187,8 @@ import BasicTable from "@/basic/Table.vue";
 import Papa from "papaparse";
 import { downloadObjectsAs } from "@/assets/utils.js";
 import MoodleOptions from "@/basic/form/MoodleOptions.vue";
+import RoleMappingStep from "@/components/dashboard/users/RoleMappingStep.vue";
+import { buildInitialRoleMappings, formatRoleList, getRoleRows, normalizeImportUsers } from "@/components/dashboard/users/roleMapping.js";
 
 /**
  * Modal for bulk creating users through csv file and Moodle API
@@ -168,7 +196,8 @@ import MoodleOptions from "@/basic/form/MoodleOptions.vue";
  */
 export default {
   name: "ImportModal",
-  components: { MoodleOptions, StepperModal, BasicButton, BasicIcon, BasicTable },
+  components: { RoleMappingStep, MoodleOptions, StepperModal, BasicButton, BasicIcon, BasicTable },
+  emits: ["updateUser"],
   data() {
     return {
       importType: "csv",
@@ -208,14 +237,29 @@ export default {
         { name: "First Name", key: "firstName" },
         { name: "Last Name", key: "lastName" },
         { name: "Email", key: "email" },
-        { name: "Roles", key: "roles" },
+        { name: "Roles", key: "displayRoles" },
       ],
       updatedUserCount: null,
       createdUsers: [],
       createdErrors: [],
+      roleMappings: {},
     };
   },
   computed: {
+    systemRoles() {
+      return this.$store.getters["admin/getSystemRoles"] || [];
+    },
+    importSourceLabel() {
+      return this.importType === "csv" ? "CSV" : "Moodle";
+    },
+    roleRows() {
+      return getRoleRows(this.users);
+    },
+    careRoleMap() {
+      return Object.fromEntries(
+        Object.entries(this.roleMappings).filter(([, careRole]) => careRole)
+      );
+    },
     userCount() {
       return {
         new: this.selectedUsers.filter((u) => !u.exists).length,
@@ -223,21 +267,29 @@ export default {
       };
     },
     steps() {
-      return [this.importType === "csv" ? { title: "Upload" } : { title: "Moodle" }, { title: "Preview" }, { title: "Confirm" }, { title: "Result" }];
+      const sourceStep = this.importType === "csv" ? { key: "source", title: "Upload" } : { key: "source", title: "Moodle" };
+      const commonSteps = [
+        { key: "preview", title: "Preview" },
+        { key: "confirm", title: "Confirm" },
+        { key: "result", title: "Result" },
+      ];
+      return [sourceStep, { key: "roleMapping", title: "Role Mapping" }, ...commonSteps];
     },
     stepValid() {
-      let validStates = [];
-      if (this.importType === "csv") {
-        validStates.push(this.file.name !== "" || this.file.errors.length < 1);
-      } else {
-        const { courseID, apiUrl, apiKey } = this.moodleOptions;
-        validStates.push(courseID && apiUrl && apiKey);
-      }
-      validStates = [...validStates, this.selectedUsers.length > 0, true, true];
-      return validStates;
+      const sourceIsValid = this.importType === "csv"
+        ? this.file.name !== "" && this.file.errors.length < 1
+        : this.hasRequiredMoodleOptions(this.moodleOptions);
+      const hasRoleMappings = this.roleRows.every((role) => Object.prototype.hasOwnProperty.call(this.roleMappings, role.raw));
+      return [sourceIsValid, hasRoleMappings, this.selectedUsers.length > 0, true, true];
     },
   },
   methods: {
+    hasRequiredMoodleOptions({ courseID, apiUrl, apiKey } = {}) {
+      return [courseID, apiUrl, apiKey].every((value) => String(value ?? "").trim() !== "");
+    },
+    initializeRoleMappings() {
+      this.roleMappings = buildInitialRoleMappings(this.users, this.roleMappings);
+    },
     downloadFileAsCSV() {
       const filename = `users_${Date.now()}`;
       const users = this.createdUsers.map((user) => ({
@@ -246,7 +298,7 @@ export default {
         lastName: user.lastName,
         userName: user.userName,
         email: user.email,
-        roles: user.roles,
+        roles: formatRoleList(user.roles),
         password: user.initialPassword || "",
       }));
       downloadObjectsAs(users, filename, "csv");
@@ -259,7 +311,7 @@ export default {
           firstName: "Test",
           lastName: "User",
           email: "test.user@example.com",
-          roles: "Student*in",
+          roles: "student",
         },
       ];
       downloadObjectsAs(users, filename, "csv");
@@ -296,6 +348,7 @@ export default {
       };
       this.users = [];
       this.selectedUsers = [];
+      this.roleMappings = {};
       if (this.updatedUserCount) {
         this.updatedUserCount = null;
         this.createdUsers = [];
@@ -306,26 +359,41 @@ export default {
       }
     },
     handleStepChange(step) {
-      switch (step) {
-        case 1:
-          this.$refs.importStepper?.setWaiting(true);
-          this.prepareUserImport();
+      const stepKey = this.steps[step]?.key;
+      switch (stepKey) {
+        case "roleMapping":
+          if (this.importType === "moodle") {
+            this.prepareUserImport();
+          } else {
+            this.initializeRoleMappings();
+            this.$refs.importStepper?.setWaiting(false);
+          }
+          break;
+        case "preview":
+          if (this.importType === "csv") {
+            this.prepareUserImport();
+          } else {
+            this.$refs.importStepper?.setWaiting(false);
+          }
           break;
-        case 2:
+        case "confirm":
           this.$refs.importStepper?.setWaiting(false);
           break;
-        case 3:
+        case "result":
           this.executeUserImport();
           break;
       }
     },
     prepareUserImport() {
       if (this.importType === "moodle") {
-        if (!this.$refs.moodleOptionsForm?.validate()) return;
+        if (!this.hasRequiredMoodleOptions(this.moodleOptions) || (this.$refs.moodleOptionsForm && !this.$refs.moodleOptionsForm.validate())) return;
+        this.$refs.importStepper?.setWaiting(true);
         this.$socket.emit("userMoodleUserGetAll", this.moodleOptions, (res) => {
           this.$refs.importStepper?.setWaiting(false);
           if (res.success) {
-            this.users = res["data"];
+            this.users = normalizeImportUsers(res["data"]);
+            this.selectedUsers = [];
+            this.initializeRoleMappings();
           } else {
             this.eventBus.emit("toast", {
               title: "Failed to get users from Moodle",
@@ -336,19 +404,14 @@ export default {
           }
         });
       } else {
+        this.$refs.importStepper?.setWaiting(true);
         this.checkDuplicateUsers();
       }
     },
     executeUserImport() {
       const userData = {
         users: this.selectedUsers,
-        // Moodle's role names are subject to change
-        moodleCareRoleMap: {
-          "Dozent*in": "teacher",
-          "Betreuer*in": "teacher",
-          "Tutor*in": "mentor",
-          "Student*in": "student",
-        },
+        roleMap: this.careRoleMap,
         progressId: this.$refs.importStepper.getProgressId(),
       };
       this.$refs.importStepper.startProgress();
@@ -419,11 +482,6 @@ export default {
                 seenEmails.add(row.email);
               }
 
-              // Check if the values of the roles column are separated by comma
-              if (row.roles && !row.roles.includes(",") && row.roles.includes(" ")) {
-                errors.push(`Roles not comma-separated for id ${row.id} at index ${index + 1}`);
-              }
-
               // Check if the email is in a valid format
               if (!emailRegex.test(row.email)) {
                 errors.push(`Invalid email format for id ${row.id} at index ${index + 1}: ${row.email}`);
@@ -445,8 +503,10 @@ export default {
     async processFile(file) {
       if (file && file.name.endsWith(".csv")) {
         try {
-          const parsingResults = await this.validateCSV(file);
+          const parsingResults = normalizeImportUsers(await this.validateCSV(file));
           this.users = parsingResults;
+          this.selectedUsers = [];
+          this.roleMappings = buildInitialRoleMappings(parsingResults, this.roleMappings);
           this.file = {
             state: 1,
             name: file.name,
@@ -473,14 +533,19 @@ export default {
         state: 0,
         name: "",
         size: 0,
+        errors: [],
       };
+      this.users = [];
+      this.selectedUsers = [];
+      this.roleMappings = {};
       this.$refs.fileInput.value = "";
     },
     checkDuplicateUsers() {
+      this.selectedUsers = [];
       this.$socket.emit("userCheckExistsByMail", this.users, (res) => {
         this.$refs.importStepper?.setWaiting(false);
         if (res.success) {
-          this.users = res.data;
+          this.users = normalizeImportUsers(res.data);
         } else {
           this.eventBus.emit("toast", {
             title: "Failed to check duplicate users",
@@ -571,6 +636,39 @@ export default {
   }
 }
 
+.result-status {
+  width: 100%;
+  text-align: center;
+}
+
+.result-summary {
+  margin-bottom: 0;
+  font-size: 1.05rem;
+  font-weight: 600;
+}
+
+.moodle-publish-intro {
+  width: 100%;
+  max-width: 500px;
+  margin-top: 1.25rem;
+  margin-bottom: 0.75rem;
+  padding-top: 1rem;
+  border-top: 1px solid #dee2e6;
+  text-align: left;
+}
+
+.moodle-publish-intro h3 {
+  margin-bottom: 0.35rem;
+  font-size: 1rem;
+  font-weight: 600;
+}
+
+.moodle-publish-intro p {
+  margin-bottom: 0;
+  color: #555;
+  font-size: 0.925rem;
+}
+
 .error-container {
   margin: 0.25rem auto 0.5rem;
   color: firebrick;
diff --git a/frontend/src/components/dashboard/users/RoleMappingStep.vue b/frontend/src/components/dashboard/users/RoleMappingStep.vue
new file mode 100644
index 000000000..ff1bc1831
--- /dev/null
+++ b/frontend/src/components/dashboard/users/RoleMappingStep.vue
@@ -0,0 +1,95 @@
+<template>
+  <div class="role-mapping-container">
+    <table class="table table-sm align-middle">
+      <thead>
+        <tr><th>{{ sourceLabel }} Role</th><th>Users</th><th>CARE Role</th></tr>
+      </thead>
+      <tbody>
+        <tr v-for="role in roleRows" :key="role.raw">
+          <td>
+            {{ role.label }}
+          </td>
+          <td>{{ role.count }}</td>
+          <td>
+            <select
+              :value="mappedRoleValue(role.raw)"
+              class="form-select form-select-sm"
+              @change="updateRoleMapping(role.raw, $event.target.value)"
+            >
+              <option
+                value="__unmapped"
+                disabled
+              >
+                Select mapping
+              </option>
+              <option v-for="option in careRoleOptions" :key="option.value" :value="option.value">
+                {{ option.label }}
+              </option>
+            </select>
+          </td>
+        </tr>
+        <tr v-if="roleRows.length === 0">
+          <td colspan="3" class="text-center text-muted">
+            No roles were found. Imported users will receive CARE's basic user role.
+          </td>
+        </tr>
+      </tbody>
+    </table>
+  </div>
+</template>
+
+<script>
+import { getRoleRows } from "./roleMapping.js";
+
+/**
+ * Step for mapping external role labels to CARE roles during user import.
+ * @author: Linyin Huang
+ */
+export default {
+  name: "RoleMappingStep",
+  props: {
+    modelValue: {
+      type: Object,
+      required: true,
+    },
+    users: {
+      type: Array,
+      required: true,
+    },
+    systemRoles: {
+      type: Array,
+      required: true,
+    },
+    sourceLabel: {
+      type: String,
+      required: true,
+    },
+  },
+  emits: ["update:modelValue"],
+  computed: {
+    careRoleOptions() {
+      return [
+        ...this.systemRoles.filter((role) => !role.deleted && role.name !== "admin").map((role) => ({
+          value: role.name,
+          label: role.name.charAt(0).toUpperCase() + role.name.slice(1),
+        })),
+        { value: "", label: "Do not assign additional role" }
+      ];
+    },
+    roleRows() {
+      return getRoleRows(this.users);
+    },
+  },
+  methods: {
+    mappedRoleValue(role) {
+      return Object.prototype.hasOwnProperty.call(this.modelValue, role) ? this.modelValue[role] : "__unmapped";
+    },
+    updateRoleMapping(role, careRole) {
+      this.$emit("update:modelValue", {
+        ...this.modelValue,
+        [role]: careRole,
+      });
+    },
+  },
+};
+</script>
diff --git a/frontend/src/components/dashboard/users/roleMapping.js b/frontend/src/components/dashboard/users/roleMapping.js
new file mode 100644
index 000000000..2887966c2
--- /dev/null
+++ b/frontend/src/components/dashboard/users/roleMapping.js
@@ -0,0 +1,100 @@
+/**
+ * Splits a comma-separated role list from an external import source.
+ *
+ * @param {string|undefined|null} roles Raw role list, with individual roles separated by commas.
+ * @returns {string[]} Trimmed role names, excluding empty entries.
+ */
+export function splitExternalRoles(roles) {
+  return roles ? roles.split(",").map((role) => role.trim()).filter(Boolean) : [];
+}
+
+/**
+ * Formats one external role string for display.
+ *
+ * Moodle role labels may contain multilingual markup such as
+ * "{mlang de}Lehrende{mlang}{mlang other}Lecturer{mlang}". The raw role string
+ * is kept elsewhere for exact mapping; this function only prepares a readable label.
+ *
+ * @param {string} role Raw external role string.
+ * @returns {string} Human-readable role label.
+ */
+export function formatExternalRole(role) {
+  const matches = [...role.matchAll(/\{mlang\s+[^}]+}([^{}]*)\{mlang}/gi)]
+    .map((match) => match[1].trim())
+    .filter(Boolean);
+  if (matches.length > 0) {
+    return [...new Set(matches)].join(" / ");
+  }
+  return role.replace(/\{[^}]*}/g, "").replace(/\s+/g, " ").trim() || role;
+}
+
+/**
+ * Builds the rows shown in the role mapping step.
+ *
+ * Rows are grouped by raw role string so different external roles are not merged
+ * just because their formatted display labels look the same.
+ *
+ * @param {Object[]} users Imported users.
+ * @param {string} users[].roles Raw comma-separated role list for one user.
+ * @returns {{raw: string, count: number, label: string}[]} Role rows sorted by display label.
+ */
+export function getRoleRows(users) {
+  const roles = new Map();
+  users.forEach((user) => {
+    splitExternalRoles(user.roles).forEach((role) => {
+      roles.set(role, (roles.get(role) || 0) + 1);
+    });
+  });
+  return Array.from(roles, ([raw, count]) => ({
+    raw,
+    count,
+    label: formatExternalRole(raw),
+  })).sort((a, b) => a.label.localeCompare(b.label));
+}
+
+/**
+ * Formats a comma-separated role list for display in the import preview.
+ *
+ * @param {string|undefined|null} roles Raw comma-separated role list.
+ * @returns {string} Readable comma-separated role list.
+ */
+export function formatRoleList(roles) {
+  return splitExternalRoles(roles).map(formatExternalRole).join(", ");
+}
+
+/**
+ * Adds display-only role labels to imported users.
+ *
+ * The original `roles` value is intentionally preserved because it is used as
+ * the key for role mapping and backend import. `displayRoles` is only for UI.
+ *
+ * @param {Object[]} users Imported users from CSV or Moodle.
+ * @param {string} users[].roles Raw comma-separated role list for one user.
+ * @returns {Object[]} New user objects with an added `displayRoles` field.
+ */
+export function normalizeImportUsers(users) {
+  return users.map((user) => ({
+    ...user,
+    displayRoles: formatRoleList(user.roles),
+  }));
+}
+
+/**
+ * Keeps explicit role mapping choices that still apply to the current import.
+ *
+ * Missing mappings are intentionally not guessed. The role mapping step should
+ * force users to choose a CARE role or explicitly choose no additional role.
+ *
+ * @param {Object[]} users Imported users.
+ * @param {string} users[].roles Raw comma-separated role list for one user.
+ * @param {Object<string, string>} [currentMappings={}] Existing raw-role to CARE-role selections.
+ * @returns {Object<string, string>} Mapping entries that still match roles in the current import.
+ */
+export function buildInitialRoleMappings(users, currentMappings = {}) {
+  return getRoleRows(users).reduce((mappings, role) => {
+    if (Object.prototype.hasOwnProperty.call(currentMappings, role.raw)) {
+      mappings[role.raw] = currentMappings[role.raw];
+    }
+    return mappings;
+  }, {});
+}