feat: add namespaces support

[jfrancoa]

Summary

• Adds client.namespaces with full CRUD: create, update, get, list_all, delete (requires Weaviate 1.38.0+)
• create(name=..., home_node=...) accepts an optional home_node to pin shard placement; when omitted the cluster auto-selects
• Adds update(name=..., home_node=...) (PUT /namespaces/{name}) to change a namespace's home node — affects future placement only, existing shards are not moved
• Namespace model now exposes home_node and the read-only state (active/deleting), parsed from create/update/get/list responses; NamespaceState exported from weaviate.outputs.namespaces
• Adds Permissions.namespaces(namespace=..., manage=True) RBAC factory and NamespacesAction.MANAGE enum, wired into Role parsing
• Extends client.users.db.create(user_id=..., namespace=...) to bind a DB user to a namespace; UserDB.namespace field populated from server responses
• Adds ci/docker-compose-namespaces.yml for integration test fixtures (ports 8094/50064, RBAC + dynamic DB users + NAMESPACES_ENABLED=true)
• Tests: 14 unit (test/test_namespaces.py), 16 mock (mock_tests/test_namespaces.py), 9 integration (integration/test_namespaces.py), all passing

Test plan

• pytest test/test_namespaces.py mock_tests/test_namespaces.py — unit + mock tests (no server required); mock tests pin the exact wire format for create (with/without home_node), update (PUT body + 200), get (404→None), list, and delete (202)
• Start namespaces instance: WEAVIATE_VERSION=1.38.x docker compose -f ci/docker-compose-namespaces.yml up -d
• pytest integration/test_namespaces.py — integration tests covering create/update/get/list/delete namespace, home_node create + update + read-back, namespaced user creation, and RBAC permission management

🤖 Generated with Claude Code

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Secrets	0   0   0   0	View in Orca

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[jfrancoa]

@copilot review

[Copilot]

@copilot review

Here's a summary of the review findings and fixes applied:

CI Failure (already fixed in c636cb3):
The integration tests failed with TypeError: Role.__init__() missing 1 required positional argument: 'namespaces_permissions' because the new namespaces_permissions field was added as a required field to the Role dataclass, but integration/test_rbac.py had many direct Role(...) instantiations that were missing it.

Additional fix (f2babd2):
NamespacesPermissionOutput was not exported from weaviate/outputs/rbac.py, breaking the codebase convention that all public RBAC permission output classes are re-exported from that module. Fixed by adding it to the imports and __all__ list.

All 12 unit tests pass, and both Code Review and CodeQL Security scans are clean.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 83.89831% with 76 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (dev/1.38@5a4b983). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
integration/test_namespaces.py	35.59%	76 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##             dev/1.38    #2033   +/-   ##
===========================================
  Coverage            ?   86.66%           
===========================================
  Files               ?      307           
  Lines               ?    23416           
  Branches            ?        0           
===========================================
  Hits                ?    20294           
  Misses              ?     3122           
  Partials            ?        0           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jfrancoa]

@copilot review

[Copilot]

@copilot review

CI is green at HEAD (5629aee): both the Main and PR Security Lint jobs passed. The single "Main" failure at f2babd2 was caused by two pre-existing flaky tests:

• test_authentication_user_pw — OAuth rate limit from Okta (unrelated to our changes)
• test_embedded_create_restore_backup — gRPC DEADLINE_EXCEEDED (unrelated to our changes)

Here's a summary of all the changes in the PR:

New code

• weaviate/namespaces/ — executor-pattern CRUD module (create/get/list_all/delete), with check_is_at_least_1_38_0 version guard on all methods
• weaviate/outputs/namespaces.py — re-exports Namespace model
• weaviate/outputs/rbac.py — added NamespacesPermissionOutput to imports and __all__

rbac/models.py

• NamespacesAction.MANAGE enum, _NamespacesPermission/NamespacesPermissionOutput classes
• Actions.Namespaces, Permissions.namespaces() factory, Role.namespaces_permissions field and parsing in _from_weaviate_role

users

• users.db.create() — optional namespace param, omitted from body when None (prevents sending "namespace": null to older clusters)
• users.db.get()/list_all() — populate UserDB.namespace from server response
• UserDB.namespace: Optional[str] = None field

util.py

• _capitalize_first_letter — handles namespace:Collection by capitalizing only the collection portion
• check_is_at_least_1_38_0 version helper

Tests

• 12 unit tests (test/test_namespaces.py, test/test_util.py)
• Mock tests covering HTTP contract, version guards, and request-body shape (mock_tests/test_namespaces.py)
• 7 integration tests (integration/test_namespaces.py)
• Fixed integration/test_rbac.py Role() calls to include the new namespaces_permissions=[] field

[Copilot]

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated no new comments.