feat: add namespaces support

ci/compose.sh

@@ -21,7 +21,7 @@ function compose_down_all {
 }
 
 function all_weaviate_ports {
-  echo "8090 8093 8087 8088 8089 8086 8082 8083 8075 8092 8085 8080" # in alphabetic order of appearance in docker-compose files
+  echo "8090 8093 8087 8088 8089 8086 8082 8083 8075 8092 8094 8085 8080" # in alphabetic order of appearance in docker-compose files
 }
 
 function wait(){

ci/docker-compose-namespaces.yml

@@ -0,0 +1,40 @@
+---
+version: '3.4'
+services:
+  weaviate-namespaces:
+    command:
+      - --host
+      - 0.0.0.0
+      - --port
+      - '8085'
+      - --scheme
+      - http
+      - --write-timeout=600s
+    image: semitechnologies/weaviate:${WEAVIATE_VERSION}
+    ports:
+      - 8094:8085
+      - 50064:50051
+    restart: on-failure:0
+    environment:
+      # Namespaces feature — requires GraphQL disabled
+      NAMESPACES_ENABLED: "true"
+      DISABLE_GRAPHQL: "true"
+      # Static API key auth (operator-level access)
+      AUTHENTICATION_APIKEY_ENABLED: "true"
+      AUTHENTICATION_APIKEY_ALLOWED_KEYS: "admin-key,custom-key"
+      AUTHENTICATION_APIKEY_USERS: "admin-user,custom-user"
+      # Anonymous access must be off when RBAC is on
+      AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED: "false"
+      # RBAC — required for namespace-scoped permission checks
+      AUTHORIZATION_ENABLE_RBAC: "true"
+      AUTHORIZATION_ADMIN_USERS: "admin-user"
+      # Dynamic DB users — needed to create namespaced users
+      AUTHENTICATION_DB_USERS_ENABLED: "true"
+      # Storage / cluster
+      PERSISTENCE_DATA_PATH: "./data-weaviate-0"
+      CLUSTER_IN_LOCALHOST: "true"
+      CLUSTER_GOSSIP_BIND_PORT: "7102"
+      CLUSTER_DATA_BIND_PORT: "7103"
+      RAFT_BOOTSTRAP_EXPECT: "1"
+      ENABLE_MODULES: ""
+...

integration/test_namespaces.py

@@ -0,0 +1,126 @@
+import pytest
+
+import weaviate
+from integration.conftest import ClientFactory
+from weaviate.auth import Auth
+from weaviate.namespaces.models import Namespace
+from weaviate.rbac.models import Permissions
+
+NS_PORTS = (8094, 50064)
+ADMIN_KEY = Auth.api_key("admin-key")
+
+_MINIMUM_VERSION = (1, 38, 0)
+
+
+def _skip_if_unsupported(client: weaviate.WeaviateClient) -> None:
+    major, minor, patch = _MINIMUM_VERSION
+    if client._connection._weaviate_version.is_lower_than(major, minor, patch):
+        pytest.skip(f"Namespaces require Weaviate {major}.{minor}.{patch}+")
+
+
+def test_create_and_get_namespace(client_factory: ClientFactory) -> None:
+    with client_factory(ports=NS_PORTS, auth_credentials=ADMIN_KEY) as client:
+        _skip_if_unsupported(client)
+
+        client.namespaces.create(name="testns")
+        try:
+            ns = client.namespaces.get(name="testns")
+            assert ns is not None
+            assert isinstance(ns, Namespace)
+            assert ns.name == "testns"
+        finally:
+            client.namespaces.delete(name="testns")
+
+
+def test_get_nonexistent_namespace_returns_none(client_factory: ClientFactory) -> None:
+    with client_factory(ports=NS_PORTS, auth_credentials=ADMIN_KEY) as client:
+        _skip_if_unsupported(client)
+
+        result = client.namespaces.get(name="doesnotexist")
+        assert result is None
+
+
+def test_list_namespaces(client_factory: ClientFactory) -> None:
+    with client_factory(ports=NS_PORTS, auth_credentials=ADMIN_KEY) as client:
+        _skip_if_unsupported(client)
+
+        client.namespaces.create(name="listns1")
+        client.namespaces.create(name="listns2")
+        try:
+            namespaces = client.namespaces.list_all()
+            names = [ns.name for ns in namespaces]
+            assert "listns1" in names
+            assert "listns2" in names
+        finally:
+            client.namespaces.delete(name="listns1")
+            client.namespaces.delete(name="listns2")
+
+
+def test_delete_namespace(client_factory: ClientFactory) -> None:
+    with client_factory(ports=NS_PORTS, auth_credentials=ADMIN_KEY) as client:
+        _skip_if_unsupported(client)
+
+        client.namespaces.create(name="deletens")
+        client.namespaces.delete(name="deletens")
+
+        fetched = client.namespaces.get(name="deletens")
+        assert fetched is None
+
+
+def test_create_namespaced_user(client_factory: ClientFactory) -> None:
+    with client_factory(ports=NS_PORTS, auth_credentials=ADMIN_KEY) as client:
+        _skip_if_unsupported(client)
+
+        client.namespaces.create(name="usernstest")
+        # On namespace-enabled clusters the server qualifies the userId as
+        # "namespace:user_id" in storage. Operators must use that qualified form
+        # when calling get/delete.
+        qualified_id = "usernstest:nsuser1"
+        try:
+            api_key = client.users.db.create(user_id="nsuser1", namespace="usernstest")
+            assert isinstance(api_key, str)
+            assert len(api_key) > 0
+
+            user = client.users.db.get(user_id=qualified_id)
+            assert user is not None
+            assert user.user_id == qualified_id
+            assert user.namespace == "usernstest"
+        finally:
+            client.users.db.delete(user_id=qualified_id)
+            client.namespaces.delete(name="usernstest")
+
+
+def test_namespace_permission_manage(client_factory: ClientFactory) -> None:
+    with client_factory(ports=NS_PORTS, auth_credentials=ADMIN_KEY) as client:
+        _skip_if_unsupported(client)
+
+        client.roles.create(
+            role_name="ns-manager",
+            permissions=Permissions.namespaces(namespace="*", manage=True),
+        )
+        try:
+            fetched = client.roles.get(role_name="ns-manager")
+            assert fetched is not None
+            assert any(p.namespace == "*" for p in fetched.namespaces_permissions)
+        finally:
+            client.roles.delete("ns-manager")
+
+
+def test_namespace_permission_multiple_namespaces(
+    client_factory: ClientFactory,
+) -> None:
+    with client_factory(ports=NS_PORTS, auth_credentials=ADMIN_KEY) as client:
+        _skip_if_unsupported(client)
+
+        client.roles.create(
+            role_name="ns-multi",
+            permissions=Permissions.namespaces(namespace=["ns1", "ns2"], manage=True),
+        )
+        try:
+            fetched = client.roles.get(role_name="ns-multi")
+            assert fetched is not None
+            ns_names = {p.namespace for p in fetched.namespaces_permissions}
+            assert "ns1" in ns_names
+            assert "ns2" in ns_names
+        finally:
+            client.roles.delete("ns-multi")

integration/test_rbac.py

@@ -50,6 +50,7 @@
                 tenants_permissions=[],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             None,
         ),
@@ -69,6 +70,7 @@
                 tenants_permissions=[],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             None,
         ),
@@ -92,6 +94,7 @@
                 tenants_permissions=[],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             None,
         ),
@@ -113,6 +116,7 @@
                 tenants_permissions=[],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             None,
         ),
@@ -147,6 +151,7 @@
                 tenants_permissions=[],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             None,
         ),
@@ -170,6 +175,7 @@
                 tenants_permissions=[],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             None,
         ),
@@ -193,6 +199,7 @@
                 tenants_permissions=[],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             None,
         ),
@@ -216,6 +223,7 @@
                 tenants_permissions=[],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             None,
         ),
@@ -241,6 +249,7 @@
                 ],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             None,
         ),
@@ -283,6 +292,7 @@
                 ],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             None,
         ),
@@ -306,6 +316,7 @@
                 tenants_permissions=[],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             None,
         ),
@@ -348,6 +359,7 @@
                     ),
                 ],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             32,
         ),
@@ -373,6 +385,7 @@
                 tenants_permissions=[],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             32,  # Minimum version for alias permissions
         ),
@@ -398,6 +411,7 @@
                 tenants_permissions=[],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             32,  # Minimum version for alias permissions
         ),
@@ -423,6 +437,7 @@
                 tenants_permissions=[],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             32,  # Minimum version for alias permissions
         ),
@@ -446,6 +461,7 @@
                 tenants_permissions=[],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             37,  # Minimum version for MCP permissions
         ),
@@ -465,6 +481,7 @@
                 tenants_permissions=[],
                 replicate_permissions=[],
                 groups_permissions=[],
+                namespaces_permissions=[],
             ),
             37,  # Minimum version for MCP permissions
         ),
@@ -490,6 +507,7 @@
                         actions={Actions.Groups.READ},
                     )
                 ],
+                namespaces_permissions=[],
             ),
             32,  # Minimum version for group permissions
         ),