feat: create db users via namespace-qualified id, drop namespace arg

The server no longer accepts a separate `namespace` field when creating a DB
user; the namespace is now derived from a namespace-qualified id of the form
"<namespace>:<user>" passed in the URL path (weaviate PR #11501,
resolveUserKeyForCreate). Update the client to match:

- users.db.create: remove the `namespace` parameter; always POST an empty body.
  The (optionally qualified) id is already carried in the path. Drop the
  now-unused 1.38 version guard tied to the namespace field.
- sync/async .pyi stubs: update the create signature accordingly.
- UserDB.namespace and get/list parsing are unchanged: the server still returns
  `namespace` in the user response for global operators (handlers_db_users.go).

Tests:
- mock_tests: replace the namespace-in-body tests with
  test_users_db_create_qualified_user_id_goes_in_path (asserts the qualified id
  lands in the URL path and the body stays empty) and
  test_users_db_create_posts_empty_body. These pin the wire contract and are the
  version-independent regression guard.
- integration: create the namespaced user with the qualified id directly.
- Bump WEAVIATE_138 to 1.38.0-rc.0-b9ea106, the first build containing PR #11501.

Verified: mock + unit suites pass (34); 8/9 namespace integration tests pass
against a live cluster. The qualified-create integration test requires the
b9ea106 image, which was still publishing to Docker Hub at commit time; the
server source at b9ea106 is git-verified to implement this contract and CI runs
the live check.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: jfrancoa

.github/workflows/main.yaml

@@ -29,7 +29,7 @@ env:
   WEAVIATE_135: 1.35.18
   WEAVIATE_136: 1.36.12
   WEAVIATE_137: 1.37.5-e0fe0d5.amd64
-  WEAVIATE_138: 1.38.0-rc.0
+  WEAVIATE_138: 1.38.0-rc.0-b9ea106
 
 jobs:
   lint-and-format:

integration/test_namespaces.py

@@ -126,12 +126,12 @@ def test_create_namespaced_user(client_factory: ClientFactory) -> None:
         _skip_if_unsupported(client)
 
         client.namespaces.create(name="usernstest")
-        # On namespace-enabled clusters the server qualifies the userId as
-        # "namespace:user_id" in storage. Operators must use that qualified form
-        # when calling get/delete.
+        # On namespace-enabled clusters an operator creates a user with a
+        # namespace-qualified id "<namespace>:<user>"; the same qualified id is
+        # used for get/delete.
         qualified_id = "usernstest:nsuser1"
         try:
-            api_key = client.users.db.create(user_id="nsuser1", namespace="usernstest")
+            api_key = client.users.db.create(user_id=qualified_id)
             assert isinstance(api_key, str)
             assert len(api_key) > 0
 

mock_tests/test_namespaces.py

@@ -354,14 +354,14 @@ def test_namespaces_methods_require_1_38(
 # ---------------------------------------------------------------------------
 
 
-def test_users_db_create_includes_namespace_in_body(
+def test_users_db_create_qualified_user_id_goes_in_path(
     ns_client: Tuple[weaviate.WeaviateClient, HTTPServer],
 ) -> None:
-    """When ``namespace`` is provided, the request body must carry it.
+    """A namespace-qualified user id must be sent in the URL path, not the body.
 
-    Without this assertion, dropping ``body['namespace'] = namespace`` from
-    ``users/base.py`` would compile and pass type-checks but silently break
-    namespace-binding on multi-tenant clusters.
+    The server derives the namespace from the ``"<namespace>:<user>"`` id in the
+    path, so the request body stays empty. This guards against reintroducing a
+    ``body['namespace']`` field, which the server no longer accepts.
     """
     client, server = ns_client
     captured: Dict[str, Any] = {}
@@ -370,22 +370,24 @@ def handler(request: Request) -> Response:
         captured["body"] = json.loads(request.get_data(as_text=True) or "{}")
         return Response(json.dumps({"apikey": "secret-key"}), status=201)
 
-    server.expect_request("/v1/users/db/alice", method="POST").respond_with_handler(handler)
+    server.expect_request("/v1/users/db/customer1:alice", method="POST").respond_with_handler(
+        handler
+    )
 
-    api_key = client.users.db.create(user_id="alice", namespace="customer1")
+    api_key = client.users.db.create(user_id="customer1:alice")
 
     assert api_key == "secret-key"
-    assert captured["body"] == {"namespace": "customer1"}
+    assert captured["body"] == {}
     server.check_assertions()
 
 
-def test_users_db_create_omits_namespace_when_not_provided(
+def test_users_db_create_posts_empty_body(
     ns_client: Tuple[weaviate.WeaviateClient, HTTPServer],
 ) -> None:
-    """The ``namespace`` key must not appear in the body when omitted by the caller.
+    """``create`` must POST an empty body — there is no separate ``namespace`` field.
 
-    Otherwise we'd send ``"namespace": null`` and break older clusters that
-    don't recognize the field.
+    Sending anything else (e.g. a stray ``namespace`` key) would diverge from the
+    server contract, which expects only the (possibly qualified) id in the path.
     """
     client, server = ns_client
     captured: Dict[str, Any] = {}

weaviate/users/async_.pyi

@@ -52,7 +52,7 @@ class _UsersDBAsync(_UsersDBExecutor[ConnectionAsync]):
     ) -> Union[Dict[str, Role], Dict[str, RoleBase]]: ...
     async def assign_roles(self, *, user_id: str, role_names: Union[str, List[str]]) -> None: ...
     async def revoke_roles(self, *, user_id: str, role_names: Union[str, List[str]]) -> None: ...
-    async def create(self, *, user_id: str, namespace: Optional[str] = None) -> str: ...
+    async def create(self, *, user_id: str) -> str: ...
     async def delete(self, *, user_id: str) -> bool: ...
     async def rotate_key(self, *, user_id: str) -> str: ...
     async def activate(self, *, user_id: str) -> bool: ...

weaviate/users/base.py

@@ -360,12 +360,12 @@ def revoke_roles(
             USER_TYPE_DB,
         )
 
-    def create(self, *, user_id: str, namespace: Optional[str] = None) -> executor.Result[str]:
+    def create(self, *, user_id: str) -> executor.Result[str]:
         """Create a new db user and return its API key.
 
         Args:
-            user_id: The id of the new user.
-            namespace: The namespace to bind the user to. Required on namespace-enabled clusters.
+            user_id: The id of the new user. On namespace-enabled clusters an operator must
+                pass a namespace-qualified id of the form ``"<namespace>:<user>"``.
 
         Returns:
             The API key of the newly created user. This key can not be retrieved later.
@@ -376,16 +376,11 @@ def resp(res: Response) -> str:
             assert resp is not None
             return str(resp["apikey"])
 
-        body: Dict[str, Any] = {}
-        if namespace is not None:
-            self._connection._weaviate_version.check_is_at_least_1_38_0("users.db.create")
-            body["namespace"] = namespace
-
         return executor.execute(
             response_callback=resp,
             method=self._connection.post,
             path=f"/users/db/{user_id}",
-            weaviate_object=body,
+            weaviate_object={},
             error_msg=f"Could not create user '{user_id}'",
             status_codes=_ExpectedStatusCodes(ok_in=[201], error="Create user"),
         )

weaviate/users/sync.pyi

@@ -52,7 +52,7 @@ class _UsersDB(_UsersDBExecutor[ConnectionSync]):
     ) -> Union[Dict[str, Role], Dict[str, RoleBase]]: ...
     def assign_roles(self, *, user_id: str, role_names: Union[str, List[str]]) -> None: ...
     def revoke_roles(self, *, user_id: str, role_names: Union[str, List[str]]) -> None: ...
-    def create(self, *, user_id: str, namespace: Optional[str] = None) -> str: ...
+    def create(self, *, user_id: str) -> str: ...
     def delete(self, *, user_id: str) -> bool: ...
     def rotate_key(self, *, user_id: str) -> str: ...
     def activate(self, *, user_id: str) -> bool: ...