feat: IHS-190 (part of IFC-2162) Add namespace restriction parameter to generic schemas

[polmichel]

To understand the global feature, see this PR: opsmill/infrahub#8319

This PR is about updating infrahub_sdk.schema.main.GenericSchemaAPI with the new generic schema parameter "restricted_namespaces".

Goal

See opsmill/infrahub#8319

Non-goals

Added another missing attribute to infrahub_sdk.schema.main.GenericSchemaAPI: hierarchical. This attribute was already into the internal Infrahub generic schema model.

What changed

Generic schemas into SDK API.

How-to review

This PR is quite small: commit by commit, in the chronological order.

How to test

Automated back-end tests:

uv run pytest tests/unit/ctl/test_schema_app.py tests/unit/sdk/test_schema.py

• new test loading a generic schema through infrahubctl command, Infrahub API is mocked
• new test ensuring that a schema not following the namespace restriction rule is rejected with the correct error message when loaded from python-sdk utilities. Infrahub API is mocked.

Application testing scenarios:

• Load a valid generic schema from SDK API using the new attribute "restricted_namespaces".
• Load an invalid schema from SDK API not following the namespace restriction rule.

Impact & rollout

Deployment notes: safe to deploy

Closes IHS-190

Summary by CodeRabbit

• New Features

  • Added optional hierarchical and restricted namespace configuration options to the schema API.
  • Implemented validation to prevent schema nodes from violating configured namespace restrictions.

• Tests

  • Added test coverage for loading generic schemas with namespace restrictions.
  • Added validation tests to ensure namespace constraint enforcement on schema definitions.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@                 Coverage Diff                  @@
##           infrahub-develop     #807      +/-   ##
====================================================
- Coverage             80.33%   80.33%   -0.01%     
====================================================
  Files                   115      115              
  Lines                  9865     9869       +4     
  Branches               1504     1504              
====================================================
+ Hits                   7925     7928       +3     
- Misses                 1419     1420       +1     
  Partials                521      521              

Flag	Coverage Δ
integration-tests	41.43% <0.00%> (-0.02%)	⬇️
python-3.10	51.34% <0.00%> (-0.05%)	⬇️
python-3.11	51.36% <0.00%> (-0.03%)	⬇️
python-3.12	51.34% <0.00%> (-0.05%)	⬇️
python-3.13	51.34% <0.00%> (-0.03%)	⬇️
python-3.14	53.01% <0.00%> (-0.03%)	⬇️
python-filler-3.12	24.09% <100.00%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
infrahub_sdk/schema/main.py	90.28% <100.00%> (+0.07%)	⬆️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ogenstad]

Small comment on this PR. It should target the infrahub-develop branch. The reason being is that anything within that branch covers features included in an upcoming Infrahub version. Where as the develop branch of the SDK might be for things that get included in an SDK release that's outside of the Infrahub release schedule.

[coderabbitai]

Walkthrough

This pull request extends the generic schema API with support for namespace restrictions on generic types. Two new optional fields are added to the GenericSchemaAPI class: hierarchical and restricted_namespaces. A test fixture is introduced that demonstrates a generic schema with an "Animal" generic type and a "Dog" node derived from it. New unit tests validate the loading of valid generic schemas and verify that schema nodes whose namespaces violate a generic's restricted_namespaces constraints are properly rejected during schema validation.

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding a namespace restriction parameter (restricted_namespaces) to generic schemas in the SDK.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@infrahub_sdk/schema/main.py`:
- Around line 292-294: GenericSchema is missing the hierarchical and
restricted_namespaces attributes present in GenericSchemaAPI, causing those
values (e.g., restricted_namespaces from valid_generic_schema.json) to be
dropped when parsed via SchemaRoot; add the two fields to GenericSchema by
declaring hierarchical: bool | None = None and restricted_namespaces: list[str]
| None = None on the GenericSchema dataclass/model so it matches
GenericSchemaAPI and preserves round-trip parsing of those properties.

🧹 Nitpick comments (2)

tests/unit/sdk/test_schema.py (2)

516-537: Variable error_message is shadowed on Line 536.

error_message is first defined on Line 516 as the mock response string, then reassigned on Line 536 to the extracted value from the response. This shadowing is confusing — use a distinct name for one of them.

Suggested fix

-    error_message = response.errors["errors"][0]["message"]
-    assert re.search(r"(?s)restricted namespaces(?=.*Dog)(?=.*Cat)", error_message)
+    actual_error = response.errors["errors"][0]["message"]
+    assert re.search(r"(?s)restricted namespaces(?=.*Dog)(?=.*Cat)", actual_error)

---

488-538: Test only covers the async path; consider adding sync coverage.

Existing tests in this file consistently parametrize over ["standard", "sync"] client types (e.g., Lines 47, 66, 93). This test only exercises InfrahubClient (async). Consider adding a sync variant using InfrahubClientSync.schema.load for parity, consistent with the existing pattern in this file. As per coding guidelines, infrahub_sdk/**/*.py: Follow async/sync dual pattern for new features in the Python SDK.