nethsm: Improve namespace handling in add-user

pynitrokey/cli/nethsm.py

@@ -297,6 +297,11 @@ def get_user(ctx: Context, user_id: str) -> None:
 )
 @click.option("-u", "--user-id", help="The user ID of the new user")
 @click.option("-N", "--namespace", help="The namespace of the new user")
+@click.option(
+    "--create-namespace",
+    is_flag=True,
+    help="Create the namespace after adding the user",
+)
 @click.pass_context
 def add_user(
     ctx: Context,
@@ -305,13 +310,22 @@ def add_user(
     passphrase: str,
     user_id: Optional[str],
     namespace: Optional[str],
+    create_namespace: bool,
 ) -> None:
     """Create a new user on the NetHSM.
 
     If the real name, role or passphrase are not specified, they have to be
     specified interactively.  If the user ID is not set, it is generated by the
     NetHSM.
 
+    If a namespace is specified, the user will be created within the namespace.
+    This means that the resulting user name will follow the pattern
+    namespace~userid, i. e. the same user ID can be used in different
+    namespaces.
+
+    If the --create-namespace option is set and a namespace is specified, the
+    namespace will be created after the user has been added.
+
     This command requires authentication as a user with the Administrator
     role."""
     with connect(ctx) as nethsm:
@@ -320,6 +334,23 @@ def add_user(
         )
         print(f"User {user_id} added to NetHSM {nethsm.host}")
 
+        if namespace and nethsm.auth is not None and "~" not in nethsm.auth.username:
+            # user added to non-existing namespace
+            if create_namespace:
+                nethsm.add_namespace(namespace)
+                print(f"Namespace {namespace} added to NetHSM {nethsm.host}")
+            else:
+                print(
+                    f"Warning: The namespace {namespace} does not exist.  Add it to the NetHSM with ",
+                    file=sys.stderr,
+                )
+                print(f"    nitropy nethsm add-namespace {namespace}", file=sys.stderr)
+                print(
+                    "to be able to use it.  Once the namespace has been added, it can only be managed "
+                    "by users in the same namespace.",
+                    file=sys.stderr,
+                )
+
 
 @nethsm.command()
 @click.argument("user-id")