kiara/Fediversity
1
0
Fork 0
forked from Fediversity/Fediversity
Code Pull requests Activity

more type-safe policy application

Browse source
This commit is contained in:
Valentin Gagarin 2025-07-22 12:28:00 +02:00 • committed by Kiara Grouwstra
parent 8bae65c4c4
commit f90e8d0932
Signed by: kiara
SSH key fingerprint: SHA256:COspvLoLJ5WC5rFb9ZDe5urVCkK4LJZOsjfF4duRJFU
2 changed files with 38 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
deployment/data-model-test.nix
View file

@ -45,10 +45,10 @@ in
extra-config = mkOption { extra-config = mkOption {
description = "Any options from NixOS"; description = "Any options from NixOS";
}; };
apply = mkOption { };
type = with types; functionTo raw; config = {
default = policy: requests: lib.mkMerge (requests ++ [ policy.extra-config ]); resource-type = types.raw; # TODO: what's the type of a NixOS configuration?
}; apply = policy: requests: lib.mkMerge (requests ++ [ policy.extra-config ]);
}; };
}; };
}; };
@ -85,22 +85,22 @@ in
type = types.bool; type = types.bool;
default = false; default = false;
}; };
apply = mkOption { };
type = with types; functionTo raw; # TODO: splice out the user type from NixOS config = {
default = resource-type = types.raw; # TODO: splice out the user type from NixOS
policy: requests: apply =
let policy: requests:
# Filter out requests that need wheel if policy doesn't allow it let
validRequests = lib.filterAttrs (_name: req: !req.wheel || policy.wheel) requests; # Filter out requests that need wheel if policy doesn't allow it
in validRequests = lib.filterAttrs (_name: req: !req.wheel || policy.wheel) requests;
lib.optionalAttrs (validRequests != { }) { in
${policy.username} = { lib.optionalAttrs (validRequests != { }) {
isNormalUser = true; ${policy.username} = {
packages = with lib; concatMap (request: attrValues request.packages) (attrValues validRequests); isNormalUser = true;
extraGroups = lib.optional policy.wheel "wheel"; packages = with lib; concatMap (request: attrValues request.packages) (attrValues validRequests);
}; extraGroups = lib.optional policy.wheel "wheel";
}; };
}; };
}; };
}; };
}; };

23
deployment/data-model.nix
View file

@ -73,11 +73,26 @@ in
type = submoduleWith { type = submoduleWith {
class = "fediversity-resource-policy"; class = "fediversity-resource-policy";
modules = [ modules = [
{ (policy: {
options.apply = mkOption { _class = "fediversity-resource-policy";
description = "Apply the policy to a request"; options = {
# TODO(@fricklerhandwerk): not sure it can be made
# sensible syntactically, but essentially we want to
# ensure that `apply` is defined, but since its output
# depends on the specific policy we also need to
# determine that somehow.
# hopefully this also helps with correct composition down the line.
resource-type = mkOption {
description = "The type of resource this policy configures";
type = types.optionType;
};
# TODO(@fricklerhandwerk): do we need a function type here as well, or is it in the way?
apply = mkOption {
description = "Apply the policy to a request";
type = functionTo policy.config.resource-type;
};
}; };
} })
]; ];
}; };
}; };