kiara/Fediversity
1
0
Fork 0
forked from Fediversity/Fediversity
Code Pull requests Activity

more type-safe policy application

Browse source
This commit is contained in:
Valentin Gagarin 2025-07-22 12:28:00 +02:00 • committed by Kiara Grouwstra
parent 8bae65c4c4
commit f90e8d0932
Signed by: kiara
SSH key fingerprint: SHA256:COspvLoLJ5WC5rFb9ZDe5urVCkK4LJZOsjfF4duRJFU
2 changed files with 38 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
deployment/data-model-test.nix
View file

@ -45,10 +45,10 @@ in
extra-config = mkOption {
description = "Any options from NixOS";
};
apply = mkOption {
type = with types; functionTo raw;
default = policy: requests: lib.mkMerge (requests ++ [ policy.extra-config ]);
};
};
config = {
resource-type = types.raw; # TODO: what's the type of a NixOS configuration?
apply = policy: requests: lib.mkMerge (requests ++ [ policy.extra-config ]);
};
};
};
@ -85,22 +85,22 @@ in
type = types.bool;
default = false;
};
apply = mkOption {
type = with types; functionTo raw; # TODO: splice out the user type from NixOS
default =
policy: requests:
let
# Filter out requests that need wheel if policy doesn't allow it
validRequests = lib.filterAttrs (_name: req: !req.wheel || policy.wheel) requests;
in
lib.optionalAttrs (validRequests != { }) {
${policy.username} = {
isNormalUser = true;
packages = with lib; concatMap (request: attrValues request.packages) (attrValues validRequests);
extraGroups = lib.optional policy.wheel "wheel";
};
};
config = {
resource-type = types.raw; # TODO: splice out the user type from NixOS
apply =
policy: requests:
let
# Filter out requests that need wheel if policy doesn't allow it
validRequests = lib.filterAttrs (_name: req: !req.wheel || policy.wheel) requests;
in
lib.optionalAttrs (validRequests != { }) {
${policy.username} = {
isNormalUser = true;
packages = with lib; concatMap (request: attrValues request.packages) (attrValues validRequests);
extraGroups = lib.optional policy.wheel "wheel";
};
};
};
};
};
};

23
deployment/data-model.nix
View file

@ -73,11 +73,26 @@ in
type = submoduleWith {
class = "fediversity-resource-policy";
modules = [
{
options.apply = mkOption {
description = "Apply the policy to a request";
(policy: {
_class = "fediversity-resource-policy";
options = {
# TODO(@fricklerhandwerk): not sure it can be made
# sensible syntactically, but essentially we want to
# ensure that `apply` is defined, but since its output
# depends on the specific policy we also need to
# determine that somehow.
# hopefully this also helps with correct composition down the line.
resource-type = mkOption {
description = "The type of resource this policy configures";
type = types.optionType;
};
# TODO(@fricklerhandwerk): do we need a function type here as well, or is it in the way?
apply = mkOption {
description = "Apply the policy to a request";
type = functionTo policy.config.resource-type;
};
};
}
})
];
};
};