deployment/data-model-test.nix

@@ -14,7 +14,6 @@ let
       ];
     }).config;
   nixops4Deployment = inputs.nixops4.modules.nixops4Deployment.default;
-  inherit (inputs.nixops4.lib) mkDeployment;
 in
 {
   test-eval = {
@@ -44,10 +43,10 @@ in
                       extra-config = mkOption {
                         description = "Any options from NixOS";
                       };
-                    };
+                      apply = mkOption {
-                    config = {
+                        type = with types; functionTo raw;
-                      resource-type = types.raw; # TODO: what's the type of a NixOS configuration?
+                        default = requests: lib.mkMerge (requests ++ [ config.extra-config ]);
-                      apply = requests: lib.mkMerge (requests ++ [ config.extra-config ]);
+                      };
                     };
                   };
               };
@@ -84,26 +83,20 @@ in
                         default = false;
                       };
                     };
-                    config = {
+                    config.resource-type = types.any; # TODO: splice out the user type from NixOS
-                      resource-type = types.raw; # TODO: splice out the user type from NixOS
+                    config.apply =
-                      apply =
+                      requests:
-                        requests:
+                      let
-                        let
+                        # Filter out requests that need wheel if policy doesn't allow it
-                          # Filter out requests that need wheel if policy doesn't allow it
+                        validRequests = lib.filterAttrs (_name: req: !req.wheel || config.wheel) requests;
-                          validRequests = lib.filterAttrs (
+                      in
-                            _name: req: !req.login-shell.wheel || config.wheel
+                      lib.optionalAttrs (validRequests != { }) {
-                          ) requests.resources;
+                        ${config.username} = {
-                        in
+                          isNormalUser = true;
-                        lib.optionalAttrs (validRequests != { }) {
+                          packages = with lib; concatMapAttrs (_name: request: attrValues request.packages) validRequests;
-                          ${config.username} = {
+                          extraGroups = lib.optional config.wheel "wheel";
-                            isNormalUser = true;
-                            packages =
-                              with lib;
-                              attrValues (concatMapAttrs (_name: request: request.login-shell.packages) validRequests);
-                            extraGroups = lib.optional config.wheel "wheel";
-                          };
                         };
-                    };
+                      };
                   };
               };
               applications.hello =
@@ -125,7 +118,7 @@ in
               environments.single-nixos-vm =
                 { config, ... }:
                 {
-                  resources.operator-environment.login-shell.username = "operator";
+                  resources.shell.login-shell.username = "operator";
                   implementation = requests: {
                     input = requests;
                     output =
@@ -168,37 +161,14 @@ in
             };
           }
         );
-        resources = fediversity.applications.hello.resources fediversity.example-configuration.applications.hello;
-        hello-shell = resources.resources.hello.login-shell;
-        environment = fediversity.environments.single-nixos-vm.resources.operator-environment.login-shell;
-        result = mkDeployment {
-          modules = [
-            (fediversity.environments.single-nixos-vm.deployment fediversity.example-configuration)
-          ];
-        };
-
       in
-      {
+      rec {
         number-of-resources = with lib; length (attrNames fediversity.resources);
         inherit (fediversity) example-configuration;
-        hello-package-exists = hello-shell.packages ? hello;
+        hello-package-exists =
-        wheel-required = hello-shell.wheel;
+          (fediversity.applications.hello.resources example-configuration.applications.hello)
-        wheel-allowed = environment.wheel;
+          .resources.hello.login-shell.packages ? hello;
-        operator-shell =
+        inherit (fediversity) example-deployment;
-          let
-            operator = (environment.apply resources).operator;
-          in
-          {
-            inherit (operator) isNormalUser;
-            packages = map (p: "${p.pname}") operator.packages;
-            extraGroups = operator.extraGroups;
-          };
-        deployment = {
-          inherit (result) _type;
-          deploymentFunction = lib.isFunction result.deploymentFunction;
-          # XXX(@fricklerhandwerk): evaluating the derivation takes a bit, we may want to stop at `isFunction` here
-          getProviders = lib.isDerivation (result.getProviders { system = builtins.currentSystem; });
-        };
       };
     expected = {
       number-of-resources = 2;
@@ -207,18 +177,7 @@ in
         applications.hello.enable = true;
       };
       hello-package-exists = true;
-      wheel-required = false;
+      example-deployment = { };
-      wheel-allowed = false;
-      operator-shell = {
-        isNormalUser = true;
-        packages = [ "hello" ];
-        extraGroups = [ ];
-      };
-      deployment = {
-        _type = "nixops4Deployment";
-        deploymentFunction = true;
-        getProviders = true;
-      };
     };
   };
 }

deployment/data-model.nix

@@ -10,6 +10,7 @@ let
     attrsOf
     attrTag
     deferredModuleWith
+    submoduleWith
     submodule
     optionType
     functionTo
@@ -73,10 +74,9 @@ in
                         description = "The type of resource this policy configures";
                         type = types.optionType;
                       };
-                      # TODO(@fricklerhandwerk): do we need a function type here as well, or is it in the way?
                       options.apply = mkOption {
                         description = "Apply the policy to a request";
-                        type = functionTo policy.config.resource-type;
+                        type = with types; functionTo policy.config.resource-type;
                       };
                     })
                   ];
@@ -158,7 +158,7 @@ in
             };
             deployment = mkOption {
               description = "Generate a deployment from a configuration";
-              type = functionTo (environment.config.resource-mapping.output-type);
+              type = functionTo (submodule environment.config.resource-mapping.output-type);
               readOnly = true;
               default =
                 cfg: