WIP: more type-safe policy application

[HACK] explicitly set resource options, as defaults seem insufficient

clarify comment

default.nix

@@ -11,7 +11,6 @@ let
     ;
   inherit (pkgs) lib;
   inherit (import sources.flake-inputs) import-flake;
-  inputs = (import-flake { src = ./.; }).inputs;
   inherit ((import-flake { src = ./.; }).inputs) nixops4;
   panel = import ./panel { inherit sources system; };
   pre-commit-check =
@@ -79,7 +78,6 @@ in
   # re-export inputs so they can be overridden granularly
   # (they can't be accessed from the outside any other way)
   inherit
-    inputs
     sources
     system
     pkgs

deployment/data-model-test.nix

@@ -7,15 +7,12 @@ let
     (lib.evalModules {
       specialArgs = {
         inherit inputs;
-        # to be passed to nixops4Deployment
-        resourceProviderSystem = builtins.currentSystem;
       };
       modules = [
         module
         ./data-model.nix
       ];
     }).config;
-  nixops4Deployment = inputs.nixops4.modules.nixops4Deployment.default;
 in
 {
   _class = "nix-unit";
@@ -40,7 +37,7 @@ in
                   };
 
                 policy =
-                  { config, ... }:
+                  { ... }:
                   {
                     _class = "fediversity-resource-policy";
 
@@ -48,10 +45,10 @@ in
                       extra-config = mkOption {
                         description = "Any options from NixOS";
                       };
-                      apply = mkOption {
-                        type = with types; functionTo raw;
-                        default = requests: lib.mkMerge (requests ++ [ config.extra-config ]);
                     };
+                    config = {
+                      resource-type = types.raw; # TODO: what's the type of a NixOS configuration?
+                      apply = policy: requests: lib.mkMerge (requests ++ [ policy.extra-config ]);
                     };
                   };
               };
@@ -75,7 +72,7 @@ in
                     };
                   };
                 policy =
-                  { config, ... }:
+                  { ... }:
                   {
                     _class = "fediversity-resource-policy";
                     options = {
@@ -88,20 +85,20 @@ in
                         type = types.bool;
                         default = false;
                       };
-                      apply = mkOption {
+                    };
-                        type = with types; functionTo raw; # TODO: splice out the user type from NixOS
+                    config = {
-                        default =
+                      resource-type = types.raw; # TODO: splice out the user type from NixOS
-                          requests:
+                      apply =
+                        policy: requests:
                         let
                           # Filter out requests that need wheel if policy doesn't allow it
-                            validRequests = lib.filterAttrs (_name: req: !req.wheel || config.wheel) requests;
+                          validRequests = lib.filterAttrs (_name: req: !req.wheel || policy.wheel) requests;
                         in
                         lib.optionalAttrs (validRequests != { }) {
-                            ${config.username} = {
+                          ${policy.username} = {
                             isNormalUser = true;
                             packages = with lib; concatMap (request: attrValues request.packages) (attrValues validRequests);
-                              extraGroups = lib.optional config.wheel "wheel";
+                            extraGroups = lib.optional policy.wheel "wheel";
-                            };
                           };
                         };
                     };
@@ -123,34 +120,21 @@ in
                   resources =
                     cfg:
                     lib.optionalAttrs cfg.enable {
-                      dummy.login-shell.packages.hello = pkgs.hello;
+                      hello.login-shell.packages = {
+                        inherit (pkgs) hello;
                       };
                     };
-              environments.single-nixos-vm =
+                };
-                { config, ... }:
+              environments.single-nixos-vm = environment: {
-                {
                 _class = "fediversity-environment";
-                  resources.shell.login-shell.username = "operator";
+                resources.shell.login-shell = {
-                  implementation =
+                  username = "operator";
-                    requests:
+                  wheel = false; # FIXME: default needs the type uncommented
-                    { providers, ... }:
-                    {
-                      _class = "nixops4Deployment";
-                      providers = {
-                        inherit (inputs.nixops4.modules.nixops4Provider) local;
                 };
-                      resources.the-machine = {
+                implementation = requests: {
-                        _class = "nixops4Resource";
-                        type = providers.local.exec;
-                        imports = [
-                          inputs.nixops4-nixos.modules.nixops4Resource.nixos
-                        ];
-                        nixos.module =
-                          { ... }:
-                          {
                   _class = "nixos";
                   users.users = (
-                              config.resources.login-shell.policy.apply (
+                    config.resources.login-shell.policy.apply environment.config.resources.shell.login-shell (
                       lib.concatMapAttrs (
                         _application: resources:
                         lib.mapAttrs (_k: lib.getAttr "login-shell") (
@@ -162,8 +146,6 @@ in
                 };
               };
             };
-                };
-            };
             options = {
               example-configuration = mkOption {
                 type = config.configuration;
@@ -175,10 +157,7 @@ in
                 };
               };
               example-deployment = mkOption {
-                type = types.submoduleWith {
+                type = types.raw;
-                  class = "nixops4Deployment";
-                  modules = [ nixops4Deployment ];
-                };
                 readOnly = true;
                 default = config.environments.single-nixos-vm.deployment config.example-configuration;
               };

deployment/data-model.nix

@@ -1,7 +1,6 @@
 {
   lib,
   config,
-  inputs,
   ...
 }:
 let
@@ -13,10 +12,10 @@ let
     submoduleWith
     optionType
     functionTo
+    raw
     ;
 
   functionType = import ./function.nix;
-  nixops4Deployment = inputs.nixops4.modules.nixops4Deployment.default;
 
   configuration = mkOption {
     description = "Configuration type declaring options to be set by operators";
@@ -73,11 +72,26 @@ in
                   type = submoduleWith {
                     class = "fediversity-resource-policy";
                     modules = [
-                      {
+                      (policy: {
-                        options.apply = mkOption {
+                        _class = "fediversity-resource-policy";
-                          description = "Apply the policy to a request";
+                        options = {
+                          # TODO(@fricklerhandwerk): not sure it can be made
+                          # sensible syntactically, but essentially we want to
+                          # ensure that `apply` is defined, but since its output
+                          # depends on the specific policy we also need to
+                          # determine that somehow.
+                          # hopefully this also helps with correct composition down the line.
+                          resource-type = mkOption {
+                            description = "The type of resource this policy configures";
+                            type = types.optionType;
                           };
-                      }
+                          # TODO(@fricklerhandwerk): do we need a function type here as well, or is it in the way?
+                          apply = mkOption {
+                            description = "Apply the policy to a request";
+                            type = functionTo policy.config.resource-type;
+                          };
+                        };
+                      })
                     ];
                   };
                 };
@@ -134,26 +148,28 @@ in
                   Setting this is optional, but provides a place to declare that information for programmatic use in the resource mapping.
                 '';
                 # TODO: maybe transpose, and group the resources by type instead
-                type = attrsOf (
+                # # FIXME: error: The option `environments.single-nixos-vm.resources.shell.login-shell.apply' does not exist. Definition values:
-                  attrTag (
+                # # - In `<unknown-file>': <function>
-                    lib.mapAttrs (
+                # # However there are no options defined in `environments.single-nixos-vm.resources.shell.login-shell'. Are you sure you've
-                      _name: resource:
+                # # declared your options properly? This can happen if you e.g. declared your options in `types.submodule'
-                      mkOption {
+                # # under `config' rather than `options'.
-                        type = submoduleWith {
+                # type = attrsOf (
-                          class = "fediversity-resource-policy";
+                #   attrTag (
-                          modules = [ resource.policy ];
+                #     lib.mapAttrs (
-                        };
+                #       _name: resource:
-                      }
+                #       mkOption {
-                    ) config.resources
+                #         type = submoduleWith {
-                  )
+                #           class = "fediversity-resource-policy";
-                );
+                #           modules = [ resource.policy ];
+                #         };
+                #       }
+                #     ) config.resources
+                #   )
+                # );
               };
               implementation = mkOption {
                 description = "Mapping of resources required by applications to available resources; the result can be deployed";
-                type = functionTo (submoduleWith {
+                type = functionTo raw;
-                  class = "nixops4Deployment";
-                  modules = [ environment.config.resource-mapping.output-type ];
-                });
               };
               resource-mapping = mkOption {
                 description = "Function type for the mapping from resources to a (NixOps4) deployment";
@@ -164,15 +180,12 @@ in
                 readOnly = true;
                 default = {
                   input-type = configuration;
-                  output-type = nixops4Deployment;
+                  output-type = raw;
                 };
               };
               deployment = mkOption {
                 description = "Generate a deployment from a configuration";
-                type = functionTo (submoduleWith {
+                type = functionTo raw;
-                  class = "nixops4Deployment";
-                  modules = [ environment.config.resource-mapping.output-type ];
-                });
                 readOnly = true;
                 default =
                   cfg: