WIP: more type-safe policy application

[HACK] explicitly set resource options, as defaults seem insufficient

clarify comment

default.nix

@@ -11,7 +11,6 @@ let
     ;
   inherit (pkgs) lib;
   inherit (import sources.flake-inputs) import-flake;
-  inputs = (import-flake { src = ./.; }).inputs;
   inherit ((import-flake { src = ./.; }).inputs) nixops4;
   panel = import ./panel { inherit sources system; };
   pre-commit-check =
@@ -79,7 +78,6 @@ in
   # re-export inputs so they can be overridden granularly
   # (they can't be accessed from the outside any other way)
   inherit
-    inputs
     sources
     system
     pkgs

deployment/data-model-test.nix

@@ -7,15 +7,12 @@ let
     (lib.evalModules {
       specialArgs = {
         inherit inputs;
-        # to be passed to nixops4Deployment
-        resourceProviderSystem = builtins.currentSystem;
       };
       modules = [
         module
         ./data-model.nix
       ];
     }).config;
-  nixops4Deployment = inputs.nixops4.modules.nixops4Deployment.default;
 in
 {
   _class = "nix-unit";
@@ -40,7 +37,7 @@ in
                   };
 
                 policy =
-                  { config, ... }:
+                  { ... }:
                   {
                     _class = "fediversity-resource-policy";
 
@@ -48,10 +45,10 @@ in
                       extra-config = mkOption {
                         description = "Any options from NixOS";
                       };
-                      apply = mkOption {
+                    };
-                        type = with types; functionTo raw;
+                    config = {
-                        default = requests: lib.mkMerge (requests ++ [ config.extra-config ]);
+                      resource-type = types.raw; # TODO: what's the type of a NixOS configuration?
-                      };
+                      apply = policy: requests: lib.mkMerge (requests ++ [ policy.extra-config ]);
                     };
                   };
               };
@@ -75,7 +72,7 @@ in
                     };
                   };
                 policy =
-                  { config, ... }:
+                  { ... }:
                   {
                     _class = "fediversity-resource-policy";
                     options = {
@@ -88,22 +85,22 @@ in
                         type = types.bool;
                         default = false;
                       };
-                      apply = mkOption {
+                    };
-                        type = with types; functionTo raw; # TODO: splice out the user type from NixOS
+                    config = {
-                        default =
+                      resource-type = types.raw; # TODO: splice out the user type from NixOS
-                          requests:
+                      apply =
-                          let
+                        policy: requests:
-                            # Filter out requests that need wheel if policy doesn't allow it
+                        let
-                            validRequests = lib.filterAttrs (_name: req: !req.wheel || config.wheel) requests;
+                          # Filter out requests that need wheel if policy doesn't allow it
-                          in
+                          validRequests = lib.filterAttrs (_name: req: !req.wheel || policy.wheel) requests;
-                          lib.optionalAttrs (validRequests != { }) {
+                        in
-                            ${config.username} = {
+                        lib.optionalAttrs (validRequests != { }) {
-                              isNormalUser = true;
+                          ${policy.username} = {
-                              packages = with lib; concatMap (request: attrValues request.packages) (attrValues validRequests);
+                            isNormalUser = true;
-                              extraGroups = lib.optional config.wheel "wheel";
+                            packages = with lib; concatMap (request: attrValues request.packages) (attrValues validRequests);
-                            };
+                            extraGroups = lib.optional policy.wheel "wheel";
                           };
-                      };
+                        };
                     };
                   };
               };
@@ -123,46 +120,31 @@ in
                   resources =
                     cfg:
                     lib.optionalAttrs cfg.enable {
-                      dummy.login-shell.packages.hello = pkgs.hello;
+                      hello.login-shell.packages = {
-                    };
+                        inherit (pkgs) hello;
-                };
-              environments.single-nixos-vm =
-                { config, ... }:
-                {
-                  _class = "fediversity-environment";
-                  resources.shell.login-shell.username = "operator";
-                  implementation =
-                    requests:
-                    { providers, ... }:
-                    {
-                      _class = "nixops4Deployment";
-                      providers = {
-                        inherit (inputs.nixops4.modules.nixops4Provider) local;
-                      };
-                      resources.the-machine = {
-                        _class = "nixops4Resource";
-                        type = providers.local.exec;
-                        imports = [
-                          inputs.nixops4-nixos.modules.nixops4Resource.nixos
-                        ];
-                        nixos.module =
-                          { ... }:
-                          {
-                            _class = "nixos";
-                            users.users = (
-                              config.resources.login-shell.policy.apply (
-                                lib.concatMapAttrs (
-                                  _application: resources:
-                                  lib.mapAttrs (_k: lib.getAttr "login-shell") (
-                                    lib.filterAttrs (_name: value: value ? login-shell) resources
-                                  )
-                                ) requests
-                              )
-                            );
-                          };
                       };
                     };
                 };
+              environments.single-nixos-vm = environment: {
+                _class = "fediversity-environment";
+                resources.shell.login-shell = {
+                  username = "operator";
+                  wheel = false; # FIXME: default needs the type uncommented
+                };
+                implementation = requests: {
+                  _class = "nixos";
+                  users.users = (
+                    config.resources.login-shell.policy.apply environment.config.resources.shell.login-shell (
+                      lib.concatMapAttrs (
+                        _application: resources:
+                        lib.mapAttrs (_k: lib.getAttr "login-shell") (
+                          lib.filterAttrs (_name: value: value ? login-shell) resources
+                        )
+                      ) requests
+                    )
+                  );
+                };
+              };
             };
             options = {
               example-configuration = mkOption {
@@ -175,10 +157,7 @@ in
                 };
               };
               example-deployment = mkOption {
-                type = types.submoduleWith {
+                type = types.raw;
-                  class = "nixops4Deployment";
-                  modules = [ nixops4Deployment ];
-                };
                 readOnly = true;
                 default = config.environments.single-nixos-vm.deployment config.example-configuration;
               };

deployment/data-model.nix

@@ -1,7 +1,6 @@
 {
   lib,
   config,
-  inputs,
   ...
 }:
 let
@@ -13,10 +12,10 @@ let
     submoduleWith
     optionType
     functionTo
+    raw
     ;
 
   functionType = import ./function.nix;
-  nixops4Deployment = inputs.nixops4.modules.nixops4Deployment.default;
 
   configuration = mkOption {
     description = "Configuration type declaring options to be set by operators";
@@ -73,11 +72,26 @@ in
                   type = submoduleWith {
                     class = "fediversity-resource-policy";
                     modules = [
-                      {
+                      (policy: {
-                        options.apply = mkOption {
+                        _class = "fediversity-resource-policy";
-                          description = "Apply the policy to a request";
+                        options = {
+                          # TODO(@fricklerhandwerk): not sure it can be made
+                          # sensible syntactically, but essentially we want to
+                          # ensure that `apply` is defined, but since its output
+                          # depends on the specific policy we also need to
+                          # determine that somehow.
+                          # hopefully this also helps with correct composition down the line.
+                          resource-type = mkOption {
+                            description = "The type of resource this policy configures";
+                            type = types.optionType;
+                          };
+                          # TODO(@fricklerhandwerk): do we need a function type here as well, or is it in the way?
+                          apply = mkOption {
+                            description = "Apply the policy to a request";
+                            type = functionTo policy.config.resource-type;
+                          };
                         };
-                      }
+                      })
                     ];
                   };
                 };
@@ -134,26 +148,28 @@ in
                   Setting this is optional, but provides a place to declare that information for programmatic use in the resource mapping.
                 '';
                 # TODO: maybe transpose, and group the resources by type instead
-                type = attrsOf (
+                # # FIXME: error: The option `environments.single-nixos-vm.resources.shell.login-shell.apply' does not exist. Definition values:
-                  attrTag (
+                # # - In `<unknown-file>': <function>
-                    lib.mapAttrs (
+                # # However there are no options defined in `environments.single-nixos-vm.resources.shell.login-shell'. Are you sure you've
-                      _name: resource:
+                # # declared your options properly? This can happen if you e.g. declared your options in `types.submodule'
-                      mkOption {
+                # # under `config' rather than `options'.
-                        type = submoduleWith {
+                # type = attrsOf (
-                          class = "fediversity-resource-policy";
+                #   attrTag (
-                          modules = [ resource.policy ];
+                #     lib.mapAttrs (
-                        };
+                #       _name: resource:
-                      }
+                #       mkOption {
-                    ) config.resources
+                #         type = submoduleWith {
-                  )
+                #           class = "fediversity-resource-policy";
-                );
+                #           modules = [ resource.policy ];
+                #         };
+                #       }
+                #     ) config.resources
+                #   )
+                # );
               };
               implementation = mkOption {
                 description = "Mapping of resources required by applications to available resources; the result can be deployed";
-                type = functionTo (submoduleWith {
+                type = functionTo raw;
-                  class = "nixops4Deployment";
-                  modules = [ environment.config.resource-mapping.output-type ];
-                });
               };
               resource-mapping = mkOption {
                 description = "Function type for the mapping from resources to a (NixOps4) deployment";
@@ -164,15 +180,12 @@ in
                 readOnly = true;
                 default = {
                   input-type = configuration;
-                  output-type = nixops4Deployment;
+                  output-type = raw;
                 };
               };
               deployment = mkOption {
                 description = "Generate a deployment from a configuration";
-                type = functionTo (submoduleWith {
+                type = functionTo raw;
-                  class = "nixops4Deployment";
-                  modules = [ environment.config.resource-mapping.output-type ];
-                });
                 readOnly = true;
                 default =
                   cfg: