deployment/data-model-test.nix

@@ -45,10 +45,10 @@ in
                       extra-config = mkOption {
                         description = "Any options from NixOS";
                       };
-                    };
+                      apply = mkOption {
-                    config = {
+                        type = with types; functionTo raw;
-                      resource-type = types.raw; # TODO: what's the type of a NixOS configuration?
+                        default = policy: requests: lib.mkMerge (requests ++ [ policy.extra-config ]);
-                      apply = policy: requests: lib.mkMerge (requests ++ [ policy.extra-config ]);
+                      };
                     };
                   };
               };
@@ -85,22 +85,22 @@ in
                         type = types.bool;
                         default = false;
                       };
-                    };
+                      apply = mkOption {
-                    config = {
+                        type = with types; functionTo raw; # TODO: splice out the user type from NixOS
-                      resource-type = types.raw; # TODO: splice out the user type from NixOS
+                        default =
-                      apply =
+                          policy: requests:
-                        policy: requests:
+                          let
-                        let
+                            # Filter out requests that need wheel if policy doesn't allow it
-                          # Filter out requests that need wheel if policy doesn't allow it
+                            validRequests = lib.filterAttrs (_name: req: !req.wheel || policy.wheel) requests;
-                          validRequests = lib.filterAttrs (_name: req: !req.wheel || policy.wheel) requests;
+                          in
-                        in
+                          lib.optionalAttrs (validRequests != { }) {
-                        lib.optionalAttrs (validRequests != { }) {
+                            ${policy.username} = {
-                          ${policy.username} = {
+                              isNormalUser = true;
-                            isNormalUser = true;
+                              packages = with lib; concatMap (request: attrValues request.packages) (attrValues validRequests);
-                            packages = with lib; concatMap (request: attrValues request.packages) (attrValues validRequests);
+                              extraGroups = lib.optional policy.wheel "wheel";
-                            extraGroups = lib.optional policy.wheel "wheel";
+                            };
                           };
-                        };
+                      };
                     };
                   };
               };
@@ -120,9 +120,7 @@ in
                   resources =
                     cfg:
                     lib.optionalAttrs cfg.enable {
-                      hello.login-shell.packages = {
+                      dummy.login-shell.packages.hello = pkgs.hello;
-                        inherit (pkgs) hello;
-                      };
                     };
                 };
               environments.single-nixos-vm = environment: {

deployment/data-model.nix

@@ -72,26 +72,11 @@ in
                   type = submoduleWith {
                     class = "fediversity-resource-policy";
                     modules = [
-                      (policy: {
+                      {
-                        _class = "fediversity-resource-policy";
+                        options.apply = mkOption {
-                        options = {
+                          description = "Apply the policy to a request";
-                          # TODO(@fricklerhandwerk): not sure it can be made
-                          # sensible syntactically, but essentially we want to
-                          # ensure that `apply` is defined, but since its output
-                          # depends on the specific policy we also need to
-                          # determine that somehow.
-                          # hopefully this also helps with correct composition down the line.
-                          resource-type = mkOption {
-                            description = "The type of resource this policy configures";
-                            type = types.optionType;
-                          };
-                          # TODO(@fricklerhandwerk): do we need a function type here as well, or is it in the way?
-                          apply = mkOption {
-                            description = "Apply the policy to a request";
-                            type = functionTo policy.config.resource-type;
-                          };
                         };
-                      })
+                      }
                     ];
                   };
                 };