WIP: more type-safe policy application

deployment/data-model-test.nix

@@ -45,10 +45,10 @@ in
                       extra-config = mkOption {
                         description = "Any options from NixOS";
                       };
-                      apply = mkOption {
+                    };
-                        type = with types; functionTo raw;
+                    config = {
-                        default = policy: requests: lib.mkMerge (requests ++ [ policy.extra-config ]);
+                      resource-type = types.raw; # TODO: what's the type of a NixOS configuration?
-                      };
+                      apply = policy: requests: lib.mkMerge (requests ++ [ policy.extra-config ]);
                     };
                   };
               };
@@ -85,22 +85,22 @@ in
                         type = types.bool;
                         default = false;
                       };
-                      apply = mkOption {
+                    };
-                        type = with types; functionTo raw; # TODO: splice out the user type from NixOS
+                    config = {
-                        default =
+                      resource-type = types.raw; # TODO: splice out the user type from NixOS
-                          policy: requests:
+                      apply =
-                          let
+                        policy: requests:
-                            # Filter out requests that need wheel if policy doesn't allow it
+                        let
-                            validRequests = lib.filterAttrs (_name: req: !req.wheel || policy.wheel) requests;
+                          # Filter out requests that need wheel if policy doesn't allow it
-                          in
+                          validRequests = lib.filterAttrs (_name: req: !req.wheel || policy.wheel) requests;
-                          lib.optionalAttrs (validRequests != { }) {
+                        in
-                            ${policy.username} = {
+                        lib.optionalAttrs (validRequests != { }) {
-                              isNormalUser = true;
+                          ${policy.username} = {
-                              packages = with lib; concatMap (request: attrValues request.packages) (attrValues validRequests);
+                            isNormalUser = true;
-                              extraGroups = lib.optional policy.wheel "wheel";
+                            packages = with lib; concatMap (request: attrValues request.packages) (attrValues validRequests);
-                            };
+                            extraGroups = lib.optional policy.wheel "wheel";
                           };
-                      };
+                        };
                     };
                   };
               };
@@ -120,7 +120,9 @@ in
                   resources =
                     cfg:
                     lib.optionalAttrs cfg.enable {
-                      dummy.login-shell.packages.hello = pkgs.hello;
+                      hello.login-shell.packages = {
+                        inherit (pkgs) hello;
+                      };
                     };
                 };
               environments.single-nixos-vm = environment: {

deployment/data-model.nix

@@ -72,11 +72,26 @@ in
                   type = submoduleWith {
                     class = "fediversity-resource-policy";
                     modules = [
-                      {
+                      (policy: {
-                        options.apply = mkOption {
+                        _class = "fediversity-resource-policy";
-                          description = "Apply the policy to a request";
+                        options = {
+                          # TODO(@fricklerhandwerk): not sure it can be made
+                          # sensible syntactically, but essentially we want to
+                          # ensure that `apply` is defined, but since its output
+                          # depends on the specific policy we also need to
+                          # determine that somehow.
+                          # hopefully this also helps with correct composition down the line.
+                          resource-type = mkOption {
+                            description = "The type of resource this policy configures";
+                            type = types.optionType;
+                          };
+                          # TODO(@fricklerhandwerk): do we need a function type here as well, or is it in the way?
+                          apply = mkOption {
+                            description = "Apply the policy to a request";
+                            type = functionTo policy.config.resource-type;
+                          };
                         };
-                      }
+                      })
                     ];
                   };
                 };