reproduce how the module function seems to fail its stated goal of adding type safety over functionTo

specifies classes in the data model, raising these to from `_class`
model attributes to `subModuleWith`'s `class` parameter where possible.

note: resource policy has remained as to use `deferredModuleWith`
(rather than `submoduleWith`) to ensure evaluation will go thru.

.forgejo/workflows/update.yaml

@@ -13,7 +13,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Update pins
-        run: nix-shell --run "npins update"
+        run: nix-shell --run "npins --verbose update"
       - name: Create PR
         uses: https://github.com/KiaraGrouwstra/gitea-create-pull-request@f9f80aa5134bc5c03c38f5aaa95053492885b397
         with:

default.nix

@@ -11,7 +11,8 @@ let
     ;
   inherit (pkgs) lib;
   inherit (import sources.flake-inputs) import-flake;
-  inherit ((import-flake { src = ./.; }).inputs) nixops4;
+  inputs = (import-flake { src = ./.; }).inputs;
+  inherit (inputs) nixops4;
   panel = import ./panel { inherit sources system; };
   pre-commit-check =
     (import "${git-hooks}/nix" {
@@ -78,6 +79,7 @@ in
   # re-export inputs so they can be overridden granularly
   # (they can't be accessed from the outside any other way)
   inherit
+    inputs
     sources
     system
     pkgs

deployment/data-model-test.nix

@@ -1,7 +1,7 @@
 let
   inherit (import ../default.nix { }) pkgs inputs;
   inherit (pkgs) lib;
-  inherit (lib) mkOption;
+  inherit (lib) mkOption types;
   eval =
     module:
     (lib.evalModules {
@@ -13,17 +13,83 @@ let
         ./data-model.nix
       ];
     }).config;
+  nixops4Deployment = inputs.nixops4.modules.nixops4Deployment.default;
+  inherit (inputs.nixops4.lib) mkDeployment;
 in
 {
   _class = "nix-unit";
 
   test-eval = {
+    /**
+      This tests a very simple arrangement that features all ingredients of the Fediversity business logic:
+      application, resource, environment, deployment; and wires it all up in one end-to-end exercise.
+      - The dummy resource is a login shell made available for some user.
+      - The dummy application is `hello` that requires a shell to be deployed.
+      - The dummy environment is a single NixOS VM that hosts one login shell, for the operator.
+      - The dummy configuration enables the `hello` application.
+      This will produce a NixOps4 deployment for a NixOS VM with a login shell for the operator and `hello` available.
+    */
     expr =
       let
         fediversity = eval (
           { config, ... }:
           {
             config = {
+              resources.login-shell = {
+                description = "The operator needs to be able to log into the shell";
+                request =
+                  { ... }:
+                  {
+                    _class = "fediversity-resource-request";
+                    options = {
+                      wheel = mkOption {
+                        description = "Whether the login user needs root permissions";
+                        type = types.bool;
+                        default = false;
+                      };
+                      packages = mkOption {
+                        description = "Packages that need to be available in the user environment";
+                        type = with types; attrsOf package;
+                      };
+                    };
+                  };
+                policy =
+                  { config, ... }:
+                  {
+                    _class = "fediversity-resource-policy";
+                    options = {
+                      username = mkOption {
+                        description = "Username for the operator";
+                        type = types.str; # TODO: use the proper constraints from NixOS
+                      };
+                      wheel = mkOption {
+                        description = "Whether to allow login with root permissions";
+                        type = types.bool;
+                        default = false;
+                      };
+                    };
+                    config = {
+                      resource-type = types.raw; # TODO: splice out the user type from NixOS
+                      apply =
+                        requests:
+                        let
+                          # Filter out requests that need wheel if policy doesn't allow it
+                          validRequests = lib.filterAttrs (
+                            _name: req: !req.login-shell.wheel || config.wheel
+                          ) requests.resources;
+                        in
+                        lib.optionalAttrs (validRequests != { }) {
+                          ${config.username} = {
+                            isNormalUser = true;
+                            packages =
+                              with lib;
+                              attrValues (concatMapAttrs (_name: request: request.login-shell.packages) validRequests);
+                            extraGroups = lib.optional config.wheel "wheel";
+                          };
+                        };
+                    };
+                  };
+              };
               applications.hello =
                 { ... }:
                 {
@@ -31,15 +97,42 @@ in
                   module =
                     { ... }:
                     {
-                      options = {
-                        enable = lib.mkEnableOption "Hello in the shell";
+                      options.enable = lib.mkEnableOption "Hello in the shell";
+                    };
+                  implementation = cfg: {
+                    input = cfg;
+                    output = lib.optionalAttrs cfg.enable {
+                      resources.hello.login-shell.packages.hello = pkgs.hello;
+                    };
+                  };
+                };
+              environments.single-nixos-vm =
+                { config, ... }:
+                {
+                  resources.operator-environment.login-shell.username = "operator";
+                  implementation = requests: {
+                    input = requests;
+                    output =
+                      { providers, ... }:
+                      {
+                        providers = {
+                          inherit (inputs.nixops4.modules.nixops4Provider) local;
+                        };
+                        resources.the-machine = {
+                          type = providers.local.exec;
+                          imports = [
+                            inputs.nixops4-nixos.modules.nixops4Resource.nixos
+                          ];
+                          nixos.module =
+                            { ... }:
+                            {
+                              users.users = config.resources.shell.login-shell.apply (
+                                lib.filterAttrs (_name: value: value ? login-shell) requests
+                              );
+                            };
+                        };
                       };
-                    };
-                  implementation =
-                    cfg:
-                    lib.optionalAttrs cfg.enable {
-                      dummy.login-shell.packages.hello = pkgs.hello;
-                    };
+                  };
                 };
             };
             options = {
@@ -51,20 +144,64 @@ in
                   applications.hello.enable = true;
                 };
               };
+              example-deployment = mkOption {
+                type = types.submodule nixops4Deployment;
+                readOnly = true;
+                default = config.environments.single-nixos-vm.deployment config.example-configuration;
+              };
             };
           }
         );
+        resources = fediversity.applications.hello.resources fediversity.example-configuration.applications.hello;
+        hello-shell = resources.resources.hello.login-shell;
+        environment = fediversity.environments.single-nixos-vm.resources.operator-environment.login-shell;
+        result = mkDeployment {
+          modules = [
+            (fediversity.environments.single-nixos-vm.deployment fediversity.example-configuration)
+          ];
+        };
+
       in
       {
-        inherit (fediversity)
-          example-configuration
-          ;
+        number-of-resources = with lib; length (attrNames fediversity.resources);
+        inherit (fediversity) example-configuration;
+        hello-package-exists = hello-shell.packages ? hello;
+        wheel-required = hello-shell.wheel;
+        wheel-allowed = environment.wheel;
+        operator-shell =
+          let
+            operator = (environment.apply resources).operator;
+          in
+          {
+            inherit (operator) isNormalUser;
+            packages = map (p: "${p.pname}") operator.packages;
+            extraGroups = operator.extraGroups;
+          };
+        deployment = {
+          inherit (result) _type;
+          deploymentFunction = lib.isFunction result.deploymentFunction;
+          getProviders = lib.isFunction result.getProviders;
+        };
       };
     expected = {
+      number-of-resources = 1;
       example-configuration = {
         enable = true;
         applications.hello.enable = true;
       };
+      hello-package-exists = true;
+      wheel-required = false;
+      wheel-allowed = false;
+      operator-shell = {
+        isNormalUser = true;
+        packages = [ "hello" ];
+        extraGroups = [ ];
+      };
+      deployment = {
+        _type = "nixops4Deployment";
+        deploymentFunction = true;
+        getProviders = true;
+      };
     };
   };
 }

deployment/data-model.nix

@@ -1,6 +1,7 @@
 {
   lib,
   config,
+  inputs,
   ...
 }:
 let
@@ -10,60 +11,194 @@ let
     attrTag
     deferredModuleWith
     submodule
+    submoduleWith
     optionType
     functionTo
     ;
 
   functionType = import ./function.nix;
-  application-resources = {
+  application-resources = submodule {
+    _class = "fediversity-application-requirements";
     options.resources = mkOption {
       # TODO: maybe transpose, and group the resources by type instead
       type = attrsOf (
-        attrTag (lib.mapAttrs (_name: resource: mkOption { type = resource.request; }) config.resources)
+        attrTag (
+          lib.mapAttrs (_name: resource: mkOption { type = submodule resource.request; }) config.resources
+        )
       );
     };
   };
+  nixops4Deployment = types.deferredModuleWith {
+    staticModules = [
+      inputs.nixops4.modules.nixops4Deployment.default
+
+      {
+        _module.args = {
+          resourceProviderSystem = builtins.currentSystem;
+          resources = { };
+        };
+      }
+    ];
+  };
 in
 {
-  _class = "nixops4Deployment";
+  _class = "fediversity-settings";
 
   options = {
+    resources = mkOption {
+      description = "Collection of deployment resources that can be required by applications and policed by hosting providers";
+      type = attrsOf (submoduleWith {
+        class = "fediversity-resource";
+        modules = [
+          (
+            { ... }:
+            {
+              _class = "fediversity-resource";
+              options = {
+                description = mkOption {
+                  description = "Description of the resource to help application module authors and hosting providers to work with it";
+                  type = types.str;
+                };
+                request = mkOption {
+                  description = "Options for declaring resource requirements by an application, a description of how the resource is consumed or accessed";
+                  type = deferredModuleWith { staticModules = [ { _class = "fediversity-resource-request"; } ]; };
+                };
+                policy = mkOption {
+                  description = "Options for configuring the resource policy for the hosting provider, a description of how the resource is made available";
+                  type = deferredModuleWith {
+                    staticModules = [
+                      (policy: {
+                        _class = "fediversity-resource-policy";
+                        options.resource-type = mkOption {
+                          description = "The type of resource this policy configures";
+                          type = types.optionType;
+                        };
+                        # TODO(@fricklerhandwerk): we may want to make the function type explict here: `request -> resource-type`
+                        # and then also rename this to be consistent with the application's resource mapping
+                        options.apply = mkOption {
+                          description = "Apply the policy to a request";
+                          type = functionTo policy.config.resource-type;
+                        };
+                      })
+                    ];
+                  };
+                };
+              };
+            }
+          )
+        ];
+      });
+    };
     applications = mkOption {
       description = "Collection of Fediversity applications";
-      type = attrsOf (
-        submodule (application: {
-          _class = "fediversity-application";
-          options = {
-            description = mkOption {
-              description = "Description to be shown in the application overview";
-              type = types.str;
-            };
-            module = mkOption {
-              description = "Operator-facing configuration options for the application";
-              type = deferredModuleWith { staticModules = [ { _class = "fediversity-application-config"; } ]; };
-            };
-            implementation = mkOption {
-              description = "Mapping of application configuration to deployment resources, a description of what an application needs to run";
-              type = application.config.config-mapping.function-type;
-            };
-            resources = mkOption {
-              description = "Compute resources required by an application";
-              type = functionTo application.config.config-mapping.output-type;
-              readOnly = true;
-              default = input: (application.config.implementation input).output;
-            };
-            config-mapping = mkOption {
-              description = "Function type for the mapping from application configuration to required resources";
-              type = submodule functionType;
-              readOnly = true;
-              default = {
-                input-type = application.config.module;
-                output-type = application-resources;
+      type = attrsOf (submoduleWith {
+        class = "fediversity-application";
+        modules = [
+          (application: {
+            _class = "fediversity-application";
+            options = {
+              description = mkOption {
+                description = "Description to be shown in the application overview";
+                type = types.str;
+              };
+              module = mkOption {
+                description = "Operator-facing configuration options for the application";
+                type = deferredModuleWith { staticModules = [ { _class = "fediversity-application-config"; } ]; };
+              };
+              implementation = mkOption {
+                description = "Mapping of application configuration to deployment resources, a description of what an application needs to run";
+                type = application.config.config-mapping.function-type;
+              };
+              resources = mkOption {
+                description = "Compute resources required by an application";
+                type = functionTo application.config.config-mapping.output-type;
+                readOnly = true;
+                default = input: (application.config.implementation input).output;
+              };
+              # TODO(@fricklerhandwerk): this needs a better name, it's just the type
+              config-mapping = mkOption {
+                description = "Function type for the mapping from application configuration to required resources";
+                type = submoduleWith {
+                  class = "module-function";
+                  modules = [ functionType ];
+                };
+                readOnly = true;
+                default = {
+                  input-type = types.int;
+                  output-type = application-resources;
+                };
               };
             };
-          };
-        })
-      );
+          })
+        ];
+      });
+    };
+    environments = mkOption {
+      description = "Run-time environments for Fediversity applications to be deployed to";
+      type = attrsOf (submoduleWith {
+        class = "fediversity-environment";
+        modules = [
+          (environment: {
+            options = {
+              resources = mkOption {
+                description = ''
+                  Resources made available by the hosting provider, and their policies.
+
+                  Setting this is optional, but provides a place to declare that information for programmatic use in the resource mapping.
+                '';
+                # TODO: maybe transpose, and group the resources by type instead
+                type = attrsOf (
+                  attrTag (
+                    lib.mapAttrs (
+                      _name: resource:
+                      mkOption {
+                        type = submoduleWith {
+                          class = "fediversity-resource-policy";
+                          modules = [ resource.policy ];
+                        };
+                      }
+                    ) config.resources
+                  )
+                );
+              };
+              implementation = mkOption {
+                description = "Mapping of resources required by applications to available resources; the result can be deployed";
+                type = environment.config.resource-mapping.function-type;
+              };
+              resource-mapping = mkOption {
+                description = "Function type for the mapping from resources to a (NixOps4) deployment";
+                type = submoduleWith {
+                  class = "module-function";
+                  modules = [ functionType ];
+                };
+                readOnly = true;
+                default = {
+                  input-type = types.int;
+                  output-type = nixops4Deployment;
+                };
+              };
+              # TODO(@fricklerhandwerk): maybe this should be a separate thing such as `fediversity-setup`,
+              # which makes explicit which applications and environments are available.
+              # then the deployments can simply be the result of the function application baked into this module.
+              deployment = mkOption {
+                description = "Generate a deployment from a configuration, by applying an environment's resource policies to the applications' resource mappings";
+                type = functionTo (environment.config.resource-mapping.output-type);
+                readOnly = true;
+                default =
+                  cfg:
+                  # TODO: check cfg.enable.true
+                  let
+                    required-resources = lib.mapAttrs (
+                      name: application-settings: config.applications.${name}.resources application-settings
+                    ) cfg.applications;
+                  in
+                  (environment.config.implementation required-resources).output;
+
+              };
+            };
+          })
+        ];
+      });
     };
     configuration = mkOption {
       description = "Configuration type declaring options to be set by operators";
@@ -78,7 +213,10 @@ in
             _name: application:
             mkOption {
               description = application.description;
-              type = submodule application.module;
+              type = submoduleWith {
+                class = "fediversity-application-config";
+                modules = [ application.module ];
+              };
               default = { };
             }
           ) config.applications;

deployment/function.nix

@@ -5,7 +5,6 @@
 let
   inherit (lib) mkOption types;
   inherit (types)
-    deferredModule
     submodule
     functionTo
     optionType
@@ -14,10 +13,10 @@ in
 {
   options = {
     input-type = mkOption {
-      type = deferredModule;
+      type = optionType;
     };
     output-type = mkOption {
-      type = deferredModule;
+      type = optionType;
     };
     function-type = mkOption {
       type = optionType;
@@ -25,10 +24,10 @@ in
       default = functionTo (submodule {
         options = {
           input = mkOption {
-            type = submodule config.input-type;
+            type = config.input-type;
           };
           output = mkOption {
-            type = submodule config.output-type;
+            type = config.output-type;
           };
         };
       });

infra/common/nixos/users.nix

@@ -6,7 +6,7 @@
   _class = "nixos";
 
   users.users = {
-    root.openssh.authorizedKeys.keys = config.user.users.procolix.openssh.authorizedKeys.keys;
+    root.openssh.authorizedKeys.keys = config.users.users.procolix.openssh.authorizedKeys.keys;
 
     procolix = {
       isNormalUser = true;

infra/flake-part.nix

@@ -23,21 +23,17 @@ let
   makeResourceModule =
     { vmName, isTestVm }:
     {
-      # TODO(@fricklerhandwerk): this is terrible but IMO we should just ditch flake-parts and have our own data model for how the project is organised internally
-      _module.args = {
-        inherit
-          inputs
-          keys
-          secrets
-          ;
-      };
-
       nixos.module.imports = [
         ./common/proxmox-qemu-vm.nix
       ];
 
       nixos.specialArgs = {
-        inherit sources;
+        inherit
+          sources
+          inputs
+          keys
+          secrets
+          ;
       };
 
       imports =
@@ -79,7 +75,13 @@ let
             # TODO(@fricklerhandwerk): we may want to pass through all of `specialArgs`
             # once we're sure it's sane. leaving it here for better control during refactoring.
             specialArgs = {
-              inherit sources;
+              inherit
+                sources
+                inputs
+                keys
+                secrets
+
+                ;
             };
           });
       };