delint-ids.nix

{ pkgs ? import <nixpkgs>{}
, lib ? pkgs.lib
, configuration ? import ./configuration.nix
, nixos ? import <nixpkgs/nixos>{ inherit configuration; }
}:

let
  inherit (lib) filterAttrs mapAttrs;
  inherit (builtins) hasAttr getAttr;

  uids = nixos.config.ids.uids;
  gids = nixos.config.ids.gids;
in

rec {
  ## map users to conflicting entries in groups: { userName = { conflictingGroup = gid } }
  conflicting-ids =
    filterAttrs (k: v: v != {}) (
      mapAttrs (userName: userId:
        filterAttrs (groupName: groupId: userId == groupId && (groupName != userName))
          gids)
        uids);

  ## find mismatched user/group: { userName = mismatchedGid }
  mismatched-uid-and-gid =
    filterAttrs (k: v: hasAttr k gids && getAttr k gids != v) uids;

  ## find groups with no corresponding uid: { groupName = gid }
  ##
  ## these uids are RESERVED (i.e., may only be used by the user which corresponds to the group).
  gid-with-no-uid =
    filterAttrs (k: v: !hasAttr k uids) gids;

  reserved-uids = gid-with-no-uid;

  ## find users with no corresponding gid: { userName = uid }
  ##
  ## these gids are RESERVED (i.e., may only be used by the group which corresponds to the user).
  uid-with-no-gid =
    filterAttrs (k: v: !hasAttr k gids) uids;

  reserved-gids = uid-with-no-gid;
}