2 files changed, 32 insertions, 8 deletions

diff --git a/krebs/4lib/default.nix b/krebs/4lib/default.nix
index bfe8c581c..afff17296 100644
--- a/krebs/4lib/default.nix
+++ b/krebs/4lib/default.nix
@@ -15,6 +15,16 @@ let out = rec {
 
   addNames = mapAttrs addName;
 
+  guard = spec@{ type, value, ... }:
+    assert isOptionType type;
+    if type.check value
+      then value
+      else throw (toString (filter isString [
+        "argument"
+        (if spec ? name then "‘${spec.name}’" else null)
+        "is not a ${type.name}"
+      ]));
+
   types = import ./types.nix {
     inherit config;
     lib = lib // { inherit genid optionalTrace; };
@@ -27,6 +37,11 @@ let out = rec {
   shell = import ./shell.nix { inherit lib; };
   tree = import ./tree.nix { inherit lib; };
 
+  lpad = n: c: s:
+    if stringLength s < n
+      then lpad n c (c + s)
+      else s;
+
   toC = x: let
     type = typeOf x;
     reject = throw "cannot convert ${type}";
@@ -41,6 +56,8 @@ let out = rec {
     mapAttrs (name: _: path + "/${name}")
              (filterAttrs (_: eq "directory") (readDir path));
 
+  genAttrs' = names: f: listToAttrs (map f names);
+
   setAttr = name: value: set: set // { ${name} = value; };
 
   optionalTrace = c: msg: x: if c then trace msg x else x;
diff --git a/krebs/4lib/types.nix b/krebs/4lib/types.nix
index 4742877a7..0d5b51f76 100644
--- a/krebs/4lib/types.nix
+++ b/krebs/4lib/types.nix
@@ -163,7 +163,7 @@ types // rec {
   secret-file = submodule ({ config, ... }: {
     options = {
       path = mkOption { type = str; };
-      mode = mkOption { type = str; default = "0400"; };
+      mode = mkOption { type = file-mode; default = "0400"; };
       owner = mkOption {
         type = user;
         default = config.krebs.users.root;
@@ -239,7 +239,7 @@ types // rec {
     check = let
       IPv4address = let d = "([1-9]?[0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])"; in
         concatMapStringsSep "." (const d) (range 1 4);
-    in x: match IPv4address x != null;
+    in x: isString x && match IPv4address x != null;
     merge = mergeOneOption;
   };
   addr6 = mkOptionType {
@@ -247,7 +247,7 @@ types // rec {
     check = let
       # TODO check IPv6 address harder
       IPv6address = "[0-9a-f.:]+";
-    in x: match IPv6address x != null;
+    in x: isString x && match IPv6address x != null;
     merge = mergeOneOption;
   };
 
@@ -293,6 +293,12 @@ types // rec {
     };
   };
 
+  file-mode = mkOptionType {
+    name = "file mode";
+    check = x: isString x && match "[0-7]{4}" x != null;
+    merge = mergeOneOption;
+  };
+
   haskell.conid = mkOptionType {
     name = "Haskell constructor identifier";
     check = x:
@@ -309,7 +315,7 @@ types // rec {
   # RFC952, B. Lexical grammar, <hname>
   hostname = mkOptionType {
     name = "hostname";
-    check = x: all label.check (splitString "." x);
+    check = x: isString x && all label.check (splitString "." x);
     merge = mergeOneOption;
   };
 
@@ -318,14 +324,15 @@ types // rec {
   label = mkOptionType {
     name = "label";
     # TODO case-insensitive labels
-    check = x: match "[0-9A-Za-z]([0-9A-Za-z-]*[0-9A-Za-z])?" x != null;
+    check = x: isString x
+            && match "[0-9A-Za-z]([0-9A-Za-z-]*[0-9A-Za-z])?" x != null;
     merge = mergeOneOption;
   };
 
   # POSIX.1‐2013, 3.278 Portable Filename Character Set
   filename = mkOptionType {
     name = "POSIX filename";
-    check = x: match "([0-9A-Za-z._])[0-9A-Za-z._-]*" x != null;
+    check = x: isString x && match "([0-9A-Za-z._])[0-9A-Za-z._-]*" x != null;
     merge = mergeOneOption;
   };
 
@@ -335,7 +342,7 @@ types // rec {
   absolute-pathname = mkOptionType {
     name = "POSIX absolute pathname";
     check = x: let xs = splitString "/" x; xa = head xs; in
-      xa == "/" || (xa == "" && all filename.check (tail xs));
+      isString x && (xa == "/" || (xa == "" && all filename.check (tail xs)));
     merge = mergeOneOption;
   };
 
@@ -344,7 +351,7 @@ types // rec {
   pathname = mkOptionType {
     name = "POSIX pathname";
     check = x: let xs = splitString "/" x; in
-      all filename.check (if head xs == "" then tail xs else xs);
+      isString x && all filename.check (if head xs == "" then tail xs else xs);
     merge = mergeOneOption;
   };