How to apply users.myuser = {} within a non-host aspect?

[ppenguin]

I'm using den.aspects.profile-something to define properties for certain host categories, they are included as den.aspects.myhost.includes = [ den.aspects.profile-something ... ].

My users are declared globally as den.aspects.<username> and included with den.hosts.<system>.<hostname> = { users.<username> = {}; };.

However, I want assign the user aspect on the aspect level and not on the host level, so I can include user aspects per default for certain host profiles. How to achieve this? (Note that I do not want to merely include the nixos user declaration, because that would bypass the whole user aspect logic.)

I think I understood I could use parametric aspects for this in the den.hosts declaration, but that would defeat the point, since I'd have to do verbatim host profile conditions in such a function, whereas this should solely live within the profile aspect. So I guess that the expected functionality would be something like defining within a profile aspect something like den.users = { someuser = {}; }; which would add to the den.hosts.*.*.users attrset when that profile aspect is included.

[sini]

You can write a custom policy that associates users with hosts like this:
https://github.com/denful/den/blob/main/templates/fleet-demo/modules/policies/fleet.nix#L82-L88

[ppenguin]

Thanks a lot for the quick response. I took a look at your configs, pretty next level (at least for a nix vet but den noob 😃 )
I'm still a bit thrown off by the fact that users somehow are not "first class" entities in den (https://den.denful.dev/explanation/entities/#entity-types) with a dedicated namespace (before I manually added this users had to be declared as aspect for the "registry-like" approach), so we need to jump through hoops to do this. Wouldn't it be natural to expect the functionality to "assign users to aspects" to be built-in? I'd argue that in fact most multi-host use cases would want to have e.g. an aspect like "mylan" and all hosts on this LAN would want the same users declared?

[sini]

Yeah, the reason I didn't link mine is my ACL system overcomplicates what you're asking. Users as a first class registry will be coming in the next release -- I already have it on a dev branch. :) There are historical reasons / the ease of just writing den.hosts.arch.hostname.users.username as a single expression that motivated the decisions around the current system from before I joined the project. Policies didn't exist yet, for example.

That said, rehoming users from host-nested does have some design complexity and backwards compatibility issues so I am taking a bit of time to make sure I get it right. But I 100% agree with your intuition.