lib/modules: Introduce _module.checks.*.check

Previously the .enable option was used to encode the condition as well,
which lead to some oddness:
- In order to encode an assertion, one had to invert it
- To disable a check, one had to mkForce it

By introducing a separate .check option this is solved because:
- It can be used to encode assertions
- Disabling is done separately with .enable option, whose default can be
  overridden without a mkForce

11 files changed, 39 insertions, 29 deletions

diff --git a/lib/modules.nix b/lib/modules.nix
index 23dbe962491b..468c373d6aa4 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -155,17 +155,22 @@ rec {
             default = {};
             internal = prefix != [];
             type = types.attrsOf (types.submodule {
-              # TODO: Rename to assertion? Or allow also setting assertion?
               options.enable = mkOption {
                 description = ''
-                  Whether to enable this check.
-                  <note><para>
-                    This is the inverse of asserting a condition: If a certain
-                    condition should be <literal>true</literal>, then this
-                    option should be set to <literal>false</literal> when that
-                    case occurs
-                  </para></note>
+                  Whether to enable this check. Set this to false to not trigger
+                  any errors or warning messages. This is useful for ignoring a
+                  check in case it doesn't make sense in certain scenarios.
                 '';
+                default = true;
+                type = types.bool;
+              };
+
+              options.check = mkOption {
+                description = ''
+                  The condition that must succeed in order for this check to be
+                  successful and not trigger a warning or error.
+                '';
+                readOnly = true;
                 type = types.bool;
               };
 
@@ -189,9 +194,7 @@ rec {
                   and use <literal>''${options.path.to.option}</literal>.
                 '';
                 type = types.str;
-                example = literalExample ''
-                  Enabling both ''${options.services.foo.enable} and ''${options.services.bar.enable} is not possible.
-                '';
+                example = "Enabling both \${options.services.foo.enable} and \${options.services.bar.enable} is not possible.";
               };
             });
           };
@@ -244,7 +247,7 @@ rec {
               if lib.hasPrefix "_" name then value.message
               else "[${showOption prefix}${optionalString (prefix != []) "/"}${name}] ${value.message}";
           in
-            if ! value.enable then errors
+            if value.enable -> value.check then errors
             else if value.type == "warning" then lib.warn show errors
             else if value.type == "error" then errors ++ [ show ]
             else abort "Unknown check type ${value.type}";
@@ -885,8 +888,7 @@ rec {
       });
       config._module.checks =
         let opt = getAttrFromPath optionName options; in {
-        ${showOption optionName} = {
-          enable = mkDefault opt.isDefined;
+        ${showOption optionName} = lib.mkIf opt.isDefined {
           message = ''
             The option definition `${showOption optionName}' in ${showFiles opt.files} no longer has any effect; please remove it.
             ${replacementInstructions}
@@ -958,8 +960,7 @@ rec {
             let val = getAttrFromPath f config;
                 opt = getAttrFromPath f options;
             in {
-              ${showOption f} = {
-                enable = mkDefault (val != "_mkMergedOptionModule");
+              ${showOption f} = lib.mkIf (val != "_mkMergedOptionModule") {
                 type = "warning";
                 message = "The option `${showOption f}' defined in ${showFiles opt.files} has been changed to `${showOption to}' that has a different type. Please read `${showOption to}' documentation and update your configuration accordingly.";
               };
@@ -1024,8 +1025,7 @@ rec {
       });
       config = mkMerge [
         {
-          _module.checks.${showOption from} = {
-            enable = mkDefault (warn && fromOpt.isDefined);
+          _module.checks.${showOption from} = mkIf (warn && fromOpt.isDefined) {
             type = "warning";
             message = "The option `${showOption from}' defined in ${showFiles fromOpt.files} has been renamed to `${showOption to}'.";
           };
diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index 9e85c90d15c5..775be9f7209b 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -279,7 +279,8 @@ checkConfigOutput baz config.value.nested.bar.baz ./types-anything/mk-mods.nix
 # Check that assertions are triggered by default for just evaluating config
 checkConfigError 'Failed checks:\n- \[test\] Assertion failed' config ./assertions/simple.nix
 
-# Assertion is not triggered when enable is false
+# Assertion is not triggered when enable is false or condition is true
+checkConfigOutput '{ }' config ./assertions/condition-true.nix
 checkConfigOutput '{ }' config ./assertions/enable-false.nix
 
 # Warnings should be displayed on standard error
diff --git a/lib/tests/modules/assertions/condition-true.nix b/lib/tests/modules/assertions/condition-true.nix
new file mode 100644
index 000000000000..7ca0817a2397
--- /dev/null
+++ b/lib/tests/modules/assertions/condition-true.nix
@@ -0,0 +1,8 @@
+{
+
+  _module.checks.test = {
+    check = true;
+    message = "Assertion failed";
+  };
+
+}
diff --git a/lib/tests/modules/assertions/enable-false.nix b/lib/tests/modules/assertions/enable-false.nix
index c326c086f03f..11f753bb32e8 100644
--- a/lib/tests/modules/assertions/enable-false.nix
+++ b/lib/tests/modules/assertions/enable-false.nix
@@ -2,6 +2,7 @@
 
   _module.checks.test = {
     enable = false;
+    check = false;
     message = "Assertion failed";
   };
 
diff --git a/lib/tests/modules/assertions/multi.nix b/lib/tests/modules/assertions/multi.nix
index ebbe17f3a558..1e2e14b8643a 100644
--- a/lib/tests/modules/assertions/multi.nix
+++ b/lib/tests/modules/assertions/multi.nix
@@ -2,20 +2,20 @@
 
   _module.checks = {
     test1 = {
-      enable = true;
+      check = false;
       message = "Assertion 1 failed";
     };
     test2 = {
-      enable = true;
+      check = false;
       message = "Assertion 2 failed";
     };
     test3 = {
-      enable = true;
+      check = false;
       message = "Warning 3 failed";
       type = "warning";
     };
     test4 = {
-      enable = true;
+      check = false;
       message = "Warning 4 failed";
       type = "warning";
     };
diff --git a/lib/tests/modules/assertions/simple.nix b/lib/tests/modules/assertions/simple.nix
index a63b8090f910..115d89a30362 100644
--- a/lib/tests/modules/assertions/simple.nix
+++ b/lib/tests/modules/assertions/simple.nix
@@ -1,6 +1,6 @@
 {
   _module.checks.test = {
-    enable = true;
+    check = false;
     message = "Assertion failed";
   };
 }
diff --git a/lib/tests/modules/assertions/submodule-attrsOf-attrsOf.nix b/lib/tests/modules/assertions/submodule-attrsOf-attrsOf.nix
index a5f92aa93c7d..27a63d1e4329 100644
--- a/lib/tests/modules/assertions/submodule-attrsOf-attrsOf.nix
+++ b/lib/tests/modules/assertions/submodule-attrsOf-attrsOf.nix
@@ -4,7 +4,7 @@
     default = { bar.baz = {}; };
     type = lib.types.attrsOf (lib.types.attrsOf (lib.types.submodule {
       _module.checks.test = {
-        enable = true;
+        check = false;
         message = "Assertion failed";
       };
     }));
diff --git a/lib/tests/modules/assertions/submodule-attrsOf.nix b/lib/tests/modules/assertions/submodule-attrsOf.nix
index 450cad0804df..aac5937cf7e5 100644
--- a/lib/tests/modules/assertions/submodule-attrsOf.nix
+++ b/lib/tests/modules/assertions/submodule-attrsOf.nix
@@ -4,7 +4,7 @@
     default = { bar = {}; };
     type = lib.types.attrsOf (lib.types.submodule {
       _module.checks.test = {
-        enable = true;
+        check = false;
         message = "Assertion failed";
       };
     });
diff --git a/lib/tests/modules/assertions/submodule.nix b/lib/tests/modules/assertions/submodule.nix
index a46734a326bf..4e7e0b1bd61e 100644
--- a/lib/tests/modules/assertions/submodule.nix
+++ b/lib/tests/modules/assertions/submodule.nix
@@ -4,7 +4,7 @@
     default = {};
     type = lib.types.submodule {
       _module.checks.test = {
-        enable = true;
+        check = false;
         message = "Assertion failed";
       };
     };
diff --git a/lib/tests/modules/assertions/underscore-attributes.nix b/lib/tests/modules/assertions/underscore-attributes.nix
index c28c9dcd9180..f9ee5c5787b0 100644
--- a/lib/tests/modules/assertions/underscore-attributes.nix
+++ b/lib/tests/modules/assertions/underscore-attributes.nix
@@ -1,7 +1,7 @@
 {
 
   _module.checks._test = {
-    enable = true;
+    check = false;
     message = "Assertion failed";
   };
 
diff --git a/lib/tests/modules/assertions/warning.nix b/lib/tests/modules/assertions/warning.nix
index 8fed9871aa2c..72598ba3fdd5 100644
--- a/lib/tests/modules/assertions/warning.nix
+++ b/lib/tests/modules/assertions/warning.nix
@@ -1,7 +1,7 @@
 {
 
   _module.checks.test = {
-    enable = true;
+    check = false;
     type = "warning";
     message = "Warning message";
   };