From ab27ce1f9647882076f3c7efa17d4d0bdce9be9b Mon Sep 17 00:00:00 2001
From: Majiir Paktu <majiir@nabaal.net>
Date: Sat, 28 Jun 2025 17:28:12 -0400
Subject: [PATCH] nixos/pam: extract autoOrderRules to utils

This function is used to convert an ordered list of rules into an
attrset of rules with reasonable 'order' values. This reduces
boilerplate to define 'order' and makes it simple to switch how ordering
is managed in the future.
---
 nixos/lib/utils.nix            | 27 +++++++++++++++++++++++++++
 nixos/modules/security/pam.nix | 25 ++++++++-----------------
 2 files changed, 35 insertions(+), 17 deletions(-)

diff --git a/nixos/lib/utils.nix b/nixos/lib/utils.nix
index 0a1c2fe50cdd..c716e7f98a59 100644
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@@ -541,6 +541,33 @@ let
       - https://github.com/qemu/qemu/blob/master/scripts/qemu-binfmt-conf.sh
     */
     binfmtMagics = import ./binfmt-magics.nix;
+
+    # Utilities for working with the security.pam module (pam.nix)
+    pam = {
+      /*
+        Set up the ordering for a set of PAM rules using an ordered list of rules.
+
+        The input is an ordered list of PAM rules. Each rule is an attrset similar to the options
+        in `security.pam.services.<service>.rules.<rule>`, with two modifications:
+
+        1. The `order` option may not be given.
+        2. The `name` option is required.
+
+        The output is an attrset of rules suitable for `security.pam.services.<service>.rules`.
+
+        The `order` option on the resulting rules will automatically be configured according to the
+        (implied) ordering of the input rules.
+      */
+      autoOrderRules = lib.flip lib.pipe [
+        (lib.imap1 (
+          index: rule:
+          assert lib.assertMsg (!rule ? order) "the 'order' option may not be set when using autoOrderRules";
+          rule // { order = lib.mkDefault (10000 + index * 100); }
+        ))
+        (map (rule: lib.nameValuePair rule.name (removeAttrs rule [ "name" ])))
+        lib.listToAttrs
+      ];
+    };
   };
 in
 utils
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index ff996943efa1..a9c2d5fe6413 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -3,6 +3,7 @@
 {
   config,
   lib,
+  utils,
   pkgs,
   ...
 }:
@@ -898,20 +899,9 @@ let
         # !!! TODO: move the LDAP stuff to the LDAP module, and the
         # Samba stuff to the Samba module.  This requires that the PAM
         # module provides the right hooks.
-        rules =
-          let
-            autoOrderRules = lib.flip lib.pipe [
-              (lib.imap1 (
-                index: rule:
-                assert lib.assertMsg (!rule ? order) "the 'order' option may not be set when using autoOrderRules";
-                rule // { order = lib.mkDefault (10000 + index * 100); }
-              ))
-              (map (rule: lib.nameValuePair rule.name (removeAttrs rule [ "name" ])))
-              lib.listToAttrs
-            ];
-          in
+        rules = (
           lib.optionalAttrs cfg.useDefaultRules {
-            account = autoOrderRules [
+            account = utils.pam.autoOrderRules [
               {
                 name = "ldap";
                 enable = use_ldap;
@@ -992,7 +982,7 @@ let
 
             ];
 
-            auth = autoOrderRules (
+            auth = utils.pam.autoOrderRules (
               [
                 {
                   name = "oslogin_login";
@@ -1365,7 +1355,7 @@ let
               ]
             );
 
-            password = autoOrderRules [
+            password = utils.pam.autoOrderRules [
               {
                 name = "systemd_home";
                 enable = config.services.homed.enable;
@@ -1450,7 +1440,7 @@ let
               }
             ];
 
-            session = autoOrderRules [
+            session = utils.pam.autoOrderRules [
               {
                 name = "env";
                 enable = cfg.setEnvironment;
@@ -1682,7 +1672,8 @@ let
                 modulePath = "${pkgs.intune-portal}/lib/security/pam_intune.so";
               }
             ];
-          };
+          }
+        );
       };
 
     };