From c3ef18ad0944242d36f3877e57bfb70637086748 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Tue, 6 Oct 2026 11:58:25 +0200
Subject: [PATCH] module-eval: assert every removed callout option fails in
 both namespaces

The removal case set 6 of the 10 option x namespace pairs. Build the pairs
from one option table over both namespaces and check there are 10.
---
 nix/module-eval/nats-authelia.nix | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/nix/module-eval/nats-authelia.nix b/nix/module-eval/nats-authelia.nix
index 4cb15060..d12e19bf 100644
--- a/nix/module-eval/nats-authelia.nix
+++ b/nix/module-eval/nats-authelia.nix
@@ -377,16 +377,30 @@ let
               && lib.hasInfix "services.hyperhive.${path}" a.message
               && lib.hasInfix "live in the swarm secret store" a.message
             ) m.assertions;
-          setting = {
-            "deploy.nats.autoGenerateCallout" = hive { deploy.nats.autoGenerateCallout = true; };
-            "swarm.nats.autoGenerateCallout" = hive { swarm.nats.autoGenerateCallout = true; };
-            "deploy.nats.calloutUserPublicKey" = hive { deploy.nats.calloutUserPublicKey = "U"; };
-            "deploy.nats.calloutIssuerPublicKey" = hive { deploy.nats.calloutIssuerPublicKey = "A"; };
-            "deploy.nats.calloutUserSeedFile" = hive { deploy.nats.calloutUserSeedFile = "/run/u.seed"; };
-            "swarm.nats.calloutIssuerSeedFile" = hive { swarm.nats.calloutIssuerSeedFile = "/run/i.seed"; };
+          removedOptions = {
+            autoGenerateCallout = true;
+            calloutUserPublicKey = "U";
+            calloutIssuerPublicKey = "A";
+            calloutUserSeedFile = "/run/u.seed";
+            calloutIssuerSeedFile = "/run/i.seed";
           };
+          setting = lib.listToAttrs (
+            lib.concatMap
+              (
+                ns:
+                lib.mapAttrsToList (name: value: {
+                  name = "${ns}.nats.${name}";
+                  value = hive { ${ns}.nats.${name} = value; };
+                }) removedOptions
+              )
+              [
+                "deploy"
+                "swarm"
+              ]
+          );
         in
-        lib.all (path: refused setting.${path} path) (lib.attrNames setting)
+        lib.length (lib.attrNames setting) == 10
+        && lib.all (path: refused setting.${path} path) (lib.attrNames setting)
         && !(lib.any (path: refused natsWithStoreIdentity path) (lib.attrNames setting));
     }
     {