# System-level user accounts, built from the identity registry
# (users/registry.nix). `hostUsers` is the host's user set, threaded by mkHost
# from the flake host table; `userRegistry` is the global identity table passed
# as a specialArg. Every account's identity -- description, groups, authorized
# keys -- comes from its registry entry, so no user data is hardcoded here and a
# host may declare any number of users.
{
  config,
  pkgs,
  lib,
  hostUsers,
  userRegistry,
  ...
}:

{
  programs.zsh.enable = true;

  users.users = lib.mapAttrs (
    name: spec:
    let
      id = userRegistry.${name};
    in
    {
      isNormalUser = true;
      home = "/home/${name}";
      description = id.fullName;
      inherit (id) extraGroups;
      openssh.authorizedKeys.keys = id.sshAuthorizedKeys;
      shell = pkgs.zsh;
    }
    # Keep this user's systemd --user instance running without an open login
    # session (e.g. for home-manager user timers). Only emitted when the host
    # table opts in, so hosts that don't set it leave linger entirely unmanaged.
    // lib.optionalAttrs (spec ? linger) { inherit (spec) linger; }
  ) hostUsers;

  programs.firefox = lib.mkIf (config.features.swayDesktop.enable == true) {
    enable = true;
  };
  programs.thunderbird = lib.mkIf (config.features.swayDesktop.enable == true) {
    enable = true;
  };
}