1{lib, ...}: let
 2  inherit (lib) mkOption mkEnableOption types;
 3
 4  sshKeyType = types.submodule {
 5    options = {
 6      tag = mkOption {
 7        type = types.nullOr types.str;
 8        default = null;
 9        description = "Tag to categorize the SSH key (e.g., 'laptop', 'workstation', 'yubikey')";
10      };
11      needVerify = mkEnableOption "Need verify before using this SSH key, e.g. passphase or security key's PIN";
12      key = mkOption {
13        type = types.str;
14        description = "SSH public key string";
15      };
16    };
17  };
18in {
19  den.schema.user.imports = [
20    (_: {
21      options = {
22        identity = mkOption {
23          type = types.submodule {
24            options = {
25              displayName = mkOption {
26                type = types.str;
27                default = "";
28                description = "Display name for the user";
29              };
30              email = mkOption {
31                type = types.nullOr types.str;
32                default = null;
33                description = "Email address for the user";
34              };
35              avatar = mkOption {
36                type = types.nullOr types.path;
37                default = null;
38                description = "Avatar for the user";
39              };
40              gpgKeys = mkOption {
41                type = types.listOf (types.either types.path types.str);
42                default = [];
43                description = "GPG key ID for the user";
44              };
45              sshKeys = mkOption {
46                type = types.listOf sshKeyType;
47                default = [];
48                description = "SSH public keys for the user, each with an optional tag";
49              };
50            };
51          };
52          default = {};
53          description = "User identity information";
54        };
55
56        system = mkOption {
57          type = types.submodule {
58            options = {
59              hashedPasswordAged = mkOption {
60                type = types.path;
61                description = "Age encryped hashed password file for user";
62              };
63              settings = mkOption {
64                type = types.attrsOf (types.attrsOf types.anything);
65                default = {};
66                description = "Per-user feature settings (freeform nested namespace)";
67              };
68              themes = mkOption {
69                type = types.attrs;
70                default = {};
71                description = ''
72                  Per-aspect theme selection (tree structure mirroring aspect tree).
73                  Leaf values are theme names (strings). The special key `theme` at the
74                  root sets the global default theme applied to all aspects that do not
75                  have a per-aspect override.
76                '';
77                example = lib.literalExpression ''
78                  {
79                    theme = "catppuccin";
80                    develop.editor.helix = "tokyo-night";
81                  }
82                '';
83              };
84            };
85          };
86          default = {};
87          description = "Unix account defaults and system configuration";
88        };
89      };
90    })
91  ];
92}