From 01c15b8752d569f11489278cf3abc734fbce3d2e Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Fri, 8 Aug 2025 00:16:37 +0200
Subject: [PATCH] nixos/tests/kanidm: restore eval when calling
 `nixosTests.kanidm` directly

instead of `kanidm.passthru.tests` by leveraging `runTest { }.extend`
and `_module.args.<name> = lib.mkDefault <thing>`.
---
 nixos/tests/all-tests.nix           | 14 ++------------
 nixos/tests/kanidm-provisioning.nix |  8 ++++----
 nixos/tests/kanidm.nix              |  8 ++++----
 pkgs/by-name/ka/kanidm/generic.nix  |  8 ++++++--
 4 files changed, 16 insertions(+), 22 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 4ce282532ef7..b1f1db8a3ab2 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -772,18 +772,8 @@ in
   k3s = handleTest ./k3s { };
   kafka = handleTest ./kafka { };
   kanboard = runTest ./web-apps/kanboard.nix;
-  kanidm =
-    kanidmVersion:
-    runTest {
-      imports = [ ./kanidm.nix ];
-      _module.args = { inherit kanidmVersion; };
-    };
-  kanidm-provisioning =
-    kanidmVersion:
-    runTest {
-      imports = [ ./kanidm-provisioning.nix ];
-      _module.args = { inherit kanidmVersion; };
-    };
+  kanidm = runTest ./kanidm.nix;
+  kanidm-provisioning = runTest ./kanidm-provisioning.nix;
   karma = runTest ./karma.nix;
   kavita = runTest ./kavita.nix;
   kbd-setfont-decompress = runTest ./kbd-setfont-decompress.nix;
diff --git a/nixos/tests/kanidm-provisioning.nix b/nixos/tests/kanidm-provisioning.nix
index f51c34eae245..547de0d1ac8f 100644
--- a/nixos/tests/kanidm-provisioning.nix
+++ b/nixos/tests/kanidm-provisioning.nix
@@ -1,4 +1,4 @@
-{ kanidmVersion, pkgs, ... }:
+{ kanidmPackage, pkgs, ... }:
 let
   certs = import ./common/acme/server/snakeoil-certs.nix;
   serverDomain = certs.domain;
@@ -13,13 +13,13 @@ let
   provisionAdminPassword = "very-strong-password-for-admin";
   provisionIdmAdminPassword = "very-strong-password-for-idm-admin";
   provisionIdmAdminPassword2 = "very-strong-alternative-password-for-idm-admin";
-
-  kanidmPackage = pkgs."kanidmWithSecretProvisioning_${kanidmVersion}";
 in
 {
-  name = "kanidm-provisioning";
+  name = "kanidm-provisioning-${kanidmPackage.version}";
   meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];
 
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning;
+
   nodes.provision =
     { pkgs, lib, ... }:
     {
diff --git a/nixos/tests/kanidm.nix b/nixos/tests/kanidm.nix
index be91be64d2f0..9d918f156b2c 100644
--- a/nixos/tests/kanidm.nix
+++ b/nixos/tests/kanidm.nix
@@ -1,4 +1,4 @@
-{ kanidmVersion, pkgs, ... }:
+{ kanidmPackage, pkgs, ... }:
 let
   certs = import ./common/acme/server/snakeoil-certs.nix;
   serverDomain = certs.domain;
@@ -13,16 +13,16 @@ let
     cp ${certs."${serverDomain}".cert} $out/snakeoil.crt
     cp ${certs."${serverDomain}".key} $out/snakeoil.key
   '';
-
-  kanidmPackage = pkgs."kanidm_${kanidmVersion}";
 in
 {
-  name = "kanidm";
+  name = "kanidm-${kanidmPackage.version}";
   meta.maintainers = with pkgs.lib.maintainers; [
     Flakebi
     oddlama
   ];
 
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm;
+
   nodes.server =
     { pkgs, ... }:
     {
diff --git a/pkgs/by-name/ka/kanidm/generic.nix b/pkgs/by-name/ka/kanidm/generic.nix
index be610935f5bd..7ee0fb2f48d0 100644
--- a/pkgs/by-name/ka/kanidm/generic.nix
+++ b/pkgs/by-name/ka/kanidm/generic.nix
@@ -133,8 +133,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   passthru = {
     tests = {
-      kanidm = nixosTests.kanidm (versionUnderscored finalAttrs);
-      kanidm-provisioning = nixosTests.kanidm-provisioning (versionUnderscored finalAttrs);
+      kanidm = nixosTests.kanidm.extend {
+        modules = [ { _module.args.kanidmPackage = finalAttrs.finalPackage; } ];
+      };
+      kanidm-provisioning = nixosTests.kanidm-provisioning.extend {
+        modules = [ { _module.args.kanidmPackage = finalAttrs.finalPackage.withSecretProvisioning; } ];
+      };
     };
 
     updateScript = lib.optionals (!enableSecretProvisioning) (nix-update-script {