From 9b41239d8fdcc3fe50febe718c15833ebc224354 Mon Sep 17 00:00:00 2001
From: Tom Bereknyei <tomberek@gmail.com>
Date: Fri, 25 Mar 2022 13:36:41 -0400
Subject: [PATCH] fix: ensure apps are apps and packages are packages

---
 doc/manual/src/release-notes/rl-next.md |  4 ++++
 src/nix/app.cc                          |  9 ++++++++
 tests/flakes-run.sh                     | 29 +++++++++++++++++++++++++
 tests/local.mk                          |  1 +
 4 files changed, 43 insertions(+)
 create mode 100644 tests/flakes-run.sh

diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
index 8c8c0fd41..6ebbe5eb4 100644
--- a/doc/manual/src/release-notes/rl-next.md
+++ b/doc/manual/src/release-notes/rl-next.md
@@ -40,3 +40,7 @@
 
   As before, the old output will continue to work, but `nix flake check` will
   issue a warning about it.
+
+* `nix run` is now stricter wrt what it accepts:
+    * Members of `apps` are now required to be apps (as defined in [the manual](https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3-run.html#apps))
+    * Member of `packages` or `legacyPackages` cannot be of type "app" when used by `nix run`.
diff --git a/src/nix/app.cc b/src/nix/app.cc
index 803d028f0..a43566496 100644
--- a/src/nix/app.cc
+++ b/src/nix/app.cc
@@ -65,6 +65,15 @@ UnresolvedApp Installable::toApp(EvalState & state)
 
     auto type = cursor->getAttr("type")->getString();
 
+    std::string expected;
+    if (hasPrefix(attrPath,"apps.")) {
+        expected = "app";
+    } else {
+        expected = "derivation";
+    }
+    if (type != expected) {
+        throw Error("Attribute '%s' should have type '%s'.", attrPath, expected);
+    }
     if (type == "app") {
         auto [program, context] = cursor->getAttr("program")->getStringWithContext();
 
diff --git a/tests/flakes-run.sh b/tests/flakes-run.sh
new file mode 100644
index 000000000..c8035431c
--- /dev/null
+++ b/tests/flakes-run.sh
@@ -0,0 +1,29 @@
+source common.sh
+
+clearStore
+rm -rf $TEST_HOME/.cache $TEST_HOME/.config $TEST_HOME/.local
+cp ./shell-hello.nix ./config.nix $TEST_HOME
+cd $TEST_HOME
+
+cat <<EOF > flake.nix
+{
+    outputs = {self}: {
+      packages.$system.PkgAsPkg = (import ./shell-hello.nix).hello;
+      packages.$system.AppAsApp = self.packages.$system.AppAsApp;
+
+      apps.$system.PkgAsApp = self.packages.$system.PkgAsPkg;
+      apps.$system.AppAsApp = {
+        type = "app";
+        program = "\${(import ./shell-hello.nix).hello}/bin/hello";
+      };
+    };
+}
+EOF
+nix run --no-write-lock-file .#AppAsApp
+nix run --no-write-lock-file .#PkgAsPkg
+
+! nix run --no-write-lock-file .#PkgAsApp || fail "'nix run' shouldn’t accept an 'app' defined under 'packages'"
+! nix run --no-write-lock-file .#AppAsPkg || fail "elements of 'apps' should be of type 'app'"
+
+clearStore
+
diff --git a/tests/local.mk b/tests/local.mk
index 668b34500..51536188c 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -1,5 +1,6 @@
 nix_tests = \
   flakes.sh \
+  flakes-run.sh \
   ca/gc.sh \
   gc.sh \
   remote-store.sh \