From 9cc0c704a7afc5674bd101e9f4e7945b3586e5ec Mon Sep 17 00:00:00 2001
From: Sandwich <sandwich@archworks.co>
Date: Mon, 10 Aug 2026 04:43:44 +0200
Subject: [PATCH] fix(global_defaults): read dict2items key and key enrichment
 on os

---
 roles/global_defaults/tasks/system.yml     |  4 +++-
 roles/global_defaults/tasks/validation.yml | 10 ++++------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/roles/global_defaults/tasks/system.yml b/roles/global_defaults/tasks/system.yml
index eb72b4f..e372eae 100644
--- a/roles/global_defaults/tasks/system.yml
+++ b/roles/global_defaults/tasks/system.yml
@@ -35,10 +35,12 @@
         }, recursive=True)
       }}
 
+# Keyed on os, not hostname: inventories set hostname themselves, and doing so
+# would otherwise skip enrichment and leave os undefined for validation.
 - name: Check if pre-computed system_cfg needs enrichment
   when: system_cfg is defined
   ansible.builtin.set_fact:
-    _bootstrap_needs_enrichment: "{{ hostname is not defined }}"
+    _bootstrap_needs_enrichment: "{{ os is not defined }}"
 
 - name: Merge pre-computed system_cfg with bootstrap system_defaults
   when:
diff --git a/roles/global_defaults/tasks/validation.yml b/roles/global_defaults/tasks/validation.yml
index 62ee2d2..4265104 100644
--- a/roles/global_defaults/tasks/validation.yml
+++ b/roles/global_defaults/tasks/validation.yml
@@ -317,7 +317,7 @@
     _autologin: "{{ system_cfg.features.desktop.autologin | default(false) }}"
   ansible.builtin.assert:
     that:
-      - _autologin is boolean and not _autologin or (_autologin is string and _autologin | length > 0 and _autologin in system_cfg.users)
+      - _autologin is boolean and not _autologin or (_autologin is string and _autologin | length > 0 and _autologin in system_cfg.users | map(attribute='name'))
     fail_msg: >-
       desktop.autologin must be false or a username string present in
       system.users; got '{{ _autologin }}'. Bool true is not accepted - the
@@ -355,14 +355,12 @@
 
 - name: Validate at least one user with a password is defined
   vars:
-    _pw_users: "{{ system_cfg.users | dict2items | selectattr('value.password', 'defined') | list }}"
+    _pw_users: "{{ system_cfg.users | selectattr('password', 'defined') | map(attribute='password') | map('string') | reject('equalto', '') | list }}"
   ansible.builtin.assert:
     that:
-      - system_cfg.users | default({}) | length > 0
+      - system_cfg.users | default([]) | length > 0
       - _pw_users | length > 0
-      - _pw_users[0].key | string | length > 0
-      - _pw_users[0].value.password | string | length > 0
-    fail_msg: "At least one user with a password must be defined in system.users."
+    fail_msg: "At least one user with a non-empty password must be defined in system.users."
     quiet: true
   no_log: true