nixos/users-groups: split isSystemUser/isNormalUser and uid check into two

[SuperSandro2000]

Before the error message only mentioned isSystemUser/isNormalUser which
lead to a confusing situation when setting isNormalUser and an uid like
500 which would generate an error like:

error:
Failed assertions:

• Exactly one of users.users.other.isSystemUser and users.users.other.isNormalUser must be set.

from which you cannot know that setting the uid to 500 and setting
isNormalUser is the actual problem.

With this patch the error looks like:

error:
Failed assertions:

• A user cannot have a users.users.fixme.uid set below 1000 and set users.users.fixme.isNormalUser.
  Either users.users.fixme.isSystemUser must be set to true instead of users.users.fixme.isNormalUser
  or users.users.fixme.uid must be changed to 1000 or above.

---

I tested this via the config where I before ran into this error and it now produced a better error message and none after fixing it like before.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[eyJhb]

I just tested this, and it works as intended, however, shouldn't we also include such assertions for isSystemUser if it is equal or above 1000?

This is the cases I ran.

  users.users.testing = {
    group = "testing";

    # fails - good
    # isNormalUser = true;
    # uid = 100;

    # passes - good
    # isNormalUser = true;
    # uid = 1000;

    # fails - good
    # isNormalUser = true;
    # isSystemUser = true;
    # uid = 1000;

    # passes - should fail????
    # isSystemUser = true;
    # uid = 1001;
  };

  users.groups.testing = {};

[SuperSandro2000]

@eyJhb did that fail before? If not I would like to move that to a 2nd PR otherwise I get a knot in my head fixing this.

[eyJhb]

@SuperSandro2000 no it did not, so I think you should be good to go, and it could be a separate PR.