refactor: simplify shared config contracts

modules/features/source-control.nix

@@ -13,19 +13,19 @@ in
       host = config.meta.host;
       user = config.meta.user;
       sourceControl = user.sourceControl;
+      sourceControlScopes = sourceControl.scopes;
       hostSourceControlUsers = host.sourceControl.users;
       hostUserSourceControl = hostSourceControlUsers.${user.name} or { };
 
-      scopeEmails = scope: lib.filter (email: email.scope == scope) (builtins.attrValues user.emails);
+      scopeConfig = scope: hostUserSourceControl.${scope} or null;
+      scopeIdentity = scope: sourceControlScopes.${scope} or null;
 
       emailForScope =
         scope:
         let
-          emails = scopeEmails scope;
+          identity = scopeIdentity scope;
         in
-        if builtins.length emails == 1 then (builtins.head emails).address else null;
-
-      scopeConfig = scope: hostUserSourceControl.${scope} or null;
+        if identity == null then null else identity.email;
 
       scopeHasSigningKey =
         scope:
@@ -51,10 +51,7 @@ in
         in
         if keyConfig == null then null else keyConfig.publicKey;
 
-      scopesInUse = lib.unique ([
-        "personal"
-        sourceControl.projectScope
-      ]);
+      scopesInUse = builtins.attrNames sourceControlScopes;
 
       allowedSignersLines = map (scope: "${emailForScope scope} ${publicKeyForScope scope}") (
         builtins.filter (scope: emailForScope scope != null && scopeHasSigningKey scope) scopesInUse