home-manager: verify username and home directory

The generation activation script should be run by the user specified
in `home.username` and `home.homeDirectory`. If some other user runs
the activation script, then files may end up in the wrong place or
with the wrong owner.

This commits adds a check early in the activation script that verifies
that the running user match the user in the configuration.

Fixes #4019

modules/lib-bash/activation-init.sh

@@ -88,6 +88,24 @@ function setupVars() {
     fi
 }
 
+function checkUsername() {
+  local expectedUser="$1"
+
+  if [[ "$USER" != "$expectedUser" ]]; then
+    _iError 'Error: USER is set to "%s" but we expect "%s"' "$USER" "$expectedUser"
+    exit 1
+  fi
+}
+
+function checkHomeDirectory() {
+  local expectedHome="$1"
+
+  if ! [[ $HOME -ef $expectedHome ]]; then
+    _iError 'Error: HOME is set to "%s" but we expect "%s"' "$HOME" "$expectedHome"
+    exit 1
+  fi
+}
+
 if [[ -v VERBOSE ]]; then
     export VERBOSE_ECHO=echo
     export VERBOSE_ARG="--verbose"