From d0fa639bb81bef3472dc3eba21c90f882ca6b32c Mon Sep 17 00:00:00 2001
From: Anand Krishnamoorthi <anakrish@microsoft.com>
Date: Wed, 3 Dec 2025 15:22:12 -0600
Subject: [PATCH] feat: Reject with keyword usage

RVM does not plan to support the `with` keyword which is mainly used
for testing.

- introduce CompilerError::WithKeywordUnsupported and fail query compilation
  when any literal carries with_mods
- skip OPA test cases that hit the error

The "withkeyword" folder is retained in the TODO list to indicate its
lack of support.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
---
 src/languages/rego/compiler/error.rs   |  3 +++
 src/languages/rego/compiler/mod.rs     |  2 +-
 src/languages/rego/compiler/queries.rs |  3 +++
 tests/opa.rs                           | 19 +++++++++++++++++--
 4 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/src/languages/rego/compiler/error.rs b/src/languages/rego/compiler/error.rs
index f2aabcd..26e5297 100644
--- a/src/languages/rego/compiler/error.rs
+++ b/src/languages/rego/compiler/error.rs
@@ -15,6 +15,9 @@ pub enum CompilerError {
     #[error("Unknown builtin function: {name}")]
     UnknownBuiltinFunction { name: String },
 
+    #[error("the `with` keyword is not supported by the compiler yet")]
+    WithKeywordUnsupported,
+
     #[error("internal: missing context for yield")]
     MissingYieldContext,
 
diff --git a/src/languages/rego/compiler/mod.rs b/src/languages/rego/compiler/mod.rs
index 8da0ecb..cb94918 100644
--- a/src/languages/rego/compiler/mod.rs
+++ b/src/languages/rego/compiler/mod.rs
@@ -10,7 +10,7 @@ mod queries;
 mod references;
 mod rules;
 
-pub use error::{CompilerError, Result};
+pub use error::{CompilerError, Result, SpannedCompilerError};
 
 use crate::ast::ExprRef;
 use crate::lexer::Span;
diff --git a/src/languages/rego/compiler/queries.rs b/src/languages/rego/compiler/queries.rs
index 4987c2f..a6990a5 100644
--- a/src/languages/rego/compiler/queries.rs
+++ b/src/languages/rego/compiler/queries.rs
@@ -38,6 +38,9 @@ impl<'a> Compiler<'a> {
         stmts: &[&LiteralStmt],
     ) -> Result<()> {
         for (idx, stmt) in stmts.iter().enumerate() {
+            if !stmt.with_mods.is_empty() {
+                return Err(CompilerError::WithKeywordUnsupported.at(&stmt.span));
+            }
             let loop_exprs = self.get_statement_loops(stmt)?;
 
             if !loop_exprs.is_empty() {
diff --git a/tests/opa.rs b/tests/opa.rs
index 262afad..022f7a5 100644
--- a/tests/opa.rs
+++ b/tests/opa.rs
@@ -32,10 +32,9 @@ const OPA_TODO_FOLDERS: &[&str] = &[
     "partialobjectdoc",
     "planner-ir",
     "refheads",
-    "sets",
-    "type",
     "virtualdocs",
     "walkbuiltin",
+    // RVM Compiler does not support 'with' keyword yet.
     "withkeyword",
 ];
 
@@ -267,6 +266,14 @@ fn is_not_valid_rule_path_error(err: &anyhow::Error) -> bool {
         .any(|cause| cause.to_string().contains("not a valid rule path"))
 }
 
+fn is_with_keyword_unsupported_error(err: &anyhow::Error) -> bool {
+    err.chain().any(|cause| {
+        cause
+            .to_string()
+            .contains("`with` keyword is not supported")
+    })
+}
+
 fn maybe_verify_rvm_case(case: &TestCase, is_rego_v0_test: bool, actual: &Value) -> Result<()> {
     if case.note == "defaultkeyword/function with var arg, ref head query" {
         println!(
@@ -292,6 +299,14 @@ fn maybe_verify_rvm_case(case: &TestCase, is_rego_v0_test: bool, actual: &Value)
                 return Ok(());
             }
 
+            if is_with_keyword_unsupported_error(&err) {
+                println!(
+                    "    skipping RVM check for '{}' (with keyword unsupported)",
+                    case.note
+                );
+                return Ok(());
+            }
+
             return Err(err);
         }
     };