compiler: allow for mocking built-in functions via "with"

[srenatus]

With this change, we're able to mock built-in functions in tests 🎉

package test

import future.keywords.in

allow {
	payload.owner == input.name
}

claims[k] = v {
	resp := http.send({"method": "GET", "body": input}).body
	some k, v in resp
}

payload = p {
	some p
	[true, _, p] = io.jwt.decode_verify(claims.jwt, {"cert": data.verification.cert, "iss": "issuer"})
}

pass_resp = {"body": {"jwt": "myjot"}}

deny_resp = {"body"}

mock_http_send(req) = pass_resp {
	req.body.name == "alice"
} else = deny_resp {
	true
}

mock_decode_verify("myjot", _) = [true, {}, {"owner": "alice"}]

test_allow {
	allow with data.verification.cert as "cert"
		with input.name as "alice"
		with http.send as mock_http_send
		with io.jwt.decode_verify as mock_decode_verify
}

⚠️ Mocking user-defined (rego) functions is the next slice of work 🚧

Fixes part of #4449

---

TODOs

• validate with target
• suppress rewriting
• adapt the var visitor to skip the ref call head for SkipRefCallHead in *With targets
• evaluate
  • deal with var in topdown or fix the var -> ref rewriting;
  • deal with stack overflow when mock func calls orig func
• partial eval
• document
• wasm
• forbid mocking relations (for now, "walk" and potentially custom relations)
• replacing builtins with builtins and other values
  • topdown
  • planner/wasm
  • update docs

[srenatus]

I think we can do this simpler than c16e679. Mocked funcs shouldn't be affected by mocking. 💭

[srenatus]

So in the not + partial code path, the "disable inlining of the replacement func" trick won't work.

Since it's inlined, it should not be here. But I think for consistency, I'll try not inlining it here, either.

[johanfylling]

Partial review. Looking good 👍🙂

[tsandall]

This looks very close! Left a couple comments.

[srenatus]

@tsandall thanks for the review! 😃

[tsandall]

This looks great--it feels very close. Left a few comments on the implementation and test cases. It would be nice to get the docs updates written up and included in this PR--it'll be important to explain the scoping in that section in the language guide.

[tsandall]

💭 could imagine using a pure built-in as the source here to avoid test flakes in the future.

[srenatus]

Yeah... but we don't have that many arity-0 built-ins. It's only time.now_ns() and opa.runtime(); since mocking rego.metadata.*() is forbidden. We could add a test-only-builtin, but that could be a burden for any other users of the test data corpus.

But I'll fix those arity-n (n > 0) cases you've commented on below 👍

[tsandall]

Can't wait for this to get rolled out!