Raise error diagnostic on ambiguous scope

src/Bicep.Core.IntegrationTests/ScenarioTests.cs

@@ -6430,7 +6430,10 @@ param condition bool
             }
             """);
 
-        result.ExcludingLinterDiagnostics().Should().NotHaveAnyDiagnostics();
+        result.ExcludingLinterDiagnostics().Should().HaveDiagnostics(new[]
+        {
+            ("BCP420", DiagnosticLevel.Error, "The scope could not be resolved at compile time because the supplied expression is ambiguous or too complex. Scoping expressions must be reducible to a specific kind of scope without knowledge of parameter values."),
+        });
     }
 
     [TestMethod]
@@ -7308,4 +7311,47 @@ public void Test_Issue17035()
 
         result.Should().NotHaveAnyDiagnostics();
     }
+
+    [TestMethod]
+    public void Test_Issue17157()
+    {
+        var result = CompilationHelper.Compile("""
+            param resourceName string = 'example'
+            param serverFarmId string
+            param someIdentityObjectId string
+            param shouldDeploy bool
+
+            resource deployAppService 'Microsoft.Web/sites@2022-03-01' = if (shouldDeploy) {
+              name: resourceName
+              location: resourceGroup().location
+              properties: {
+                serverFarmId: serverFarmId
+              }
+            }
+
+            resource existingAppService 'Microsoft.Web/sites@2022-03-01' existing = {
+              name: resourceName
+            }
+
+            resource contributorRoleDefinition 'Microsoft.Authorization/roleDefinitions@2018-01-01-preview' existing = {
+              name: 'b24988ac-6180-42a0-ab88-20f7382dd24c'
+            }
+
+            var appServiceId = shouldDeploy ? deployAppService.id : existingAppService.id
+            resource contributorRoleAssignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = if (shouldDeploy) {
+              name: guid(appServiceId, someIdentityObjectId, 'contributor')
+              scope: shouldDeploy ? deployAppService : existingAppService
+              properties: {
+                roleDefinitionId: contributorRoleDefinition.id
+                principalId: someIdentityObjectId
+                principalType: 'ServicePrincipal'
+              }
+            }
+            """);
+
+        result.Should().HaveDiagnostics(new[]
+        {
+            ("BCP420", DiagnosticLevel.Error, "The scope could not be resolved at compile time because the supplied expression is ambiguous or too complex. Scoping expressions must be reducible to a specific kind of scope without knowledge of parameter values."),
+        });
+    }
 }

src/Bicep.Core/Diagnostics/DiagnosticBuilder.cs

@@ -1907,6 +1907,10 @@ public Diagnostic ExtensionCannotBeReferenced() => CoreError(
             public Diagnostic InvalidReservedImplicitExtensionNamespace(string name) => CoreError(
                 "BCP419",
                 $"Namespace name \"{name}\", and cannot be used an extension name.");
+
+            public Diagnostic ScopeKindUnresolvableAtCompileTime() => CoreError(
+                "BCP420",
+                "The scope could not be resolved at compile time because the supplied expression is ambiguous or too complex. Scoping expressions must be reducible to a specific kind of scope without knowledge of parameter values.");
         }
 
         public static DiagnosticBuilderInternal ForPosition(TextSpan span)

src/Bicep.Core/Emit/ScopeHelper.cs

@@ -1,5 +1,6 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
+
 using System.Collections.Immutable;
 using Azure.Deployments.Expression.Expressions;
 using Bicep.Core.Diagnostics;
@@ -32,7 +33,7 @@ public record ScopeData(
             ImmutableArray<SyntaxBase>? ResourceScopeNameSyntaxSegments = null,
             SyntaxBase? IndexExpression = null);
 
-        public delegate void LogInvalidScopeDiagnostic(IPositionable positionable, ResourceScope suppliedScope, ResourceScope supportedScopes);
+        public delegate void LogInvalidScopeDiagnostic(IPositionable positionable, ResourceScope? suppliedScope, ResourceScope supportedScopes);
 
         private static ScopeData? ValidateScope(SemanticModel semanticModel, LogInvalidScopeDiagnostic logInvalidScopeFunc, ResourceScope supportedScopes, SyntaxBase bodySyntax, SyntaxBase? scopeValue)
         {
@@ -187,6 +188,13 @@ public record ScopeData(
                         logInvalidScopeFunc(scopeValue, ResourceScope.Module, supportedScopes);
                     }
 
+                    return null;
+
+                case UnionType unionScopeType when scopeSymbol is null && unionScopeType.Members.All(m => m is IScopeReference):
+                    // the user likely provided an expression that would pass type checking but cannot be converted to
+                    // valid scoping data. raise an error
+                    logInvalidScopeFunc(scopeValue, null, supportedScopes);
+
                     return null;
             }
 
@@ -406,8 +414,10 @@ private static bool IsReadonlyAtScope(DeclaredResourceMetadata resource, ScopeDa
 
         public static ImmutableDictionary<DeclaredResourceMetadata, ScopeData> GetResourceScopeInfo(SemanticModel semanticModel, IDiagnosticWriter diagnosticWriter)
         {
-            void logInvalidScopeDiagnostic(IPositionable positionable, ResourceScope suppliedScope, ResourceScope supportedScopes)
-                => diagnosticWriter.Write(positionable, x => x.UnsupportedResourceScope(suppliedScope, supportedScopes));
+            void logInvalidScopeDiagnostic(IPositionable positionable, ResourceScope? suppliedScope, ResourceScope supportedScopes)
+                => diagnosticWriter.Write(positionable, x => suppliedScope.HasValue
+                    ? x.UnsupportedResourceScope(suppliedScope.Value, supportedScopes)
+                    : x.ScopeKindUnresolvableAtCompileTime());
 
             var scopeInfo = new Dictionary<DeclaredResourceMetadata, ScopeData>();
             var ancestorsLookup = semanticModel.DeclaredResources
@@ -562,8 +572,10 @@ ResourceScope.ResourceGroup when scopeData.ResourceGroupProperty is not null
 
         public static ImmutableDictionary<ModuleSymbol, ScopeData> GetModuleScopeInfo(SemanticModel semanticModel, IDiagnosticWriter diagnosticWriter)
         {
-            void LogInvalidScopeDiagnostic(IPositionable positionable, ResourceScope suppliedScope, ResourceScope supportedScopes)
-                => diagnosticWriter.Write(positionable, x => x.UnsupportedModuleScope(suppliedScope, supportedScopes));
+            void LogInvalidScopeDiagnostic(IPositionable positionable, ResourceScope? suppliedScope, ResourceScope supportedScopes)
+                => diagnosticWriter.Write(positionable, x => suppliedScope.HasValue
+                    ? x.UnsupportedModuleScope(suppliedScope.Value, supportedScopes)
+                    : x.ScopeKindUnresolvableAtCompileTime());
 
             var scopeInfo = new Dictionary<ModuleSymbol, ScopeData>();