ListUsers intersection

[willvedd]

Description

Adding support for intersection rewrites in ListUsers via the and operator.

To achieve this, we need to execute the expand against all children of the intersection rewrite. We then aggregate the frequency count of all of the returned users. If that count is equal to the number of children, that indicates that the user was present in all intersection rewrite expands, thus we push it onto the main results channel.

This work may need to be refactored slightly when exclusion is introduced.

References

Parent PR: #1428

Review Checklist

• I have clicked on "allow edits by maintainers".
• I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
• The correct base branch is being used, if not main
• I have added tests to validate that the change in functionality is working as expected

[miparnisari]

I realized after merging this that there is one unit test worth adding, and it's currently failing:

{
			name: "intersection_and_wildcard",
			req: &openfgav1.ListUsersRequest{
				Object:   &openfgav1.Object{Type: "document", Id: "1"},
				Relation: "can_view",
				UserFilters: []*openfgav1.ListUsersFilter{
					{
						Type: "user",
					},
				},
			},
			model: `model
            schema 1.1
          type user
          type document
            relations
              define allowed: [user]
              define viewer: [user:*] and allowed
              define can_view: viewer`,

			tuples: []*openfgav1.TupleKey{
				tuple.NewTupleKey("document:1", "allowed", "user:jon"),
				tuple.NewTupleKey("document:1", "viewer", "user:*"),
				tuple.NewTupleKey("document:2", "viewer", "user:*"),
			},
			expectedUsers: []string{"user:jon"},
		},

For reference, this appears in https://github.com/openfga/openfga/blob/main/assets/tests/consolidated_1_1_tests.yaml#L4595-L4659

[willvedd]

Very good point! Addressed in #1485.