chore: intersection lr implementation (#2816)

Author: tstirrat15

pkg/query/intersection.go

@@ -2,8 +2,6 @@ package query
 
 import (
 	"github.com/google/uuid"
-
-	"github.com/authzed/spicedb/pkg/spiceerrors"
 )
 
 // Intersection the set of paths that are in all of underlying subiterators.
@@ -221,7 +219,92 @@ func (i *Intersection) IterSubjectsImpl(ctx *Context, resource Object) (PathSeq,
 }
 
 func (i *Intersection) IterResourcesImpl(ctx *Context, subject ObjectAndRelation) (PathSeq, error) {
-	return nil, spiceerrors.MustBugf("unimplemented: intersection.go IterResourcesImpl")
+	ctx.TraceStep(i, "iterating resources for subject %s:%s from %d sub-iterators", subject.ObjectType, subject.ObjectID, len(i.subIts))
+
+	// Track paths by resource key for combining with AND logic
+	pathsByKey := make(map[string]Path)
+
+	for iterIdx, it := range i.subIts {
+		ctx.TraceStep(i, "processing sub-iterator %d", iterIdx)
+
+		pathSeq, err := ctx.IterResources(it, subject)
+		if err != nil {
+			return nil, err
+		}
+		paths, err := CollectAll(pathSeq)
+		if err != nil {
+			return nil, err
+		}
+
+		ctx.TraceStep(i, "sub-iterator %d returned %d paths", iterIdx, len(paths))
+
+		if len(paths) == 0 {
+			ctx.TraceStep(i, "sub-iterator %d returned empty, short-circuiting", iterIdx)
+			return EmptyPathSeq(), nil
+		}
+
+		if iterIdx == 0 {
+			// First iterator - initialize pathsByKey using resource-based keys
+			for _, path := range paths {
+				key := path.Resource.Key()
+				if existing, exists := pathsByKey[key]; !exists {
+					pathsByKey[key] = path
+				} else {
+					// If multiple paths for same resource in first iterator, merge with OR
+					merged, err := existing.MergeOr(path)
+					if err != nil {
+						return nil, err
+					}
+					pathsByKey[key] = merged
+				}
+			}
+		} else {
+			// Subsequent iterators - intersect based on resources and combine caveats
+			newPathsByKey := make(map[string]Path)
+
+			// First collect all paths from this iterator by resource
+			currentIterPaths := make(map[string]Path)
+			for _, path := range paths {
+				key := path.Resource.Key()
+				if existing, exists := currentIterPaths[key]; !exists {
+					currentIterPaths[key] = path
+				} else {
+					// Multiple paths for same resource in current iterator, merge with OR
+					merged, err := existing.MergeOr(path)
+					if err != nil {
+						return nil, err
+					}
+					currentIterPaths[key] = merged
+				}
+			}
+
+			// Now intersect: only keep subjects that exist in both previous and current
+			for key, currentPath := range currentIterPaths {
+				if existing, exists := pathsByKey[key]; exists {
+					// Combine using intersection logic (AND)
+					combined, err := existing.MergeAnd(currentPath)
+					if err != nil {
+						return nil, err
+					}
+					newPathsByKey[key] = combined
+				}
+				// If resource not in previous results, it's filtered out (intersection)
+			}
+			pathsByKey = newPathsByKey
+
+			if len(pathsByKey) == 0 {
+				return EmptyPathSeq(), nil
+			}
+		}
+	}
+
+	return func(yield func(Path, error) bool) {
+		for _, path := range pathsByKey {
+			if !yield(path, nil) {
+				return
+			}
+		}
+	}, nil
 }
 
 func (i *Intersection) Clone() Iterator {

pkg/query/intersection_test.go

@@ -167,13 +167,26 @@ func TestIntersectionIterator(t *testing.T) {
 		require.NotEmpty(paths, "Intersection should find common subjects")
 	})
 
-	t.Run("IterResources_Unimplemented", func(t *testing.T) {
+	t.Run("IterResources", func(t *testing.T) {
 		t.Parallel()
 
 		intersect := NewIntersection()
-		require.Panics(func() {
-			_, _ = ctx.IterResources(intersect, NewObject("user", "alice").WithEllipses())
-		})
+
+		// Add test iterators
+		documentAccess := NewDocumentAccessFixedIterator()
+		multiRole := NewMultiRoleFixedIterator()
+
+		intersect.addSubIterator(documentAccess)
+		intersect.addSubIterator(multiRole)
+
+		pathSeq, err := ctx.IterResources(intersect, NewObject("user", "alice").WithEllipses())
+		require.NoError(err)
+
+		paths, err := CollectAll(pathSeq)
+		require.NoError(err)
+
+		// Should return resources that are in BOTH iterators
+		require.NotEmpty(paths, "Intersection should find common resources")
 	})
 }