unexpected expand/lookup behaviour with wildcard permissions

[vroldanbet]

Reproduction: https://play.authzed.com/s/Ay9ZZJBrGDKu (check validation tab)

As I run some experiments with the new wildcard permissions feature, I stumbled upon an apparently unexpected behaviour when doing lookup/expand. Permissions that effectively end up in user* & userset behave correctly with Check API, but not with Lookup/Expand API (which is presumably what's used in the validation tab in the playground).

In the original issue, we discussed that SpiceDB will have special treatment to user:* relationship when performing Lookup/Expand API, which is reasonable because it would lead to "listing all public resources" phenomenon. However, when user:* is chained with other algebraic operators like & and -, I think the current implementation semantics seem unexpected. The desirable outcome would be:

<user:userset> - <user:*> = empty
<user:userset> & <user:*> = <user:userset>

[josephschorr]

Appears that we need to support wildcard in the subjectset that the developer API is using for its expected relations determination:

spicedb/pkg/membership/membership.go

Line 192 in 6f66209

func newSubjectSet() *subjectSet {

[josephschorr]

After discussion, we might also need to do handle in Lookup (Expand already has it in the correct place)

[josephschorr]

Closed by recent fixes, as addressed in GHSA-7p8f-8hjm-wm92. See commit: 15bba2e