$setIntersection (aggregation)

Create the roles创建角色

Run:运行：

db.createRole( { role: "Marketing", roles: [], privileges: [] } )
db.createRole( { role: "Sales", roles: [], privileges: [] } )
db.createRole( { role: "Development", roles: [], privileges: [] } )
db.createRole( { role: "Operations", roles: [], privileges: [] } )

Create the users创建用户

Create users named John and Jane with the required roles. Replace the test database with your database name.创建具有所需角色的名为John和Jane的用户。将test数据库替换为您的数据库名称。

db.createUser( {
   user: "John",
   pwd: "jn008",
   roles: [
      { role: "Marketing", db: "test" },
      { role: "Development", db: "test" },
      { role: "Operations", db: "test" },
      { role: "read", db: "test" }
   ]
} )

db.createUser( {
   user: "Jane",
   pwd: "je009",
   roles: [
      { role: "Sales", db: "test" },
      { role: "Operations", db: "test" },
      { role: "read", db: "test" }
   ]
} )

Create the collection创建集合

Run:运行：

db.budget.insertMany( [
   {
      _id: 0,
      allowedRoles: [ "Marketing" ],
      comment: "For marketing team",
      yearlyBudget: 15000
   },
   {
      _id: 1,
      allowedRoles: [ "Sales" ],
      comment: "For sales team",
      yearlyBudget: 17000,
      salesEventsBudget: 1000
   },
   {
      _id: 2,
      allowedRoles: [ "Operations" ],
      comment: "For operations team",
      yearlyBudget: 19000,
      cloudBudget: 12000
   },
   {
      _id: 3,
      allowedRoles: [ "Development" ],
      comment: "For development team",
      yearlyBudget: 27000
   }
] )

Log in as John以John身份登录

Run:运行：

db.auth( "John", "jn008" )

Retrieve the documents检索文档

To use a system variable, add $$ to the start of the variable name. 要使用系统变量，请在变量名的开头添加$$。Specify the USER_ROLES system variable as $$USER_ROLES.将USER_ROLES系统变量指定为$$USER_ROLES。

Run:

db.budget.aggregate( [ {
   $match: {
      $expr: {
         $not: {
            $eq: [ { $setIntersection: [ "$allowedRoles", "$$USER_ROLES.role" ] }, [] ]
         }
      }
   }
} ] )

The previous example returns the documents from the budget collection that match at least one of the roles that the user who runs the example has. 上一个示例返回budget集合中与运行该示例的用户所具有的至少一个角色相匹配的文档。To do that, the example uses $setIntersection to return documents where the intersection between the budget document allowedRoles field and the set of user roles from $$USER_ROLES is not empty.为此，该示例使用$setIntersection返回预算文档allowedRoles字段和$$USER_ROLES中的用户角色集之间的交集不为空的文档。

Examine the documents检查文件

John has the Marketing, Operations, and Development roles, and sees these documents:John负责Marketing、Operations和Development，并查看以下文档：

[
   {
      _id: 0,
      allowedRoles: [ 'Marketing' ],
      comment: 'For marketing team',
      yearlyBudget: 15000
   },
   {
      _id: 2,
      allowedRoles: [ 'Operations' ],
      comment: 'For operations team',
      yearlyBudget: 19000,
      cloudBudget: 12000
   },
   {
      _id: 3,
      allowedRoles: [ 'Development' ],
      comment: 'For development team',
      yearlyBudget: 27000
   }
]

Log in as Jane以Jane身份登录

Run:运行：

db.auth( "Jane", "je009" )

Retrieve the documents检索文档

To use a system variable, add $$ to the start of the variable name. 要使用系统变量，请在变量名的开头添加$$。Specify the USER_ROLES system variable as $$USER_ROLES.将USER_ROLES系统变量指定为$$USER_ROLES。

Run:运行：

db.budget.aggregate( [ {
   $match: {
      $expr: {
         $not: {
            $eq: [ { $setIntersection: [ "$allowedRoles", "$$USER_ROLES.role" ] }, [] ]
         }
      }
   }
} ] )

Examine the documents检查文件

Jane has the Sales and Operations roles, and sees these documents:Jane担任Sales和Operations角色，并查看以下文档：

[
   {
      _id: 1,
      allowedRoles: [ 'Sales' ],
      comment: 'For sales team',
      yearlyBudget: 17000,
      salesEventsBudget: 1000
   },
   {
      _id: 2,
      allowedRoles: [ 'Operations' ],
      comment: 'For operations team',
      yearlyBudget: 19000,
      cloudBudget: 12000
   }
]