$setIntersection (aggregation)（聚合）

Create the roles创建角色

Run:运行：

db.createRole( { role: "Marketing", roles: [], privileges: [] } )
db.createRole( { role: "Sales", roles: [], privileges: [] } )
db.createRole( { role: "Development", roles: [], privileges: [] } )
db.createRole( { role: "Operations", roles: [], privileges: [] } )

Create the users创建用户

Create users named John and Jane with the required roles. Replace the test database with your database name.创建具有所需角色的名为John和Jane的用户。用数据库名称替换test数据库。

db.createUser( {
   user: "John",
   pwd: "jn008",
   roles: [
      { role: "Marketing", db: "test" },
      { role: "Development", db: "test" },
      { role: "Operations", db: "test" },
      { role: "read", db: "test" }
   ]
} )

db.createUser( {
   user: "Jane",
   pwd: "je009",
   roles: [
      { role: "Sales", db: "test" },
      { role: "Operations", db: "test" },
      { role: "read", db: "test" }
   ]
} )

Create the collection创建集合

Run:运行：

db.budget.insertMany( [
   {
      _id: 0,
      allowedRoles: [ "Marketing" ],
      comment: "For marketing team",
      yearlyBudget: 15000
   },
   {
      _id: 1,
      allowedRoles: [ "Sales" ],
      comment: "For sales team",
      yearlyBudget: 17000,
      salesEventsBudget: 1000
   },
   {
      _id: 2,
      allowedRoles: [ "Operations" ],
      comment: "For operations team",
      yearlyBudget: 19000,
      cloudBudget: 12000
   },
   {
      _id: 3,
      allowedRoles: [ "Development" ],
      comment: "For development team",
      yearlyBudget: 27000
   }
] )

Log in as John以John的身份登录

Run:运行：

db.auth( "John", "jn008" )

Retrieve the documents检索文件

To use a system variable, add $$ to the start of the variable name. Specify the USER_ROLES system variable as $$USER_ROLES.要使用系统变量，请在变量名的开头添加$$。将USER_ROLES系统变量指定为$$USER_ROLES。

Run:运行：

db.budget.aggregate( [ {
   $match: {
      $expr: {
         $not: {
            $eq: [ { $setIntersection: [ "$allowedRoles", "$$USER_ROLES.role" ] }, [] ]
         }
      }
   }
} ] )

The previous example returns the documents from the budget collection that match at least one of the roles that the user who runs the example has. 前面的示例从预算集合中返回与运行该示例的用户所具有的至少一个角色匹配的文档。To do that, the example uses $setIntersection to return documents where the intersection between the budget document allowedRoles field and the set of user roles from $$USER_ROLES is not empty.为此，该示例使用$setIntersection返回预算文档allowedRoles字段与$$user_roles中的用户角色集之间的交集不为空的文档。

Examine the documents检查文件

John has the Marketing, Operations, and Development roles, and sees these documents:>John担任Marketing（营销）、Operations（运营）和Development（开发）职位，并查看以下文档：

[
   {
      _id: 0,
      allowedRoles: [ 'Marketing' ],
      comment: 'For marketing team',
      yearlyBudget: 15000
   },
   {
      _id: 2,
      allowedRoles: [ 'Operations' ],
      comment: 'For operations team',
      yearlyBudget: 19000,
      cloudBudget: 12000
   },
   {
      _id: 3,
      allowedRoles: [ 'Development' ],
      comment: 'For development team',
      yearlyBudget: 27000
   }
]

Log in as Jane以Jane身份登录

Run:运行：

db.auth( "Jane", "je009" )

Retrieve the documents检索文件

To use a system variable, add $$ to the start of the variable name. Specify the USER_ROLES system variable as $$USER_ROLES.要使用系统变量，请在变量名的开头添加$$。将USER_ROLES系统变量指定为$$USER_ROLES。

Run:运行：

db.budget.aggregate( [ {
   $match: {
      $expr: {
         $not: {
            $eq: [ { $setIntersection: [ "$allowedRoles", "$$USER_ROLES.role" ] }, [] ]
         }
      }
   }
} ] )

Examine the documents检查文件

Jane has the Sales and Operations roles, and sees these documents:Jane担任Sales（销售）和Operations（运营）角色，并查看以下文档：

[
   {
      _id: 1,
      allowedRoles: [ 'Sales' ],
      comment: 'For sales team',
      yearlyBudget: 17000,
      salesEventsBudget: 1000
   },
   {
      _id: 2,
      allowedRoles: [ 'Operations' ],
      comment: 'For operations team',
      yearlyBudget: 19000,
      cloudBudget: 12000
   }
]