Lookup in second table but exclude users from first - mongodb

Question

The bounty expires in 7 days. Answers to this question are eligible for a +150 reputation bounty.
bflemi3 wants to draw more attention to this question.
I have a collection called permissions that I'm joining with another collection called groups.
permissions
[
{
"_id": 1,
"resource": "resource:docs/61",
"permissions": [
{
"permission": "role:documentOwner",
"users": [
"user:def",
"group:abc",
]
},
{
"permission": "document.read",
"users": [
"user:abc",
"user:xxx",
"group:abc"
]
},
{
"permission": "document.update",
"users": [
"user:xxx"
]
}
]
},
{
"_id": 2,
"resource": "resource:docs/38",
"permissions": [
{
"permission": "role:documentOwner",
"users": [
"user:abc",
"user:def",
"group:abc",
"group:bff"
]
},
{
"permission": "document.read",
"users": [
"user:xxx"
]
},
{
"permission": "document.update",
"users": [
"user:xxx"
]
}
]
}
]
groups
[
{
"_id": 1,
"id": "abc",
"name": "Test Group",
"users": [
"abc",
"cpo",
"yyy",
"xxx"
]
},
{
"_id": 2,
"id": "bff",
"name": "Something",
"users": [
"xxx"
]
}
]
I'm trying to do two things:
Get all permissions and have any entries in the users array that are prefixed with group: resolved so that the respective group's users are included in the users array.
If a permission document has a user that is listed specifically and also contained in a listed group, then that user is not included from the group. In other words, permissions that are granted to a group's users, can be overridden for a member of the group if they are specifically granted permissions. For instance, I grant group:abc with document.read permission on a resource, but I want user:abc (which is a part of the group) to have document.read and document.update for that resource, so I specifically grant user:abc with those permissions.
For example, here's what permissions._id = 1 would look like...
[
{
"_id": 1,
"resource": "resource:docs/61",
"permissions": [
{
"permission": "role:documentOwner",
"users": [
"user:def",
"user:cpo", // inherited from group:abc
"user:yyy", // inherited from group:abc
]
},
{
"permission": "document.read",
"users": [
"user:abc", // not inherited even though part of group:abc because they're specifically listed in the original document
"user:xxx", // not inherited even though part of group:abc because they're specifically listed in the original document
"user:cpo", // inherited from group:abc
"user:yyy", // inherited from group:abc
]
},
{
"permission": "document.update",
"users": [
"user:xxx" // not inherited even though part of group:abc because they're specifically listed in the original document
]
}
]
},
...
]
I created a Mongo Playground to use for testing. I'm failing miserably though 😞
I appreciate the help!

Answer 1

You can do the followings in an aggregation pipeline:
$unwind to process at permission-resource level
"split" the users array into "user" and "groups" respectively. Locate the array entries using $indexOfCP equal to 0 to check for the prefix.
$lookup to the groups collection
perform $setUnion to union the permissions for individual users and permissions granted from groups
$group again to get back original form
db.permissions.aggregate([
{
$match: {
"_id": 1
}
},
{
"$unwind": "$permissions"
},
{
$set: {
// process users entries
u: {
"$reduce": {
"input": "$permissions.users",
"initialValue": [],
"in": {
"$cond": {
"if": {
$eq: [
0,
{
"$indexOfCP": [
"$$this",
"user:"
]
}
]
},
"then": {
"$concatArrays": [
"$$value",
[
{
"$replaceAll": {
"input": "$$this",
"find": "user:",
"replacement": ""
}
}
]
]
},
"else": "$$value"
}
}
}
},
// process groups entries
g: {
"$reduce": {
"input": "$permissions.users",
"initialValue": [],
"in": {
"$cond": {
"if": {
$eq: [
0,
{
"$indexOfCP": [
"$$this",
"group:"
]
}
]
},
"then": {
"$concatArrays": [
"$$value",
[
{
"$replaceAll": {
"input": "$$this",
"find": "group:",
"replacement": ""
}
}
]
]
},
"else": "$$value"
}
}
}
}
}
},
{
"$lookup": {
"from": "groups",
"localField": "g",
"foreignField": "id",
"as": "g"
}
},
{
$project: {
resource: 1,
permissions: {
permission: 1,
// flatten and union users and looked up groups
users: {
"$setUnion": [
"$u",
{
"$reduce": {
"input": "$g",
"initialValue": [],
"in": {
"$setUnion": [
"$$value",
"$$this.users"
]
}
}
}
]
}
}
}
},
{
// cosmetics
$set: {
"permissions.users": {
"$map": {
"input": "$permissions.users",
"as": "u",
"in": {
"$concat": [
"user:",
"$$u"
]
}
}
}
}
},
{
$group: {
_id: "$_id",
resource: {
$first: "$resource"
},
permissions: {
$push: "$permissions"
}
}
}
])
Mongo Playground