MemoryFilter: NOT operator and nested expressions

[fubar-coder]

Hi,

I'd like to use kernel memory, but I have a problem with the filter implementation, as it only allows "AND", "OR", and "EQUALS" operators, which is not enough in the following scenario:

Let's assume that you have a document, that has the following permissions:

• Role A is allowed to read the document
• Role B is denied access to the document
• User C is allowed to read the document
• User D is denied access to the document

Now let's assume that the user/role assignment is as follows:

• User C is in role A and B
• User D is in role A
• User E is in role A
• User F is in role A and B

The effective permission of the users are:

• User C has read access to the document, because user permissions are more important than any role permission, which means that the "DENY" through role B gets ignored
• User D has no access to the document, because the user permissions are more important than the role permission
• User E has read access through role A
• User F has no access to the document, because the "DENY" for role B is more important than the "ALLOW" for role A

This are the filters I'd like to generate:

NOT "USER:C"="DENY"
&& (
  "USER:C"="ALLOW"
  || (
    (
      "ROLE:A"="ALLOW"
      || "ROLE:B"="ALLOW"
    )
    && NOT (
      "ROLE:A"="DENY"
      || "ROLE:B"="DENY"
    )
  )
)

The filters for user D, E, and F have a similar structure and would allow filtering according to the documents ACL.

Is there a way to implement those kind of filters ourselves or is a library change required?

[fubar-coder]

This seems to be a duplicate? of #688, but I also need nested expressions too. I didn't realize this before.

[dluc]

The feature is work in progress in Semantic Kernel, where we've ported the ability to apply tags and use complex filters. Once that's ready, KM connectors can be refactored to leverage that.