CredentialQueryResolverImpl Partial Scope Matching

[admetaq]

Current behavior

In CredentialQueryResolverImpl, when a client requests credentials that include scopes beyond those allowed by the self-issued token, the entire query is rejected:

var isValidQuery = new HashSet<>(allowedCredentials.stream()
        .map(VerifiableCredentialResource::getId).toList())
        .containsAll(requestedCredentials.stream()
        .map(VerifiableCredentialResource::getId).toList());

if (!isValidQuery) {
    return QueryResult.unauthorized("Invalid query: requested Credentials outside of scope.");
}

Problem

This is an all-or-nothing check. If a client requests 3 scopes and only 2 are permitted by the token, the entire query fails, even for the 2 valid ones.

This behaviour may be acceptable in some contexts, but it is not the only valid approach. The decision of whether to serve the intersection of permitted and requested credentials, or to reject it, should be left to the operator running the Identity Hub, not enforced globally.

Proposed change

Whether to reject or partially serve a query like this should be a configuration associated with the participant context.

[paullatzelsperger]

The DCP spec is pretty clear about this:

If the [scope] array is empty, the Credential Service MUST return HTTP 4xx. If the array contains scopes that a client is not entitled to, the Credential Service MUST return HTTP 2xx with the PresentationResponseMessage's presentation array holding less entries than requested.

So yes, that's a bug. However, it is not up for interpretation or configuration.

[edit]: I opened a bug issue #990

[paullatzelsperger]

closing because the implementation was aligned in #992