Management API: add optional "scopes" parameter

[paullatzelsperger]

Feature Request

The /catalog endpoint of the Management API should take an optional parameter with which clients can inject additional DCP scope values.

This could either be a named field in the JSON structure, or an entry in extensible map, similar to various properties fields we have.

Which Areas Would Be Affected?

Catalog API

Why Is the Feature Desired?

In typical DCP interactions, the consumer derives from the current request (e.g. policies, or existing agreements) which scopes need to be put in the access token. This does not work for a Catalog request, because there is no request context.

Further, in many dataspaces there are "default scopes", i.e. scopes that must be present on every DSP interaction, but these are static - they can't be changed at runtime.

In some cases, it is necessary to add scopes to the default scopes. For example, a consumer may know that a provider has certain assets available, but they have an access policy constraing on them, which makes them "invisible" unless a certain credential is presented.

Solution Proposal

• write a decision-record
• add a new optional parameter to the CatalogRequest plus its transformers
• in IdentityHub, treat PresentationQueryMessage#scope as nullable