Clarify mismatch between dcql_query.credentials[*].format and vp_formats_supported verifier metadata

[awoie]

There may be edge cases cases where the verifier sends a redirect-based OID4VP request to the wallet that requires vp_formats_supported with a list of VP formats that don't include any or all of the dcql_query.credentials[*].format attributes. It is undefined what the wallet should do in this case.

Should we assume the wallet returns an vp_formats_not_supported error or not return anything (which is always possible)? We could include this error condition as an additional item in the list of failure cases for vp_formats_not_supported error.

Any thoughts @c2bo @jogu @GarethCOliver @TimoGlastra ?

[charsleysa]

I would say the vp_formats_not_supported error is not quite correct and instead the wallet should treat it the same as no matching credentials found.

[awoie]

I would say the vp_formats_not_supported error is not quite correct and instead the wallet should treat it the same as no matching credentials found.

Then we should say something in access_denied about this. vp_formats_supported is not part of the dcql query.

[dpostnikov]

@awoie - existing text wouldn't work? The Wallet did not have the requested Credentials to satisfy the Authorization Request.

How would you suggest to enhance it?

[brentzundel]

I am not at all understanding the edge case. It seems like if the wallet doesn't have credentials with any or all of the dcql_query.credentials[*].format attributes, that behavior is defined.
What am I not understanding?