feat: add key type validation for JWE paths

Add validate_jwe_key_type to enforce key type checks
at construction time, restoring structural parity with
the JWS validation path.

Author: jtdowney

src/gose/internal/key_helpers.gleam

@@ -131,6 +131,34 @@ pub fn validate_jws_key_type(
   }
 }
 
+pub fn validate_jwe_key_type(
+  alg: jwa.JweAlg,
+  key: jwk.Jwk,
+) -> Result(Nil, gose.GoseError) {
+  let key_type = jwk.key_type(key)
+  case alg, key_type {
+    jwa.JweDirect, jwk.OctKeyType
+    | jwa.JweAesKeyWrap(_, _), jwk.OctKeyType
+    | jwa.JweChaCha20KeyWrap(_), jwk.OctKeyType
+    -> Ok(Nil)
+
+    jwa.JweRsa(_), jwk.RsaKeyType -> Ok(Nil)
+
+    jwa.JweEcdhEs(_), jwk.EcKeyType -> Ok(Nil)
+    jwa.JweEcdhEs(_), jwk.OkpKeyType -> validate_xdh_key(key)
+
+    jwa.JwePbes2(_), _ ->
+      Error(gose.InvalidState("use password_decryptor for PBES2 algorithms"))
+
+    _, _ ->
+      Error(gose.InvalidState(
+        "algorithm "
+        <> jwa.jwe_alg_to_string(alg)
+        <> " incompatible with key type",
+      ))
+  }
+}
+
 fn validate_ec_curve(
   key: jwk.Jwk,
   expected: ec.Curve,
@@ -152,6 +180,16 @@ fn validate_eddsa_key(key: jwk.Jwk) -> Result(Nil, gose.GoseError) {
   }
 }
 
+fn validate_xdh_key(key: jwk.Jwk) -> Result(Nil, gose.GoseError) {
+  case jwk.xdh_curve(key) {
+    Ok(_) -> Ok(Nil)
+    Error(_) ->
+      Error(gose.InvalidState(
+        "ECDH-ES algorithm requires an EC or XDH key (X25519/X448), not EdDSA",
+      ))
+  }
+}
+
 /// Validate that a key's `alg` field matches the expected JWE algorithm.
 ///
 /// If the key has no `alg` field set, validation passes (any algorithm allowed).
@@ -222,6 +260,7 @@ pub fn validate_key_for_jwe_decryption(
   alg: jwa.JweAlg,
   key: jwk.Jwk,
 ) -> Result(Nil, gose.GoseError) {
+  use _ <- result.try(validate_jwe_key_type(alg, key))
   use _ <- result.try(validate_key_use(key, ForDecryption))
   use _ <- result.try(validate_key_ops(key, ForDecryption))
   validate_key_algorithm_jwe(key, alg)
@@ -234,6 +273,7 @@ pub fn validate_key_for_jwe_encryption(
   alg: jwa.JweAlg,
   key: jwk.Jwk,
 ) -> Result(Nil, gose.GoseError) {
+  use _ <- result.try(validate_jwe_key_type(alg, key))
   use _ <- result.try(validate_key_use(key, ForEncryption))
   use _ <- result.try(validate_key_ops(key, ForEncryption))
   validate_key_algorithm_jwe(key, alg)

test/gose/internal/key_helpers_test.gleam

@@ -511,3 +511,75 @@ pub fn validate_key_for_jwe_encryption_wrong_alg_test() {
   assert msg
     == "key algorithm mismatch: key has RSA-OAEP, expected RSA-OAEP-256"
 }
+
+pub fn validate_jwe_key_type_oct_alg_ok_test() {
+  let key = jwk.generate_enc_key(jwa.AesGcm(jwa.Aes128))
+  let result = key_helpers.validate_jwe_key_type(jwa.JweDirect, key)
+  assert result == Ok(Nil)
+}
+
+pub fn validate_jwe_key_type_rsa_ok_test() {
+  let key = fixtures.rsa_private_key()
+  let result =
+    key_helpers.validate_jwe_key_type(jwa.JweRsa(jwa.RsaOaepSha256), key)
+  assert result == Ok(Nil)
+}
+
+pub fn validate_jwe_key_type_ecdh_es_ec_ok_test() {
+  let key = fixtures.ec_p256_key()
+  let result =
+    key_helpers.validate_jwe_key_type(jwa.JweEcdhEs(jwa.EcdhEsDirect), key)
+  assert result == Ok(Nil)
+}
+
+pub fn validate_jwe_key_type_ecdh_es_xdh_ok_test() {
+  let key = fixtures.x25519_key()
+  let result =
+    key_helpers.validate_jwe_key_type(jwa.JweEcdhEs(jwa.EcdhEsDirect), key)
+  assert result == Ok(Nil)
+}
+
+pub fn validate_jwe_key_type_ecdh_es_rejects_eddsa_test() {
+  let key = fixtures.ed25519_key()
+  let assert Error(gose.InvalidState(msg)) =
+    key_helpers.validate_jwe_key_type(jwa.JweEcdhEs(jwa.EcdhEsDirect), key)
+  assert msg
+    == "ECDH-ES algorithm requires an EC or XDH key (X25519/X448), not EdDSA"
+}
+
+pub fn validate_jwe_key_type_pbes2_rejects_any_key_test() {
+  let key = jwk.generate_hmac_key(jwa.HmacSha256)
+  let assert Error(gose.InvalidState(msg)) =
+    key_helpers.validate_jwe_key_type(
+      jwa.JwePbes2(jwa.Pbes2Sha256Aes128Kw),
+      key,
+    )
+  assert msg == "use password_decryptor for PBES2 algorithms"
+}
+
+pub fn validate_jwe_key_type_wrong_key_type_test() {
+  let key = jwk.generate_hmac_key(jwa.HmacSha256)
+  let assert Error(gose.InvalidState(msg)) =
+    key_helpers.validate_jwe_key_type(jwa.JweRsa(jwa.RsaOaepSha256), key)
+  assert msg == "algorithm RSA-OAEP-256 incompatible with key type"
+}
+
+pub fn validate_key_for_jwe_decryption_wrong_key_type_test() {
+  let key = jwk.generate_hmac_key(jwa.HmacSha256)
+  let assert Error(gose.InvalidState(msg)) =
+    key_helpers.validate_key_for_jwe_decryption(
+      jwa.JweRsa(jwa.RsaOaepSha256),
+      key,
+    )
+  assert msg == "algorithm RSA-OAEP-256 incompatible with key type"
+}
+
+pub fn validate_key_for_jwe_encryption_wrong_key_type_test() {
+  let key = jwk.generate_hmac_key(jwa.HmacSha256)
+  let assert Error(gose.InvalidState(msg)) =
+    key_helpers.validate_key_for_jwe_encryption(
+      jwa.JweRsa(jwa.RsaOaepSha256),
+      key,
+    )
+  assert msg == "algorithm RSA-OAEP-256 incompatible with key type"
+}

test/gose/jwe_test.gleam

@@ -377,14 +377,14 @@ pub fn wrong_key_type_test() {
     |> jwe.encrypt(rsa_key, <<"test":utf8>>)
 
   assert result1
-    == Error(gose.InvalidState("direct encryption requires an octet key"))
+    == Error(gose.InvalidState("algorithm dir incompatible with key type"))
 
   let result2 =
     jwe.new_rsa(jwa.RsaOaepSha1, jwa.AesGcm(jwa.Aes256))
     |> jwe.encrypt(octet_key, <<"test":utf8>>)
 
   assert result2
-    == Error(gose.InvalidState("RSA encryption requires an RSA key"))
+    == Error(gose.InvalidState("algorithm RSA-OAEP incompatible with key type"))
 }
 
 pub fn wrong_key_size_test() {