KeyWrapAlgorithm models a near-closed set as an open string

[sideeffffect]

Severity: low · Category: design (judgment call)

Evidence

• src/optypes/KeyWrapAlgorithm.scala:10-20 — opaque type KeyWrapAlgorithm = String with only Rsa = "RSA" / Aes = "AES" constants; forwarded unchecked at src/internal/CryptoCapabilityImpl.scala:20.

Problem
A typo ("rsa", "RSA-OAEP") is silently accepted and fails only at the sidecar. The doc comment intentionally allows other component-supported strings, so the open set is partly by design — flagging for a decision.

Suggested fix
Either leave as-is (documented open set — acceptable) or switch to an enum of the algorithms Dapr's crypto building block documents, with an escape hatch if arbitrary strings are still needed.

[sideeffffect]

Confirmed: src/optypes/KeyWrapAlgorithm.scala is opaque type KeyWrapAlgorithm = String with a non-empty require, plus Rsa = "RSA" / Aes = "AES" constants, forwarded unchecked to the SDK at src/internal/CryptoCapabilityImpl.scala:20. A typo like "rsa" or "RSA-OAEP" passes construction and only fails at the sidecar.

Recommendation: keep the opaque String, do not switch to an enum. The Scaladoc deliberately documents this as an open set: "The accepted values depend on the key type configured in the crypto component ... Any other algorithm string supported by the component may be passed." Dapr delegates key-wrap to the underlying component (Vault, Kubernetes secrets, JWKS, etc.), so the valid set is component-defined and versioned outside this library — exactly the situation where an enum would force users onto an escape hatch and create a stale closed list to maintain. This also matches the library idiom for delegated/forward-compatible strings (ETag, CloudEventSpecVersion).

The cheap, honest hardening that keeps the open set: in apply, warn-or-document the canonical constants rather than reject unknowns, and keep Rsa/Aes as the discoverable happy path. If you ever want stricter feedback, do it as an optional KeyWrapAlgorithm.checked smart constructor returning Either, not a type change.