[anakinj]

Description

Fixes #788.

When an EC JWK's x/y coordinates aren't a valid point on the curve named in crv, for example a P-256 key labelled P-384 or an off-curve point, JWT::JWK::EC#create_point let OpenSSL::PKey::EC::Point::Error escape from verify_key, private?, export and JWKS-based JWT.decode. That error isn't a JWT::Error, so a malformed key in a remote JWKS surfaced as an OpenSSL exception in application code.

create_point now rescues it and raises JWT::JWKError, "Invalid EC point for curve <crv>". Ruby keeps the original OpenSSL error as cause. This matches how other invalid JWK input is already handled: an unknown crv raises JWT::JWKError, and invalid base64 raises JWT::Base64DecodeError.

The specs cover a mismatched curve and an off-curve point, both when using the key directly and when decoding with jwks:. Without the fix, the 4 new examples fail.

Out of scope: a private JWK whose d doesn't belong to its x/y is still accepted without an error. That's a separate consistency check, and I can file it as its own issue.

Checklist

Before the PR can be merged be sure the following are checked:

• There are tests for the fix or feature added/changed
• A description of the changes and a reference to the PR has been added to CHANGELOG.md. More details in the CONTRIBUTING.md

Posted by Claude on behalf of @anakinj.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the EC JWK error-handling change.

No open issues 🎉

What changed in this PR

Addresses #788 by making malformed EC JWK coordinates raise JWT::JWKError, allowing callers to handle these failures through the library’s error hierarchy.

Changes:

• Wraps OpenSSL point errors while preserving the original exception as the cause.
• Adds regression tests for mismatched curves and off-curve points through direct key use and JWKS-based decoding.
• Documents the fix in the changelog.

File	Description
spec/​jwt/​jwk/​ec_spec.rb	Tests malformed EC coordinates and error propagation.
lib/​jwt/​jwk/​ec.rb	Converts OpenSSL point errors to JWT::JWKError.
CHANGELOG.md	Records the error-handling fix and PR reference.

_{Review effort: Balanced}