xpublish-api/src/main.py's auth_middleware (~line 233-241) calls request.state.identity = await resolve_identity(request) with no try/except, unlike api/src/main.py's auth_context_middleware which wraps the same call in try/except HTTPException (added in this same PR) specifically so auth failures return a proper JSON response through CORSMiddleware rather than propagating raw.
Impact: An invalid/expired token, JWKS fetch failure, or Keycloak connectivity issue hitting xpublish-api surfaces as an uncaught exception instead of a clean 401/503, and — because it bypasses the normal response path — never gets the Access-Control-Allow-Origin header, so the frontend sees an opaque CORS failure instead of a readable auth error.
Fix: Mirror the try/except HTTPException pattern already in api/src/main.py.
xpublish-api/src/main.py's auth_middleware (~line 233-241) calls request.state.identity = await resolve_identity(request) with no try/except, unlike api/src/main.py's auth_context_middleware which wraps the same call in try/except HTTPException (added in this same PR) specifically so auth failures return a proper JSON response through CORSMiddleware rather than propagating raw.
Impact: An invalid/expired token, JWKS fetch failure, or Keycloak connectivity issue hitting xpublish-api surfaces as an uncaught exception instead of a clean 401/503, and — because it bypasses the normal response path — never gets the Access-Control-Allow-Origin header, so the frontend sees an opaque CORS failure instead of a readable auth error.
Fix: Mirror the try/except HTTPException pattern already in api/src/main.py.