try
            {
                // Determine the static file path
                string? staticPath = null;
                if (context.Request.Path.StartsWithSegments("/vue") || context.Request.Path.StartsWithSegments("/2/vue"))
                {
                    staticPath = context.Request.Path.Value?.Replace("/2/vue", "/vue") ?? "/vue";
                }
                else
                {
                    // Check if it's a Vue app route that should map to index.html
                    var pathValue = context.Request.Path.Value;
                    foreach (var appName in vueAppNames)
                    {
                        if (string.Equals(pathValue, $"/{appName}", StringComparison.OrdinalIgnoreCase) ||
                            pathValue?.StartsWith($"/{appName}/", StringComparison.OrdinalIgnoreCase) == true)
                        {
                            staticPath = $"/vue/src/{appName}/index.html";
                            break;
                        }
                    }

                    // If no app match, map as asset file
                    if (staticPath == null)
                    {
                        staticPath = "/vue/src" + context.Request.Path;
                    }
                }

                var physicalPath = Path.Join(context.RequestServices.GetRequiredService<IWebHostEnvironment>().WebRootPath,
                    staticPath.TrimStart('/').Replace('/', Path.DirectorySeparatorChar));

                // Prevent directory traversal: ensure the resolved physical path is within WebRootPath
                var webRoot = context.RequestServices.GetRequiredService<IWebHostEnvironment>().WebRootPath;
                var resolvedPhysical = Path.GetFullPath(physicalPath);
                var resolvedWebRoot = Path.GetFullPath(webRoot);

                if (!resolvedPhysical.StartsWith(resolvedWebRoot, StringComparison.OrdinalIgnoreCase))
                {
                    // Do not serve files outside the web root
                    logger.LogWarning("Attempt to access file outside web root: {Path}", resolvedPhysical);
                }
                else if (File.Exists(resolvedPhysical))
                {
                    var contentType = GetContentType(Path.GetExtension(resolvedPhysical));
                    // Set content type if not already started
                    context.Response.ContentType = contentType ?? "application/octet-stream";
                    await context.Response.SendFileAsync(resolvedPhysical);
                    return;
                }
            }
            catch (Exception fileEx) when (fileEx is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException or IOException)
            {
                var safePath = context.Request.Path.ToString().Replace("\r", "").Replace("\n", "");
                logger.LogWarning(fileEx, "Failed to serve static file fallback for {Path}", safePath);
            }

                try
                {
                    // Use the registered HttpClient from dependency injection
                    var httpClientFactory = context.RequestServices.GetRequiredService<IHttpClientFactory>();
                    var httpClient = httpClientFactory.CreateClient("ViteProxy");

                    // Build the Vite server URL and try to proxy directly
                    var viteUrl = ViteProxyHelpers.BuildViteUrl(context.Request.Path, context.Request.QueryString, VueAppNames);
                    var requestMessage = ViteProxyHelpers.CreateProxyRequest(context, viteUrl);
                    using var response = await httpClient.SendAsync(requestMessage, HttpCompletionOption.ResponseHeadersRead, context.RequestAborted);

                    // Copy the response back to the client
                    await ViteProxyHelpers.CopyProxyResponse(context, response);
                    return; // Successfully proxied, don't continue to static files
                }
                catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
                {
                    var logger = context.RequestServices.GetRequiredService<ILogger<Program>>();
                    logger.LogDebug(ex, "Vite server not available, falling back to static files for {Path}",
                        Uri.EscapeDataString(context.Request.Path.Value ?? "unknown"));
                    // Fall through to static file serving
                }

        try
        {
            File.Delete(awsCredentialsFilePath);
        }
        catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
        {
            logger.Error(ex, $"COULD NOT DELETE THE AWS CREDENTIALS XML FILE (\"{awsCredentialsFilePath}\").  The file will need to be deleted manually.");
            logger.Error(ex, $"COULD NOT DELETE THE AWS CREDENTIALS XML FILE (\"{awsCredentialsFilePath}\").  The file will need to be deleted manually.");
        }

        catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
        {
            logger.Error(ex, $"COULD NOT DELETE THE AWS CREDENTIALS XML FILE (\"{awsCredentialsFilePath}\").  The file will need to be deleted manually.");
            logger.Error(ex, $"COULD NOT DELETE THE AWS CREDENTIALS XML FILE (\"{awsCredentialsFilePath}\").  The file will need to be deleted manually.");
        }

                    try
                    {
                        using HttpResponseMessage response = await _f5HttpRequest.Send(request);
                        RecordMessage(messages, "Response Status: " + response.StatusCode);
                        VmacsResponse vmacsResponse = await ParseResponse(response);
                        RecordMessage(messages, JsonSerializer.Serialize(vmacsResponse));
                    }
                    catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
                    {
                        HttpHelper.Logger.Log(LogLevel.Warn, ex);
                        RecordMessage(messages, "Error: " + ex.Message + " " + ex.StackTrace);
                        if (ex.InnerException != null)
                        {
                            RecordMessage(messages, "Error: " + ex.InnerException.Message + " " + ex.InnerException.StackTrace);
                        }
                    }

        private static async Task<VmacsResponse> ParseResponse(HttpResponseMessage response)
        {
            VmacsResponse? vmacsResponse;
            string responseBody = await response.Content.ReadAsStringAsync();
            try
            {
                vmacsResponse = JsonSerializer.Deserialize<VmacsResponse>(responseBody, new JsonSerializerOptions { PropertyNameCaseInsensitive = true });
                if (vmacsResponse == null)
                {
                    throw new InvalidOperationException("Failed to deserialize VMACS response.");
                }

                vmacsResponse.Success = response.IsSuccessStatusCode;
            }
            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
            {
                vmacsResponse = new()
                {
                    Success = false,
                    ErrorMessage = "Invalid response from VMACS: " + responseBody
                };
            }

            try
            {
                ActiveDirectoryService.GetGroups();
            }
            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
            {
                Logger logger = LogManager.GetCurrentClassLogger();
                logger.Error(ex);
            }

                }
                catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
                {
                    bool isProd = false;

                    if (HttpHelper.Environment != null)
                    {
                        isProd = HttpHelper.Environment.IsProduction();
                    }

                    // if were on the production system or the error is something other that RecordNotFoundException then log the error
                    // basically we don't want to be notified of RecordNotFound exception's except on production since users can be missing until the next db refresh
                    if (isProd || !(ex is RecordNotFoundException))
                    {
                        HttpHelper.Logger.Log(LogLevel.Error, ex, ex.Message);
                    }

                }

            try
            {
                AAUDContext? aaudContext = _aaudContext
                    ?? (AAUDContext?)HttpHelper.HttpContext?.RequestServices.GetService(typeof(AAUDContext));
                AaudUser? currentUser = GetByLoginId(aaudContext, HttpHelper.HttpContext?.User?.Identity?.Name);

                return currentUser;
            }
            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
            {
                HttpHelper.Logger.Error(ex);
                return null;
            }

                _logger.LogDebug("Retrieved {Count} rotations, filtered to {FilteredCount} based on permissions",
                    rotations.Count, filteredRotations.Count);
                return Ok(filteredRotations);
            }
            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
            {
                // Store context for ApiExceptionFilter to use in logging
                SetExceptionContext(new Dictionary<string, object>
                {
                    ["ServiceId"] = serviceId,
                    ["Operation"] = "RetrieveRotations"
                });
                throw; // Let ApiExceptionFilter handle the response
            }

                    LogSanitizer.SanitizeId(user.MothraId), serviceId, canEdit);

                return Ok(new { canEdit });
            }
            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
            {
                // Store context for ApiExceptionFilter to use in logging
                SetExceptionContext("ServiceId", serviceId);
                throw; // Let ApiExceptionFilter handle the response
            }
        }

                // All other cases (Admin, Manage, EditClnSchedules, rotation view, or service-specific permissions) see all clinicians
                return clinicians;
            }
            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
            {
                _logger.LogError(ex, "Error filtering clinicians by permissions. Returning unfiltered list.");
                return clinicians; // Return unfiltered list on error to avoid breaking functionality
            }

        public async Task<bool> IsServiceAvailableAsync()
        {
            try
            {
                // If using Mailpit in development, check if it's running
                if (_hostEnvironment.IsDevelopment() && _emailSettings.UseMailpit)
                {
                    return await IsMailpitAvailableAsync();
                }

                // For production, assume the SMTP server is available
                return true;
            }
            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
            {
                _logger.LogError(ex, "Error checking email service availability");
                return false;
            }

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@web/Areas/Computing/Services/BiorenderStudentLookup.cs`:
- Line 98: In BiorenderStudentLookup.cs replace the filtered catch "catch
(Exception ex) when (ex is FormatException or ArgumentException)" with two
explicit catches—first "catch (FormatException ex)" and then "catch
(ArgumentException ex)"—inside the same method in class BiorenderStudentLookup,
keeping the existing error handling logic for both; if both handlers share
identical code, factor shared behavior into a small private helper method to
avoid duplication and ensure the original logging/response behavior remains
unchanged.

In `@web/Areas/CTS/Controllers/CompetencyController.cs`:
- Around line 180-183: The catch block in CompetencyController's delete handler
currently returns a misleading message "Could not remove domain..." when
catching
DbUpdateException/SqlException/InvalidOperationException/OperationCanceledException;
update the return BadRequest(...) call in that catch block to reference the
correct entity (e.g., "Could not remove competency. It may be linked to other
objects.") or use the appropriate localized/message constant so clients and logs
correctly state "competency" instead of "domain".

In `@web/Areas/CTS/Controllers/EpaController.cs`:
- Around line 109-112: The catch block in EpaController.cs that catches
DbUpdateException/SqlException/InvalidOperationException/OperationCanceledException
should not return raw ex.Message to clients; instead log the full exception
server-side (e.g., using the controller's ILogger or existing logging helper)
and return a fixed, non-sensitive BadRequest or Problem response (e.g., "An
error occurred processing your request."). Update the catch in the action method
to call logger.LogError(ex, "...") with contextual information and replace
return BadRequest(ex.Message) with a generic error response message.

In `@web/Areas/RAPS/Controllers/AdGroupsController.cs`:
- Around line 117-120: In the AdGroupsController catch block (the catch
(Exception ex) when (...) that currently returns ValidationProblem(ex.Message)),
stop returning raw exception text to clients: log the full exception via the
controller's logger (e.g., _logger.LogError(ex, "Error creating/updating ad
group")) and replace ValidationProblem(ex.Message) with a generic client-safe
response such as ValidationProblem("An error occurred while processing the
request.") or a ValidationProblemDetails instance containing a non-sensitive
message; preserve the original exception only in server logs for diagnostics.

In `@web/Areas/RAPS/Controllers/RolesController.cs`:
- Around line 226-228: In RolesController's catch block (the catch (Exception
ex) when (...) handler) remove appending ex.InnerException?.Message from the
Problem(...) response so the API returns a generic error like "There was a
problem updating the database."; instead log the full exception server-side
(e.g., _logger.LogError(ex, "Error updating roles") or similar) and return only
the generic Problem(...) call using the existing ex variable and Problem(...)
method to avoid leaking internal details.

In `@web/Areas/RAPS/Services/OuGroupService.cs`:
- Line 49: In OuGroupService replace the filtered catch "catch (Exception ex)
when (ex is DbUpdateException or SqlException or InvalidOperationException or
OperationCanceledException)" with explicit typed catch blocks: add separate
catches for DbUpdateException, SqlException, InvalidOperationException, and
OperationCanceledException in the method where the current catch appears (inside
the OuGroupService class), handling/logging each type as currently done for ex,
and avoid a broad catch(Exception); if a fallback is required, keep it minimal
(log and rethrow) but prefer the specific handlers.

In `@web/Areas/RAPS/Services/VMACSExport.cs`:
- Line 171: The catch filter in ParseResponse around the
JsonSerializer.Deserialize call currently only handles DbUpdateException,
SqlException, InvalidOperationException, and OperationCanceledException; update
that filter to also include JsonException (and optionally NotSupportedException)
so malformed VMACS JSON will be caught and the method can return the fallback
VmacsResponse; locate the JsonSerializer.Deserialize usage and the catch with
the filter in VMACSExport.ParseResponse and add the additional exception types
to the "ex is ..." list.
- Line 136: The catch block around the call to _f5HttpRequest.Send(request) in
VMACSExport.cs currently filters exceptions but omits HttpRequestException;
update the exception filter on the catch (currently "catch (Exception ex) when
(ex is DbUpdateException or SqlException or InvalidOperationException or
OperationCanceledException)") to also include HttpRequestException so
network/DNS/TLS failures are handled by this block (keep
OperationCanceledException for timeouts/cancellation and leave the other
exception types unchanged).

In `@web/Classes/SitemapMiddleware.cs`:
- Around line 90-93: The current catch in SitemapMiddleware that only catches
DbUpdateException/SqlException/InvalidOperationException/OperationCanceledException
prevents other sitemap-generation failures from falling through to
_next(context); change the handler to catch all exceptions at this middleware
boundary (e.g., catch(Exception ex)) so any runtime/reflection/type-loading
failures also await _next(context) and preserve fallback behavior; update the
catch block around the sitemap generation code (where the existing catch is
declared) and optionally add minimal logging inside the broad catch before
calling await _next(context).

In `@web/Classes/UserHelper.cs`:
- Line 275: Replace the filtered broad catch "catch (Exception ex) when (ex is
DbUpdateException or SqlException or InvalidOperationException or
OperationCanceledException)" used in the helper methods with explicit typed
catch blocks: add separate catches for DbUpdateException, SqlException,
InvalidOperationException, and OperationCanceledException (preserving the
exception variable name if used) and handle/log/rethrow each appropriately as
the original code intended; do this for every occurrence of that filtered catch
in UserHelper.cs (the three helper method catch sites) so each exception type is
caught explicitly rather than using a filtered Exception catch.

In `@web/Classes/Utilities/ActiveDirectoryService.cs`:
- Line 224: The catch filters in AddUserToGroup and RemoveUserFromGroup are
using DB/SQL exception types which are irrelevant to the
System.DirectoryServices.AccountManagement/LDAP operations; update the exception
filter to catch AD/LDAP-specific exceptions (e.g., PrincipalOperationException,
DirectoryServicesCOMException, LdapException and general
InvalidOperationException/OperationCanceledException if appropriate) and remove
DbUpdateException and SqlException so AD errors are correctly caught and
logged/handled by those methods.

In `@web/Classes/Utilities/F5HttpRequest.cs`:
- Around line 27-30: The retry catch currently filters
DbUpdateException/SqlException/InvalidOperationException which are irrelevant
for HttpClient; change the filter in the F5HttpRequest retry block so transport
failures trigger HandleConnectionFail by catching HttpRequestException and
keeping OperationCanceledException (to preserve timeout/cancellation behavior)
instead of the DB/SQL exception types — i.e., update the catch expression that
calls HandleConnectionFail(request, attemptNumber) to check for
HttpRequestException or OperationCanceledException.

In `@web/Classes/Utilities/IamApi.cs`:
- Around line 403-406: The exception filter in ParseResponse<T> currently
catches DbUpdateException, SqlException, InvalidOperationException, and
OperationCanceledException but misses JsonException and NotSupportedException so
JSON deserialize failures escape; update the catch in ParseResponse<T> to
include JsonException and NotSupportedException (or replace the filter with a
broader Exception catch for deserialize errors) and ensure the handler sets
r.ErrorMessage = "Invalid response: " + ex.Message + "." so
malformed/unsupported IAM payloads are converted into the error result.

In `@web/Program.cs`:
- Around line 90-93: The catch block that wraps
builder.Configuration.AddSystemsManager(...) is too narrow and lets non-matching
AWS/network exceptions escape; update the catch on the try surrounding
builder.Configuration.AddSystemsManager to either remove the restrictive
exception filter (catch Exception ex) or explicitly include
Amazon.Runtime.AmazonServiceException, Amazon.Runtime.AmazonClientException,
System.Net.Http.HttpRequestException and
TaskCanceledException/OperationCanceledException in the filter, then call
logger.Fatal(ex, "Failed to get secrets from AWS") as before and handle/rethrow
as appropriate; locate the catch block that currently references
DbUpdateException/SqlException and replace the filter with the recommended
exception types or a plain catch to ensure AWS/config/network errors are logged
and handled.

---

Outside diff comments:
In `@web/Areas/ClinicalScheduler/Controllers/CliniciansController.cs`:
- Around line 579-583: The catch block that currently catches
DbUpdateException/SqlException/InvalidOperationException/OperationCanceledException
and calls _logger.LogError(...) must not fail open by returning the unfiltered
variable clinicians; change the behavior to return an empty collection (e.g.,
Enumerable.Empty<Clinician>() or new List<Clinician>()) or rethrow the exception
instead of returning clinicians to avoid exposing unfiltered data—update the
catch clause in the CliniciansController method containing the catch (Exception
ex) when (...) block and keep the _logger.LogError call but replace return
clinicians with a safe empty-list return (or throw) as appropriate for your
error-handling policy.

In `@web/Classes/ClaimsTransformer.cs`:
- Around line 95-107: The current catch in ClaimsTransformer narrows Exception
to
DbUpdateException/SqlException/InvalidOperationException/OperationCanceledException
which prevents the existing RecordNotFoundException handling from running; add
an explicit catch (RecordNotFoundException) block (before the broader catches)
in the method that contains this try/catch so RecordNotFoundException is handled
locally as intended (or restore the original broader catch ordering), then keep
the existing production-check/logging logic in the other catch blocks (the block
referencing HttpHelper.Environment and the isProd check) to ensure
RecordNotFoundException no longer bubbles out of the role-assignment flow.

In `@web/Program.cs`:
- Around line 454-460: The catch block guarding the HttpClient.SendAsync
fallback is too narrow and misses common network errors (e.g.,
HttpRequestException/IOException), so update the catch around the
HttpClient.SendAsync call (the existing catch handling and logging using logger
from context.RequestServices.GetRequiredService<ILogger<Program>> and the
message "Vite server not available, falling back to static files for {Path}") to
also catch HttpRequestException and IOException (and/or related network
exceptions like SocketException) — or replace the filtered exception clause with
a broader network-aware catch — then log the exception the same way and fall
through to static file serving as before.
- Around line 586-590: The catch filter currently only checks for
DB/SQL/InvalidOperation/OperationCanceled exceptions but the
File.Delete(awsCredentialsFilePath) call can throw filesystem-related
exceptions; update the when-clause on the catch for the File.Delete block to
match filesystem exception types (e.g., IOException,
UnauthorizedAccessException, PathTooLongException, NotSupportedException and
SecurityException) so those failures are caught and logged by the existing
logger.Error calls; locate the catch surrounding File.Delete in Program.cs (the
catch with variable ex) and replace the type checks in the when clause
accordingly (also remove the duplicate logger.Error if still present).

In `@web/Services/EmailService.cs`:
- Around line 224-228: IsServiceAvailableAsync's outer filtered catch is
ineffective because IsMailpitAvailableAsync currently swallows all exceptions;
update IsMailpitAvailableAsync to only catch specific exception types (e.g.,
HttpRequestException, TaskCanceledException/OperationCanceledException,
SocketException or other transport/network exceptions you expect) and log the
exception with _logger.LogError/LogWarning before returning false, and then
remove or narrow the outer catch in IsServiceAvailableAsync (the catch
(Exception ex) when (...) block) so it no longer tries to handle
broad/irrelevant exceptions—this ensures network/transport failures from
IsMailpitAvailableAsync surface properly and are logged.

In `@web/ViteProxyHelpers.cs`:
- Around line 372-376: The catch filter in ViteProxyHelpers (the catch(Exception
fileEx) when (...) block) excludes critical filesystem/security exceptions so
the static-file fallback can be skipped; update the exception filter to also
include UnauthorizedAccessException, System.Security.SecurityException,
NotSupportedException (and optionally PathTooLongException) so those exceptions
are handled the same way, keeping the existing safePath sanitization and
logger.LogWarning(fileEx, "Failed to serve static file fallback for {Path}",
safePath) call; ensure you reference the same local variable fileEx and preserve
the surrounding logic in the method where the catch block appears.
- Around line 289-296: Update the exception filters in ViteProxyHelpers: in the
header copy catch (the catch block handling headerEx used when setting response
headers) remove DbUpdateException and SqlException and instead catch
header-relevant errors such as ArgumentException and FormatException plus the
existing InvalidOperationException, OperationCanceledException and IOException
so header-setting failures are always logged; similarly update the static-file
fallback catch (the catch around SendFileAsync/path resolution) to remove
DbUpdateException and SqlException and include filesystem/access exceptions like
FileNotFoundException, DirectoryNotFoundException, PathTooLongException,
UnauthorizedAccessException, ArgumentException and FormatException in addition
to IOException/InvalidOperationException so file/path errors are properly
handled and logged.

                    // Build the Vite server URL and try to proxy directly
                    var viteUrl = ViteProxyHelpers.BuildViteUrl(context.Request.Path, context.Request.QueryString, VueAppNames);
                    var requestMessage = ViteProxyHelpers.CreateProxyRequest(context, viteUrl);
                    using var response = await httpClient.SendAsync(requestMessage, HttpCompletionOption.ResponseHeadersRead, context.RequestAborted);

                    // Copy the response back to the client
                    await ViteProxyHelpers.CopyProxyResponse(context, response);
                    return; // Successfully proxied, don't continue to static files
                }
                catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
                {
                    var logger = context.RequestServices.GetRequiredService<ILogger<Program>>();
                    logger.LogDebug(ex, "Vite server not available, falling back to static files for {Path}",
                        Uri.EscapeDataString(context.Request.Path.Value ?? "unknown"));
                    // Fall through to static file serving
                }

        try
        {
            File.Delete(awsCredentialsFilePath);
        }
        catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
        {
            logger.Error(ex, $"COULD NOT DELETE THE AWS CREDENTIALS XML FILE (\"{awsCredentialsFilePath}\").  The file will need to be deleted manually.");
            logger.Error(ex, $"COULD NOT DELETE THE AWS CREDENTIALS XML FILE (\"{awsCredentialsFilePath}\").  The file will need to be deleted manually.");
        }

            try
            {
                // If using Mailpit in development, check if it's running
                if (_hostEnvironment.IsDevelopment() && _emailSettings.UseMailpit)
                {
                    return await IsMailpitAvailableAsync();
                }

                // For production, assume the SMTP server is available
                return true;
            }
            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
            {
                _logger.LogError(ex, "Error checking email service availability");
                return false;
            }

                catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
                {
                    HttpHelper.Logger.Error(ex);
                    return null;
                }

            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
            {
                HttpHelper.Logger.Error(ex);
                return null;
            }

            catch (Exception ex) when (ex is DbUpdateException or SqlException or InvalidOperationException or OperationCanceledException)
            {
                HttpHelper.Logger.Error(ex);
                return null;
            }

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@web/Areas/ClinicalScheduler/Controllers/CliniciansController.cs`:
- Around line 579-582: The permission helper methods currently only catch
DbUpdateException/SqlException/InvalidOperationException so non-DB failures from
GetCurrentUser(), GetRequiredService<RAPSContext>(), or HasPermission(...)
surface as 500s and break the intended fail-open/fail-closed contract; update
the helpers to catch all exceptions (catch Exception) and return the original
fallback values (e.g., return clinicians or return false) so
permission-resolution errors preserve the existing behavior, or alternatively
move the broad try/catch to the controller action boundary
(GetClinicians/GetClinicianSchedule) to preserve the contract — apply the same
change to both occurrences around the blocks referencing GetCurrentUser(),
GetRequiredService<RAPSContext>(), and HasPermission(...).

In `@web/Classes/Utilities/ActiveDirectoryService.cs`:
- Around line 222-225: Replace the filtered catch of a broad Exception with
explicit typed catches in the service/business logic: remove constructs like
"catch (Exception ex) when (ex is PrincipalException or
System.DirectoryServices.DirectoryServicesCOMException)" and add separate catch
blocks "catch (PrincipalException ex) { HttpHelper.Logger.Error(ex); }" and
"catch (System.DirectoryServices.DirectoryServicesCOMException ex) {
HttpHelper.Logger.Error(ex); }" (apply the same change in
ActiveDirectoryService.cs, F5HttpRequest.cs, IamApi.cs, and EmailService.cs),
ensure the appropriate namespaces are imported (e.g., System.DirectoryServices,
System.DirectoryServices.AccountManagement) and do not leave a broad
catch(Exception) in these non-boundary layers so other unexpected exceptions can
propagate.

In `@web/Program.cs`:
- Around line 473-475: The log is currently writing request-derived values
(e.g., context.Request.Path/queries/derived target URLs) using
Uri.EscapeDataString/HtmlEncode/newline-stripping which still allows
client-controlled data into logs; update the call sites in Program.cs
(viteLogger.LogDebug) and ViteProxyHelpers.cs to sanitize any request-originated
strings with LogSanitizer (e.g., LogSanitizer.SanitizeString or SanitizeId as
appropriate) before logging, and avoid logging raw query strings or full derived
target URLs—either omit them or log a sanitized/placeholder value instead.
Ensure you call the sanitizer on the specific variables passed into
LogDebug/LogInformation and do not log context.Request.QueryString or generated
target URL directly.

---

Outside diff comments:
In `@web/Areas/Computing/Services/BiorenderStudentLookup.cs`:
- Around line 24-49: The loop currently calls throttler.WaitAsync() before
validating emails, causing permits to leak when IsValidEmail(emailTrimmed) is
false and no Release() is called; move the semaphore acquisition so it only
occurs for valid emails (i.e., perform emailTrimmed/IsValidEmail(emailTrimmed)
checks first), then call throttler.WaitAsync() immediately before creating the
Task.Run that invokes GetSingleStudent(emailTrimmed) and ensure
throttler.Release() remains in the Task's finally block (or alternatively, if
you prefer keeping WaitAsync() early, add an explicit throttler.Release() on the
invalid-email branch before continuing); update references around
throttler.WaitAsync, IsValidEmail, GetSingleStudent, and resultList accordingly.

In `@web/Classes/ClaimsTransformer.cs`:
- Around line 95-109: In ClaimsTransformer.TransformAsync and in
UserHelper.GetByLoginId, GetCurrentUser, and GetTrueCurrentUser remove
OperationCanceledException from the exception filters so cancellations are not
swallowed; specifically, update the catch expressions (e.g., the "catch
(Exception ex) when (ex is DbUpdateException or SqlException or
InvalidOperationException or OperationCanceledException)" in ClaimsTransformer)
to exclude OperationCanceledException, and ensure cancellation exceptions are
allowed to propagate (either by not catching them or by rethrowing them
immediately) rather than logging and returning null.

In `@web/ViteProxyHelpers.cs`:
- Around line 348-370: The path normalization (Path.GetFullPath) can throw
ArgumentException, NotSupportedException, or PathTooLongException for
malformed/oversized request paths, but the current catch only handles
IO/Unauthorized/InvalidOperation; expand the exception filter on the catch
(currently "when (fileEx is IOException or UnauthorizedAccessException or
InvalidOperationException)") to also include ArgumentException,
NotSupportedException, and PathTooLongException so those errors are handled by
the static-file fallback (or alternatively validate/normalize the incoming
staticPath before constructing physicalPath); refer to the physicalPath,
resolvedPhysical, and the catch block surrounding Path.GetFullPath to locate the
change.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@web/Areas/ClinicalScheduler/Controllers/CliniciansController.cs`:
- Around line 579-582: The permission helper methods currently only catch
DbUpdateException/SqlException/InvalidOperationException so non-DB failures from
GetCurrentUser(), GetRequiredService<RAPSContext>(), or HasPermission(...)
surface as 500s and break the intended fail-open/fail-closed contract; update
the helpers to catch all exceptions (catch Exception) and return the original
fallback values (e.g., return clinicians or return false) so
permission-resolution errors preserve the existing behavior, or alternatively
move the broad try/catch to the controller action boundary
(GetClinicians/GetClinicianSchedule) to preserve the contract — apply the same
change to both occurrences around the blocks referencing GetCurrentUser(),
GetRequiredService<RAPSContext>(), and HasPermission(...).

In `@web/Classes/Utilities/ActiveDirectoryService.cs`:
- Around line 222-225: Replace the filtered catch of a broad Exception with
explicit typed catches in the service/business logic: remove constructs like
"catch (Exception ex) when (ex is PrincipalException or
System.DirectoryServices.DirectoryServicesCOMException)" and add separate catch
blocks "catch (PrincipalException ex) { HttpHelper.Logger.Error(ex); }" and
"catch (System.DirectoryServices.DirectoryServicesCOMException ex) {
HttpHelper.Logger.Error(ex); }" (apply the same change in
ActiveDirectoryService.cs, F5HttpRequest.cs, IamApi.cs, and EmailService.cs),
ensure the appropriate namespaces are imported (e.g., System.DirectoryServices,
System.DirectoryServices.AccountManagement) and do not leave a broad
catch(Exception) in these non-boundary layers so other unexpected exceptions can
propagate.

In `@web/Program.cs`:
- Around line 473-475: The log is currently writing request-derived values
(e.g., context.Request.Path/queries/derived target URLs) using
Uri.EscapeDataString/HtmlEncode/newline-stripping which still allows
client-controlled data into logs; update the call sites in Program.cs
(viteLogger.LogDebug) and ViteProxyHelpers.cs to sanitize any request-originated
strings with LogSanitizer (e.g., LogSanitizer.SanitizeString or SanitizeId as
appropriate) before logging, and avoid logging raw query strings or full derived
target URLs—either omit them or log a sanitized/placeholder value instead.
Ensure you call the sanitizer on the specific variables passed into
LogDebug/LogInformation and do not log context.Request.QueryString or generated
target URL directly.

---

Outside diff comments:
In `@web/Areas/Computing/Services/BiorenderStudentLookup.cs`:
- Around line 24-49: The loop currently calls throttler.WaitAsync() before
validating emails, causing permits to leak when IsValidEmail(emailTrimmed) is
false and no Release() is called; move the semaphore acquisition so it only
occurs for valid emails (i.e., perform emailTrimmed/IsValidEmail(emailTrimmed)
checks first), then call throttler.WaitAsync() immediately before creating the
Task.Run that invokes GetSingleStudent(emailTrimmed) and ensure
throttler.Release() remains in the Task's finally block (or alternatively, if
you prefer keeping WaitAsync() early, add an explicit throttler.Release() on the
invalid-email branch before continuing); update references around
throttler.WaitAsync, IsValidEmail, GetSingleStudent, and resultList accordingly.

In `@web/Classes/ClaimsTransformer.cs`:
- Around line 95-109: In ClaimsTransformer.TransformAsync and in
UserHelper.GetByLoginId, GetCurrentUser, and GetTrueCurrentUser remove
OperationCanceledException from the exception filters so cancellations are not
swallowed; specifically, update the catch expressions (e.g., the "catch
(Exception ex) when (ex is DbUpdateException or SqlException or
InvalidOperationException or OperationCanceledException)" in ClaimsTransformer)
to exclude OperationCanceledException, and ensure cancellation exceptions are
allowed to propagate (either by not catching them or by rethrowing them
immediately) rather than logging and returning null.

In `@web/ViteProxyHelpers.cs`:
- Around line 348-370: The path normalization (Path.GetFullPath) can throw
ArgumentException, NotSupportedException, or PathTooLongException for
malformed/oversized request paths, but the current catch only handles
IO/Unauthorized/InvalidOperation; expand the exception filter on the catch
(currently "when (fileEx is IOException or UnauthorizedAccessException or
InvalidOperationException)") to also include ArgumentException,
NotSupportedException, and PathTooLongException so those errors are handled by
the static-file fallback (or alternatively validate/normalize the incoming
staticPath before constructing physicalPath); refer to the physicalPath,
resolvedPhysical, and the catch block surrounding Path.GetFullPath to locate the
change.

                    catch (Exception ex) when (ex is HttpRequestException or InvalidOperationException or TaskCanceledException)
                    {
                        HttpHelper.Logger.Log(LogLevel.Warn, ex);
                        RecordMessage(messages, "Error: " + ex.Message + " " + ex.StackTrace);
                        if (ex.InnerException != null)

                catch (JsonException)
                {
                    return new VmacsResponse
                    {
                        ErrorMessage = "Could not parse response from VMACS: " + finalMessage,