@Override
  public Response toResponse(Throwable exception) {

    debugLog(exception);

    if (exception instanceof WebApplicationException w) {
      var res = w.getResponse();
      if (res.getStatus() >= 500) {
        log(w);
      }
      return res;
    }

    if (exception instanceof AuthenticationException) {
      return Response.status(Status.UNAUTHORIZED).build();
    }

    if (exception instanceof ValidationException ve) {
      if (ve.seeOther() != null) {
        return Response.seeOther(ve.seeOther()).build();
      }

      return buildContentNegotiatedErrorResponse(ve.localizedMessage(), Status.BAD_REQUEST);
    }

    // the remaining exceptions are unexpected, let's log them
    log(exception);

    if (exception instanceof FederationException fe) {
      var errorMessage = new Message(FEDERATION_ERROR_MESSAGE, fe.reason().name());
      return buildContentNegotiatedErrorResponse(errorMessage, Status.INTERNAL_SERVER_ERROR);
    }

    var status = Status.INTERNAL_SERVER_ERROR;

    var errorMessage = new Message(SERVER_ERROR_MESSAGE, (String) null);
    return buildContentNegotiatedErrorResponse(errorMessage, status);
  }
@Test
  void toResponse_propagateWebApplicationException_forbidden() {

    when(uriInfo.getRequestUri()).thenReturn(REQUEST_URI);

    var status = 500;
    var ex = new ServerErrorException(status);

    // when
    var res = mapper.toResponse(ex);

    // then
    assertEquals(status, res.getStatus());
  }