Bug: AppSync Events swallows UnauthorizedException in non-aggregate handlers, class-based async middleware leaks a coroutine, HttpResolverLocal is not usable as a Lambda handler #8582

Expected Behaviour

• AppSync Events: raising UnauthorizedException in a publish handler fails the invocation so the publisher gets 401/403, as the docs say, regardless of aggregate.
• A class-based middleware with async def handler works in resolve_async(), as the docs say.
• HttpResolverLocal works as a Lambda handler (handler = app) and accepts binary request bodies.

Current Behaviour

1. AppSync Events swallows UnauthorizedException in non-aggregate handlers (events_appsync/appsync_events.py:257 sync, :316 async with gather(return_exceptions=True)). The documented example working_with_authorization_control.py uses the default aggregate=False. Against a real AppSync Events API:

   aggregate=False: HTTP 200 {"failed":[{"code":"CustomError","message":"UnauthorizedException - not allowed"}, ...],"successful":[]}
   aggregate=True:  HTTP 401 {"errors":[{"errorType":"UnauthorizedException","message":"Not authorized to access channel agg"}]}
   

   Events are not delivered in either case, so it is not a bypass, but the status is wrong and the internal exception message reaches the publisher.
2. Class-based async middleware leaks a coroutine (middlewares/async_utils.py:158). The __call__ wrapper is sync, so iscoroutinefunction is False, it runs in a thread and the returned coroutine is treated as the body: TypeError: Object of type coroutine is not JSON serializable. Also wrap_middleware_async (line 101) raises IndexError when a sync middleware short-circuits.
3. HttpResolverLocal as Lambda handler (http_resolver.py:348, 270, 72). handler = app from the docs example raises TypeError (__call__ is ASGI only); app.resolve() with an HTTP API or Function URL event raises KeyError: 'httpMethod'; a binary body through ASGI raises UnicodeDecodeError.

Code snippet

import asyncio
from aws_lambda_powertools.event_handler import APIGatewayRestResolver, AppSyncEventsResolver, HttpResolver
from aws_lambda_powertools.event_handler.events_appsync.exceptions import UnauthorizedException
from aws_lambda_powertools.event_handler.middlewares import BaseMiddlewareHandler
from tests.functional.utils import load_event

events = AppSyncEventsResolver()
@events.on_publish("/default/*")
def deny(payload): raise UnauthorizedException("nope")
print(events.resolve(load_event("appSyncEventsEvent.json"), None))
# {"events": [{"id": "1", "error": "UnauthorizedException - nope"}, ...]}  (expected: exception propagates)

class Mw(BaseMiddlewareHandler):
    async def handler(self, app, nxt): return await nxt(app)
app = APIGatewayRestResolver()
@app.get("/my/path", middlewares=[Mw()])
async def h(): return {"ok": True}
asyncio.run(app.resolve_async(load_event("apiGatewayProxyEvent.json"), None))
# TypeError: Object of type coroutine is not JSON serializable

local = HttpResolver()
@local.get("/my/path")
def p(): return {"ok": True}
local(load_event("apiGatewayProxyEvent.json"), None)      # TypeError: missing 'send'
local.resolve(load_event("apiGatewayProxyV2Event.json"), None)  # KeyError: 'httpMethod'

Possible Solution

Re-raise UnauthorizedException before the generic except in the per-event loop and after gather in the async path. In AsyncMiddlewareFrame.__call__, detect iscoroutinefunction(getattr(mw, "handler", None)) and await coroutine results; return the held result in wrap_middleware_async. Make HttpResolverLocal.__call__ dispatch on scope["type"] vs (event, context), fall back to the parent event mapping, and base64-encode non-UTF-8 bodies.

Steps to Reproduce

Run the snippet above with the tests/events fixtures. Full context in #8576.

Powertools for AWS Lambda (Python) version

latest

AWS Lambda function runtime

3.13

Packaging format used

PyPi

Debugging logs