NextJS auth middleware and authorized callback clarification

What is the improvement or update you wish to see?

At no point does the documentation say that by using the auth method as a wrapper for your middleware, it no longer calls the authorized callback (see docs). In fact, it sort of insinuates that the opposite is true by saying 'You can also use the auth method as a wrapper if you’d like to implement more logic inside the middleware.'

This caught me out and I imagine it might catch many more people out.

I've checked the implementation and verified this is what's happening (see code).

Is there any context that might help us understand?

N/A

Does the docs page already exist? Please link to it.

https://authjs.dev/getting-started/session-management/protecting#nextjs-middleware

Start with the Next.js middleware section at the linked protecting-session documentation page, then read packages/next-auth/src/lib/index.ts around lines 241-279 to confirm the reported behavior. Update the page to distinguish the auth wrapper from the authorized callback, and verify that the resulting guidance matches the implementation.