Just trying to figure out a few things here:

From what I understand Auth.js v5 (ex NextAuth.js) suggests placing the auth logic inside middleware.ts with a big disclaimer that it can’t access any databases from there since tcp sockets, filesystems etc may not be available on edge.

So far so good I’d say but it looks like that inside auth.config.ts (which runs everywhere) any user can define a callbacks property under the authConfig object which takes a function called authorized which is then passed the session (auth object) and the request.

How on earth is this possible since it’s running on edge? When are most importantly where are these callbacks invoked?