Why do not allow call forbidden() also in middleware?


We need to ensure middleware can also handle non-authorization by rendering a page with forbidden status

Why just allow this in server components / server actions and routes? WHat about middleware?