What runs before withSupabase in an MCP pipeline?

If an MCP client calls your Supabase function, which checks run before withSupabase({ auth: 'user' }), and which run after it? The Supabase changelog for @supabase/middleware 1.0 (30 September 2026) a