Whats Wrong with This Middleware?

[Qodestackr]

Code:

import NextAuth from "next-auth";
import authConfig from "./auth.config";

import {
   authPrefix,
   DEFAULT_LOGIN_REDIRECT,
   privateRouts,
   publicRouts,
} from "./routes";

const { auth } = NextAuth(authConfig);

export default auth((req) => {
   const { nextUrl } = req;
   const isLoggedIn = !!req.auth;

   const isApiAuthRoute = nextUrl.pathname.startsWith(authPrefix);
   const isPublicRoute = publicRouts.includes(nextUrl.pathname);
   const isAuthRoute = privateRouts.includes(nextUrl.pathname);

   if (isApiAuthRoute) {
      return null;
   }

   if (isAuthRoute) {
      if (isLoggedIn) {
         return Response.redirect(new URL(DEFAULT_LOGIN_REDIRECT, nextUrl));
      }
      return null;
   }

   if (!isLoggedIn && !isPublicRoute) {
      return Response.redirect(new URL("/auth/login", nextUrl));
   }

   return null;
});

export const config = {
   matcher: ["/((?!.*\\..*|_next).*)", "/", "/(api|trpc)(.*)"],
};

The Routes:

export const publicRouts = [
  "/",
  "/auth/new-verification",
  "/auth/reset-password",
  "/sign-petition",
  // "/create-petition", // TODO: This is a Private Route
];

export const privateRouts = [
  "/auth/login",
  "/auth/register",
  "/auth/error",
  "/auth/reset",
];

export const authPrefix = "/api/auth";

export const DEFAULT_LOGIN_REDIRECT = "/setting";

Context: I debugged too much. Code works in Local but fails in Vercel's builds. Deleting this and accessing sessions in pages worked.. But I wish I could still understand what was wrong.

This worked:

    const session = await auth()
    if (!session || session == null) {
        redirect('/auth/login')
    }

Any Guidelines on if middlewares are recommended and any practices to follow along?