Get ctx.state in middleware before next()

In the content API I just want to sanitize some query fields globally, based on userrole, before data is fetched. So middleware should do the trick.

But I don’t get the userrole because ctx.state is not set before I call “await next()”.
Seems like the order inside middleware.js is not relevant for this.

Any idea why ctx.state is not set here? Maybe I can call permissions plugin middleware earlier?

Or is there an other way of globally sanitizing fields before they are fetched?

Thanks for your help!

module.exports = (config, { strapi }) => {
  return async (ctx, next) => {

    console.log(ctx.state) // empty Object
    await next();
    // Here data is fetched already...