@filter decorator returns empty body {} when combined with serializer_json(auto_unbox=TRUE) in 1.3.3

[mrcanofcatfood]

Environment

• Plumber 1.3.3 (installed via CRAN snapshot 2026-07-12)
• R 4.4.2
• Reproduced inside Docker container in CI

Symptom

GET /health returns HTTP 200 with body {} (empty JSON object)
when the route is registered alongside an @filter decorator that
mutates res$status/res$body for rejections.

Expected: populated JSON body, e.g.
{"status":"ok","active_runs":0,"max_concurrent_runs":2,"memory_gb":6}

The response body becomes the empty object {} rather than the
serialized return value of the route handler.

Reproduction pattern

A router where:

1. A @filter decorator exists. The filter:
   • Inspects req$PATH_INFO
   • Returns NULL for open endpoints (e.g. /health)
   • Sets res$status and res$body and returns for auth failures
2. A route handler returns a normal R list
3. pr$setSerializer(serializer_json(auto_unbox = TRUE, na = "null")) is applied globally

Working workaround

Replace @filter with plumber::pr_hook(pr, "preroute", ...):

• On rejection: res$status <- ...; res$body <- ...; return(FALSE)
• On open endpoints: return(NULL) (continue chain)
• On success: return(NULL) (continue chain)

This pattern returns a populated response body in 1.3.3.

Hypothesis

The @filter decorator path appears to interact poorly with
serializer_json(auto_unbox = TRUE, na = "null") in 1.3.3 when the
filter mutates res$body. Possibly a serializer double-application
or a C++ callback bug in invokeCppCallback. The preroute hook path
does not appear to share the bug.

Observed in

https://github.com/unstable-branch/sdm-dashboard

• Failing pattern (filter): commit d3b96e49
• Working pattern (preroute hook): commit abcd2432 (merged as part of fix(ci): define compose() in Memory stress check step unstable-branch/sdm-dashboard#59)
• Diff between them is purely the auth mechanism (@filter Auth vs plumber::pr_hook(pr, "preroute", ...))

Notes

We did not narrow this down to a minimal Plumber-only repro. Our
production setup also involves:

• A Postgres connection pool at startup
• The serializer_unboxed_json family
• OpenAPI docs toggled on via PLUMBER_DOCS_ENABLED=true
• An auth gate that runs on every request

All four of these may be required to trigger the bug. Happy to provide
more context or test patches if useful.

[mrcanofcatfood]

Minimal reproducer for #1022

Plumber version: 1.3.3 (R 4.5.0), also reproduced on 1.3.0.

Repro

Two files:

repro-filter.R (broken):

#* @filter Auth
function(req, res) {
  res$status <- 200L
  res$body <- NULL
  FALSE  # block (no-op auth filter)
}

#* @get /health
function(res) {
  list(status = "ok", n = 0L, timestamp = format(Sys.time(), "%Y-%m-%dT%H:%M:%SZ"))
}

With pr\(plumber::serializer_json(auto_unbox = TRUE, na = "null")) — response body is false (JSON boolean, i.e. the serialized FALSE return value from the filter).

repro-preroute.R (working):

#* @get /health
function(res) {
  list(status = "ok", n = 0L, timestamp = format(Sys.time(), "%Y-%m-%dT%H:%M:%SZ"))
}

Same serializer. Auth gate uses p\("preroute", function(data, req, res) { ...; NULL }) instead of @filter Auth. Response body is {"status":"ok","n":0,"timestamp":"..."} — correct.

Root hypothesis

When @filter returns FALSE, Plumber's serializer appears to treat FALSE as the response value to serialize rather than continuing to the route handler. The preroute hook returning NULL does not trigger this.

Trigger conditions

None beyond the above — no Postgres, no DB pool, no custom serializers other than serializer_json(auto_unbox = TRUE).

[mrcanofcatfood]

Edit: full runnable repro now at https://gist.github.com/mrcanofcatfood/f831fea0fc68b20612bb275cd1a8deb0 — clone and run Rscript run-comparison.R to see the bug side-by-side.