Swagger is locked when using the checkAuth filter example from docs

[alexverse]

Describe the bug
When using the example for authentication the Swagger page is locked. Is this intentional, and is there a recommended way to enable docs while having authentication?

To Reproduce
Run this example taken from plumber documentation

library(plumber)

#* @apiTitle Plumber Example API
#* @apiDescription Plumber example description.
#* @filter setuser
function(req) {
  un <- req$cookies$user
  # Make req$username available to endpoints
  req$username <- un
  plumber::forward()
}

#* @filter checkAuth
function(req, res) {
  if (is.null(req$username)){
    res$status <- 401 # Unauthorized
    return(list(error="Authentication required"))
  } else {
    plumber::forward()
  }
}

#* Echo back the input
#* @param msg The message to echo
#* @get /echo
function(msg = "") {
    list(msg = paste0("The message is: '", msg, "'"))
}

When I visit /__docs__/ I get an error

Expected behavior
Swagger docs are rendered

Screenshots

Additional context

R version 4.3.1 (2023-06-16)
Platform: x86_64-pc-linux-gnu (64-bit)
Running under: Ubuntu 22.04.3 LTS

Matrix products: default
BLAS:   /usr/lib/x86_64-linux-gnu/openblas-pthread/libblas.so.3 
LAPACK: /usr/lib/x86_64-linux-gnu/openblas-pthread/libopenblasp-r0.3.20.so;  LAPACK version 3.10.0

locale:
 [1] LC_CTYPE=en_US.UTF-8       LC_NUMERIC=C               LC_TIME=en_US.UTF-8        LC_COLLATE=en_US.UTF-8     LC_MONETARY=en_US.UTF-8   
 [6] LC_MESSAGES=en_US.UTF-8    LC_PAPER=en_US.UTF-8       LC_NAME=C                  LC_ADDRESS=C               LC_TELEPHONE=C            
[11] LC_MEASUREMENT=en_US.UTF-8 LC_IDENTIFICATION=C       

time zone: Etc/UTC
tzcode source: system (glibc)

attached base packages:
[1] stats     graphics  grDevices utils     datasets  methods   base     

other attached packages:
[1] jsonlite_1.8.7   purrr_1.0.2      rlang_1.1.1      plumber_1.2.1    conflicted_1.2.0

loaded via a namespace (and not attached):
 [1] later_1.3.1       R6_2.5.1          httpuv_1.6.11     fastmap_1.1.1     swagger_3.33.1    magrittr_2.0.3    webutils_1.2.0    cachem_1.0.8     
 [9] memoise_2.0.1     lifecycle_1.0.3   promises_1.2.1    cli_3.6.1         vctrs_0.6.5       rsconnect_1.1.0   compiler_4.3.1    rstudioapi_0.15.0
[17] tools_4.3.1       ellipsis_0.3.2    Rcpp_1.0.11       stringi_1.7.12

[thomasp85]

The crude example you show hides everything behind an authentication, but that is due to the implementation of the checkAuth filter. In that filter you could check the path of the request and always allow (ie. call plumber::forward()) requests for __docs__/*