fix(json): preserve empty arrays across decode + re-encode

[AlinsRan]

Problem

The shared cjson instance in utils.lua decoded JSON without the array metatable, so an empty array ([]) lost its array identity across a decode + re-encode cycle and was re-encoded as an object ({}):

{"items":[]}  ->  decode -> encode  ->  {"items":{}}

This regressed OIDC userinfo claims with empty arrays (e.g. groups, roles), silently turning them into objects and breaking downstream systems that expect arrays.

Fix

Enable decode_array_with_array_mt(true) on the cjson instance at creation so decoded arrays keep their metatable and round-trip as []. Encode and decode share the instance, so the option is set wherever it is created first.

Adds a regression test in spec/01-utils_spec.lua.

Upstream: bungle#207

Summary by CodeRabbit

• Bug Fixes

  • Improved JSON handling so empty arrays stay as [] after a decode/encode round trip instead of changing to {}.
  • Preserved array structure in nested JSON values, helping responses remain consistent.

• Tests

  • Added coverage for JSON round-tripping to verify empty arrays are kept intact.

[coderabbitai]

📝 Walkthrough

Walkthrough

The shared cjson.safe instance in encode_json and decode_json is configured with decode_array_with_array_mt(true) during lazy initialization, ensuring empty arrays are preserved as JSON arrays rather than converted to objects during encode/decode round-trips. A corresponding test case was added.

Changes

Empty Array Preservation

Layer / File(s)	Summary
Enable array metatable decoding lib/resty/session/utils.lua	Both encode_json and decode_json now call decode_array_with_array_mt(true) on the shared cjson.safe instance during lazy initialization.
Round-trip test for empty arrays spec/01-utils_spec.lua	Adds a test verifying that {"items":[]} remains {"items":[]} after decode then encode.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
E2e Test Quality Review	⚠️ Warning	The new test is a unit test for utils.encode_json/decode_json, not an end-to-end flow, so it doesn’t meet the E2E requirement.	Add an integration/E2E case that exercises the session/userinfo path with real dependencies and asserts empty arrays survive the full round-trip.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Security Check	✅ Passed	No security-relevant changes: patch only tweaks JSON array metatable handling and adds a round-trip test; no logs, auth, DB, TLS, or secret handling touched.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: preserving empty JSON arrays through decode and re-encode.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/json-empty-array-array-mt

---

_{Comment @coderabbitai help to get the list of available commands.}