sadpandajoe opened a new pull request, #45644: URL: https://github.com/apache/superset/pull/45644
### SUMMARY Guest-user handling for embedded dashboards should apply to every guest token, whatever value its `username` claim carries. `SupersetSecurityManager.is_guest_user()` used the current user's username as a presence check, so a guest whose username claim is an empty string was not recognized as a guest and skipped the guest-specific handling that depends on `is_guest_user()`. The dashboard screenshot dispatch had the same dependency and did not forward the guest token for such a guest. - `is_guest_user()` still evaluates the current user inside the existing `NoAuthorizationError` guard, but no longer consults its username; the user's guest marker decides, as it already does for the explicit-user form. - The dashboard screenshot dispatch resolves the guest with `get_current_guest_user_if_guest()` (the type-based check used elsewhere) and forwards its token, so the task renders as the guest. Non-guest, anonymous and unauthenticated behavior is unchanged. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A (backend only). ### TESTING INSTRUCTIONS ```bash pytest tests/unit_tests/security/guest_user_detection_test.py tests/unit_tests/dashboards/screenshot_guest_dispatch_test.py ``` The tests build the guest through the request loader from tokens with a non-empty and an empty username and assert identical handling for detection, dashboard access rules (security manager and UUID lookup), response field filtering, error sanitization and screenshot dispatch, plus controls showing a legitimately authorized guest is still allowed. The empty-username cases fail without the change. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: `EMBEDDED_SUPERSET` - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
