Guest users (embedded dashboards via guest tokens) have is_anonymous=False but no database identity (user_id is None). The existing code path for authenticated users queries the assoc_user_role table by user_id, which returns nothing for guests. This caused all datasource_access, database_access, and schema_access permissions on the guest role to be invisible, breaking features like chart-based annotation layers that rely on ChartDAO.find_by_id (which applies a datasource access filter via ChartFilter).

Fix: detect guest users before the authenticated user path and resolve permissions directly from the roles attached to the guest token.

SUMMARY

user_view_menu_names() in SupersetSecurityManager was broken for guest users (embedded dashboards via guest tokens). Guest users have is_anonymous=False but no database identity (user_id is None). The authenticated user code path queries the assoc_user_role table by user_id, which produces WHERE user_id IS NULL — matching nothing.

This caused all role-based permissions (datasource_access, database_access, schema_access) to be invisible to guest users, even when correctly assigned to the guest role. Any code path using user_view_menu_names() was affected, most notably ChartFilter (via get_dataset_access_filters), which broke chart-based annotation layers on embedded dashboards with a misleading
"Chart not found" error.

Fix: Add a guest user check before the authenticated user path that resolves permissions directly from the roles attached to the guest token, using the same pattern as the existing anonymous user path.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Before: Charts with annotation layers on embedded dashboards fail with:
Chart with ID (referenced by annotation layer '') was not found.
Please verify that the chart exists and is accessible.

After: Annotation layers load correctly because ChartDAO.find_by_id() can now see the guest role's datasource permissions through ChartFilter.

TESTING INSTRUCTIONS

1. Create a chart (Chart A) backed by a datasource
2. Create a second chart (Chart B) that uses Chart A as an annotation layer source (sourceType "line" or "table")
3. Add Chart B to a dashboard and enable embedding
4. Assign datasource_access for Chart A's datasource to the Public role (or whichever role is configured via GUEST_ROLE_NAME)
5. Access the embedded dashboard via guest token
6. Verify Chart B loads with its annotation layer rendered correctly

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API