fix: dashboard preview thumbnails fail for guest API calls during screenshot

[Neeraaaj]

Before:-

After:-

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[greptile-apps]

Confidence Score: 4/5

The preview-key permission path needs a fix before merging.

• A valid screenshot key is not scoped to the dashboard being captured.
• Guest API calls can reuse that key while it remains in the cache or cookie.
• The frontend fallback and screenshot soft-failure changes do not show another blocking issue.

insights/api/shared.py

Security Review

The preview key is accepted from request state without being tied to a specific dashboard, so a valid key can temporarily authorize Guest access outside the intended preview target.

Important Files Changed

Filename	Overview
frontend/src2/dashboard/DashboardCard.vue	Adds local image error state and resets it when the preview URL changes.
insights/api/shared.py	Expands preview-key lookup to query params and cookies, but the validation remains unscoped.
insights/insights/doctype/insights_dashboard_v3/insights_dashboard_v3.py	Uses the preview key for Guest dashboard API access and soft-fails screenshot generation.
insights/www/insights.py	Sets a temporary preview-key cookie so the Guest SPA can call APIs during screenshot capture.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
insights/api/shared.py:58-64
**Preview Key Becomes Global**

When a screenshot key is present in the query string or cookie, this check only verifies that the cache entry exists. Since generated keys store only `True`, the same key can make Guest requests pass `is_public()` and `get_distinct_column_values()` for unrelated private dashboards until the key is deleted or expires.

_{Reviews (1): Last reviewed commit: "fix: dashboard preview thumbnails fail f..." | Re-trigger Greptile}

[greptile-apps]

Preview Key Becomes Global

When a screenshot key is present in the query string or cookie, this check only verifies that the cache entry exists. Since generated keys store only True, the same key can make Guest requests pass is_public() and get_distinct_column_values() for unrelated private dashboards until the key is deleted or expires.

Context Used: This is a Frappe Framework application (Python bac... (source)

Prompt To Fix With AI

This is a comment left during a code review.
Path: insights/api/shared.py
Line: 58-64

Comment:
**Preview Key Becomes Global**

When a screenshot key is present in the query string or cookie, this check only verifies that the cache entry exists. Since generated keys store only `True`, the same key can make Guest requests pass `is_public()` and `get_distinct_column_values()` for unrelated private dashboards until the key is deleted or expires.

**Context Used:** This is a Frappe Framework application (Python bac... ([source](https://app.greptile.com/review/custom-context?memory=instruction-0))

How can I resolve this? If you propose a fix, please make it concise.