#82687 SDK bootstrap auth fires GET /auth/sso even when isGuest: true

Describe the bug

When using @metabase/embedding-sdk-react (0.63.1) with MetabaseProvider configured for Guest mode (defineMetabaseAuthConfig({ metabaseInstanceUrl, isGuest: true })), an unexpected GET {instanceUrl}/auth/sso request fires on every page load, even though no SSO auth method is configured or intended. The server correctly responds with:

400 { "status": "error-sso-disabled", "message": "..." }

Root cause (found via source inspection)

frontend/src/embedding-sdk-bundle/bootstrap-auth.ts → startJwtAuth() starts the "early auth" bootstrap flow as soon as authConfig is available in the provider props store. Its bail-out condition only checks for apiKey or preferredAuthMethod === "saml":

function startJwtAuth(authConfig: any) {
  if (
    ("apiKey" in authConfig && authConfig.apiKey) ||
    authConfig.preferredAuthMethod === "saml"
  ) {
    setAuthState({ status: "skipped" });
    return;
  }
  // ... proceeds to performFullAuthFlow() -> connectToInstanceAuthSso() -> GET /auth/sso
}

There is no check for authConfig.isGuest, so the SSO discovery call fires unconditionally for guest embeds too.

Impact

Functionally harmless (guest embeds use initGuestEmbed, which never reads this early-fetched session), but it:

pollutes network logs / browser DevTools with a spurious 400 error
can trigger false alerts in server-side monitoring/logging for SSO failures
confuses developers debugging auth issues in Guest-only setups

To Reproduce

Steps to reproduce

Configure MetabaseProvider with authConfig = defineMetabaseAuthConfig({ metabaseInstanceUrl, isGuest: true })
Render a <StaticDashboard token={guestToken} /> inside it
Observe DevTools Network tab: GET /auth/sso fires with a 400 response (assuming SSO isn't configured server-side)

Expected behavior

startJwtAuth() should also bail out (set status "skipped") when authConfig.isGuest === true, since guest embeds have their own auth path (initGuestEmbed) and don't use this early-fetched SSO session at all.

Logs

No response

Information about your Metabase installation

{
  "browser-info": {
    "language": "fr-FR",
    "platform": "Win32",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36",
    "vendor": "Google Inc."
  },
  "metabase-info": {
    "databases": [
      "postgres"
    ],
    "run-mode": "prod",
    "plan-alias": "pro-self-hosted",
    "version": {
      "date": "2026-09-15",
      "tag": "v1.63.18",
      "hash": "2ba2485"
    },
    "settings": {
      "report-timezone": "Europe/Paris"
    },
    "hosting-env": "unknown",
    "application-database": "postgres",
    "application-database-details": {
      "database": {
        "name": "PostgreSQL",
        "version": "16.14"
      },
      "jdbc-driver": {
        "name": "PostgreSQL JDBC Driver",
        "version": "42.7.12"
      }
    }
  },
  "system-info": {
    "file.encoding": "UTF-8",
    "java.runtime.name": "OpenJDK Runtime Environment",
    "java.runtime.version": "25.0.4+7-LTS",
    "java.vendor": "Eclipse Adoptium",
    "java.vendor.url": "https://adoptium.net/",
    "java.version": "25.0.4",
    "java.vm.name": "OpenJDK 64-Bit Server VM",
    "java.vm.version": "25.0.4+7-LTS",
    "jvm.available-processors": 1,
    "jvm.max-memory": "3.9 GB",
    "os.name": "Linux",
    "os.version": "5.15.0-1121-azure",
    "system.total-memory": "4.0 GB",
    "user.language": "en",
    "user.timezone": "Europe/Paris"
  }
}

Severity

Minor

Additional context

No response