def get_user_roles(self, user) -> List[object]:
        """
        Get current user roles, if user is not authenticated returns the public role
        """
        if not user.is_authenticated:
            return [self.get_public_role()]
        return user.roles + [role for group in user.groups for role in group.roles]

        Get current user roles, if user is not authenticated returns the public role
        
flask_appbuilder/security/manager.py