Close the session after the FAB permissions collection read

[bingqin2]

GET /auth/fab/v1/permissions still runs its two queries through security_manager.session, the thread-local scoped session, without ending the transaction. The route is a sync FastAPI handler, so it runs on a threadpool thread, and the Session.remove() that cleanup_session_middleware issues on the event-loop thread never reaches that session. On PostgreSQL the backend stays idle in transaction after the 200 response, which is the leak #72362 describes for the users and roles collections. #72578 fixed those two; this applies the same create_session(scoped=False) block to the permissions collection, the last collection handler in the FAB FastAPI services that read through the scoped session.

Changes

• providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/services/roles.py: FABAuthManagerRoles.get_permissions runs inside create_session(scoped=False), like get_roles and get_users
• providers/fab/tests/unit/fab/auth_manager/api_fastapi/services/test_roles.py: the five get_permissions tests patch create_session and assert the session is entered once and exited, including on the 400 path

Testing

• providers/fab: tests/unit/fab/auth_manager/api_fastapi/services/test_roles.py and tests/unit/fab/auth_manager/api_fastapi/routes/test_roles.py (54 tests)
• mypy on the changed module, prek hooks on the changed files (no route or datamodel changes, so the FAB OpenAPI spec is unchanged)

closes: #72362

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

Generated-by: Claude Code (Claude Fable 5.1) following the guidelines. I reviewed and understand all changes; the tests were run locally as listed above.

---

🤖 Generated with Claude Code