Stop rebuilding the FAB app on every users and roles API call

[namanjain24-sudo]

The users, roles and permissions endpoints under /auth/fab/v1 wrapped every request in get_application_builder(), the helper written for the FAB CLI commands. It creates a new Flask app per call, so the @cache on _return_appbuilder never hits and keeps every app alive. Each request also re-runs init_appbuilder, which swaps the auth manager's appbuilder for the throwaway one and, with the default update_fab_perms, runs a full sync_roles().

These routes now use the auth manager's own Flask app through _get_flask_app(), the same way the login routes already do. The CLI helper is unchanged.

I ran a local airflow api-server (sqlite, one worker) and sent 400 authenticated GETs to users and roles, 8 at a time:

	before	after
p50 / p95 latency	506 / 878 ms	75 / 131 ms
API server RSS growth	+271 MiB	+6.6 MiB

Postgres 16 showed the same pattern. The fab unit tests pass on sqlite and Postgres 16, and the API server also behaves correctly on MySQL 8.

One behaviour change: sync_roles() no longer runs on every request, so a role created through the API without actions doesn't get can_read on Website until the next startup sync or airflow sync-perm. Roles created in the UI already work this way.

closes: #72937

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

Generated-by: a Gen-AI coding assistant, following the guidelines. I reviewed the change and ran the tests and the checks above locally.

[Vamsi-klu]

​

[namanjain24-sudo]

Thanks for the careful review, both points are addressed now.

• Added a note to providers/fab/docs/changelog.rst. One small correction on the scope: for a custom role, the per-request sync_roles() only ever added can_read on Website. I checked both sides. Before this change a role created with actions=[] had it after the next request. Now it gets it at startup or after airflow sync-perm. The note says exactly that.
• Added test_requests_reuse_the_auth_manager_flask_app for roles and users. It uses the real FabAuthManager app and DB, with only the user and the authorization check faked. It sends two requests and asserts that AirflowAppBuilder.init_app is never called and that flask_app/appbuilder stay the same. Against the old routes it fails with Expected 'init_app' to not have been called. Called 2 times.

I also rebased on latest main and reran everything there. The api_fastapi tests pass on sqlite and Postgres 16, the full fab unit suite passes, prek and mypy are clean, and the Website behaviour above holds on both the old and new routes.

[adrian-edbert]

Tested locally on my side and no longer have any issue, thanks

[namanjain24-sudo]

This has been approved and CI is green — would appreciate it if someone with merge access could merge this when they get a chance. Thanks!

---

Drafted-by: Claude Code (Sonnet 5); reviewed by @namanjain24-sudo before posting