The FastAPI API server's bearer-token auth raised 401 for anonymous
users even when AUTH_ROLE_PUBLIC was set, because the gate only honored
Flask's webserver_config.py and the FastAPI stack had no equivalent.

This adds a new [fab] auth_role_public Airflow config, surfaced via a
new BaseAuthManager.get_public_user() hook. FabAuthManager populates an
AnonymousUser with the public role's permissions pre-expanded so it works
outside a Flask request context. The legacy AUTH_ROLE_PUBLIC setting in
webserver_config.py keeps working via a startup-time bridge that copies
[fab] auth_role_public into Flask's config.

Closes apache#60897

Co-Authored-By: Claude <noreply@anthropic.com>

Per @vincbeck's review, replace the BaseAuthManager.get_public_user()
method with a middleware approach mirroring SimpleAllAdminMiddleware.

- Add generic BaseAuthManager.get_fastapi_middlewares() extension hook
  that auth managers override to register their own middlewares.
- New FabAuthRolePublicMiddleware attaches an AnonymousUser to
  request.state.user for unauthenticated requests when [fab]
  auth_role_public is configured. The FastAPI get_user dependency
  short-circuits on request.state.user, so no JWT minting is needed.
- Revert security.py to upstream behavior (401 on missing token).
- Rename FabAuthManager.get_public_user -> build_public_user and mark
  as :meta private: since it's an implementation detail consumed only
  by the middleware.

Addresses apache#65685 (comment)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…iring

Follow-up review from @vincbeck on PR apache#65685. Shrinks the diff and aligns
the FAB public-access path with the simple auth manager's patterns.

- ``FabAuthManager.build_public_user`` no longer opens a Flask app
  context or uses ``self.flask_app``. It resolves the public role via a
  SQLAlchemy session (``@provide_session``), eager-loaded joined
  permissions, and writes ``_roles``/``_perms`` directly on the
  ``AnonymousUser``. No Flask context is created in the auth manager.
- ``FabAuthManager._get_auth_role_public`` reads only the Flask app
  config. The ``providers/fab/www/app.py`` bridge already copies
  ``[fab] auth_role_public`` into ``AUTH_ROLE_PUBLIC`` at app creation,
  so there's a single source of truth and no duplicate ``conf.get``.
- ``SimpleAuthManager`` now overrides ``get_fastapi_middlewares`` to
  register ``SimpleAllAdminMiddleware`` when
  ``[core] simple_auth_manager_all_admins`` is set. The hardcoded
  registration in ``init_middlewares`` is removed so all auth managers
  go through the same generic hook.
- Revert the ``webserver-authentication.rst`` expansion; the existing
  ``AUTH_ROLE_PUBLIC`` paragraph is enough and the new config key is
  documented via ``provider.yaml``.
- Drop the 65685 newsfragment per maintainer feedback.

Tests updated to match the new behavior (Flask config is the single
source of truth read by the auth manager) and extended with two new
tests for ``SimpleAuthManager.get_fastapi_middlewares``.

Co-Authored-By: Claude <noreply@anthropic.com>

Per @vincbeck's review nit: airflow-core documentation should not
mention a specific provider auth manager. Rephrase the docstring
example to describe the behavior generically (public access) rather
than naming FAB.

Addresses apache#65685 (comment)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CI mypy caught two issues on the middleware refactor:

1. core_api/app.py:174 — ``add_middleware`` expects
   ``_MiddlewareFactory[[KwArg(Any)]]`` not bare ``type``. Narrow
   ``get_fastapi_middlewares`` return type on BaseAuthManager (and the
   FAB/simple overrides) to use Starlette's ``_MiddlewareFactory``
   protocol.

2. FAB middleware.py:44 — ``get_auth_manager()`` is typed
   ``BaseAuthManager[Any]``, so mypy cannot resolve
   ``build_public_user`` (FAB-specific). Cast to ``FabAuthManager``
   inside ``dispatch`` since this middleware is only registered by
   FabAuthManager.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>