Fix FAB Security page links losing the /auth prefix behind a subpath proxy

[Dhruv-kys]

FAB's Security pages generated Add/Edit/Show links without the /auth blueprint
prefix when Airflow runs behind a reverse proxy on a URL subpath.

closes: #70389

Problem

With [fab] enable_proxy_fix = True and the proxy sending X-Forwarded-Prefix,
links on /auth/roles/list/ and /auth/users/list/ point at
/<subpath>/roles/add instead of /<subpath>/auth/roles/add. The broken link
resolves to the React SPA shell, which has no client-side route for
roles/users and redirects to the Dashboard — so the buttons appear to do
nothing, with no visible error.

Cause

The Flask app is mounted at / inside a FastAPI sub-app
(fab_auth_manager.py:256), which is itself mounted at /auth
(api_fastapi/app.py:206), so Starlette passes SCRIPT_NAME=/auth into the WSGI
environ. Werkzeug's ProxyFix then assigns X-Forwarded-Prefix to
SCRIPT_NAME rather than prepending to it:

if x_prefix:
    environ["SCRIPT_NAME"] = x_prefix

That discards the mount path. Since url_for builds every URL as
SCRIPT_NAME + rule, all FAB-generated links lose /auth. The list pages
themselves keep the prefix because those URLs come from the React shell's
configuration rather than from url_for, which is why the bug looks selective.

Fix

Wrap ProxyFix in a pair of small WSGI middlewares: the outer one stashes the
mount path and clears SCRIPT_NAME so ProxyFix sees an empty slot, and the
inner one appends the mount path back once the forwarded prefix has been
applied. The result is always forwarded_prefix + mount_path.

An earlier approach re-appended the mount path only when SCRIPT_NAME differed
from its original value. That is wrong when the proxy subpath happens to equal
the mount path (X-Forwarded-Prefix: /auth): the two values match, the guard
skips, and the prefix is silently dropped. The stash/restore pair needs no such
comparison; that case is covered by the
subpath-proxy-prefix-matching-mount-path test.

Testing

New providers/fab/tests/unit/fab/www/extensions/test_init_wsgi_middlewares.py
covers mounted/unmounted x forwarded-prefix/no-prefix, the equal-prefix edge
case, and proxy-fix disabled. Two cases fail without the fix
(mounted-behind-subpath-proxy and subpath-proxy-prefix-matching-mount-path);
the other four pass either way and act as controls against a fix that
over-applies the prefix.

uv run --project providers/fab pytest providers/fab/tests/unit/fab/www/
# 67 passed

uv run --project airflow-core pytest airflow-core/tests/unit/always/test_project_structure.py
# 10 passed, 1 xfailed

This also removes the module from the OVERLOOKED_TESTS allow-list in
airflow-core/tests/unit/always/test_project_structure.py, which the project is
driving to zero.

---

Was generative AI tooling used to co-author this PR?

• Yes — Claude Code (Opus 5)

Generated-by: Claude Code (Opus 5) following the guidelines

[boring-cyborg]

Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide
Here are some useful points:

• Pay attention to the quality of your code (ruff, mypy and type annotations). Our prek-hooks will help you with that.
• In case of a new feature add useful documentation (in docstrings or in docs/ directory). Adding a new operator? Check this short guide Consider adding an example Dag that shows how users should use it.
• Consider using Breeze environment for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
• Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
• Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
• Be sure to read the Airflow Coding style.
• Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
  Apache Airflow is a community-driven project and together we are making it better 🚀.
  In case of doubts contact the developers at:
  Mailing List: dev@airflow.apache.org
  Slack: https://s.apache.org/airflow-slack