Bump flask-appbuilder to 5.2.1 and mirror new auth event hooks

Upstream FAB 5.2.1 was released to PyPI on 2026-04-09 (no GitHub release
was cut, only a master commit `5dae8164` titled "release: 5.2.1"). It
adds three vendored-relevant items on top of 5.2.0:

  - PR #2450 (commit 63e7708e) — three new no-op hook methods on
    BaseSecurityManager: on_user_login, on_user_login_failed,
    on_user_logout. update_user_auth_stat now calls on_user_login or
    on_user_login_failed at the end. AuthView.logout / SAML SLO call
    on_user_logout. Hook defaults are no-ops; subclasses can override
    for audit logging.
  - PR #2451 — _is_user_detached / _get_safe_user helpers + a rewrite
    of has_access to handle DetachedInstanceError on g.user (LocalProxy
    or detached ORM instance after some session boundary). Inherited
    automatically; not vendored in override.py so no mirror needed.
  - PR #2440 — security log redactions: OAuth tokens / responses no
    longer logged at debug level. Inherited; the redacted code paths
    are not vendored in override.py.

Mirror the auth-event-hook pieces into FabAirflowSecurityManagerOverride
since update_user_auth_stat is vendored. Without this mirror, the new
hooks would not fire in Airflow because override.py shadows the upstream
implementation.

Specifically:

  - Add no-op on_user_login / on_user_login_failed / on_user_logout
    methods on FabAirflowSecurityManagerOverride mirroring the FAB
    defaults.
  - Append the on_user_login / on_user_login_failed dispatch at the
    end of FabAirflowSecurityManagerOverride.update_user_auth_stat,
    matching the upstream order (called after update_user, so the
    counters / last_login are already persisted before the hook runs).

Bump EXPECTED_FAB_VERSION in test_fab_alignment.py to 5.2.1; all 7
alignment tests + 39 security_manager unit tests pass locally with
flask-appbuilder==5.2.1 installed.

The pyjwt floor pin from the parent commit on this branch is unchanged;
the lock-file bump for it is included here because uv re-resolved the
graph for the FAB version bump.

Author: potiuk

providers/fab/docs/index.rst

@@ -111,7 +111,7 @@ PIP package                                 Version required
 ``apache-airflow-providers-common-compat``  ``>=1.12.0``
 ``blinker``                                 ``>=1.6.2``
 ``flask``                                   ``>=2.2.1``
-``flask-appbuilder``                        ``==5.2.0``
+``flask-appbuilder``                        ``==5.2.1``
 ``pyjwt``                                   ``>=2.11.0``
 ``flask-login``                             ``>=0.6.2; python_version < "3.14"``
 ``flask-login``                             ``>=0.6.3; python_version >= "3.14"``

providers/fab/pyproject.toml

@@ -77,7 +77,7 @@ dependencies = [
     # Every time we update FAB version here, please make sure that you review the classes and models in
     # `airflow/providers/fab/auth_manager/security_manager/override.py` with their upstream counterparts.
     # In particular, make sure any breaking changes, for example any new methods, are accounted for.
-    "flask-appbuilder==5.2.0",  # Whenever updating the version, run test_fab_alignment.py to verify.
+    "flask-appbuilder==5.2.1",  # Whenever updating the version, run test_fab_alignment.py to verify.
     # Transitive via flask-appbuilder -> flask-jwt-extended; pinned here so the FAB
     # provider keeps installing cleanly when paired with older airflow-core releases
     # (the compat-3.0.6 matrix job) whose own pyjwt floor predates `jwt.types.Options`

providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py

@@ -1544,6 +1544,36 @@ def del_register_user(self, register_user) -> bool:
     def get_all_users(self) -> list[User]:
         return self.session.scalars(select(self.user_model)).all()
 
+    def on_user_login(self, user) -> None:
+        """
+        Run after a successful user login.
+
+        Override to add custom logic (e.g. audit logging). Mirrors
+        ``BaseSecurityManager.on_user_login`` from FAB 5.2.1+.
+
+        :param user: The authenticated user model.
+        """
+
+    def on_user_login_failed(self, user) -> None:
+        """
+        Run after a failed user login attempt.
+
+        Override to add custom logic (e.g. audit logging). Mirrors
+        ``BaseSecurityManager.on_user_login_failed`` from FAB 5.2.1+.
+
+        :param user: The identified (but not authenticated) user model.
+        """
+
+    def on_user_logout(self, user) -> None:
+        """
+        Run when a user logs out.
+
+        Override to add custom logic (e.g. audit logging). Mirrors
+        ``BaseSecurityManager.on_user_logout`` from FAB 5.2.1+.
+
+        :param user: The user model that is logging out.
+        """
+
     def update_user_auth_stat(self, user, success=True) -> None:
         """
         Update user authentication stats.
@@ -1569,6 +1599,13 @@ def update_user_auth_stat(self, user, success=True) -> None:
         else:
             user.fail_login_count += 1
         self.update_user(user)
+        # Fire the auth event hooks added in FAB 5.2.1 (PR #2450) so subclasses
+        # can plug in audit logging / custom side effects without having to
+        # override update_user_auth_stat itself.
+        if success:
+            self.on_user_login(user)
+        else:
+            self.on_user_login_failed(user)
 
     """
     -------------

providers/fab/tests/unit/fab/auth_manager/security_manager/test_fab_alignment.py

@@ -40,7 +40,7 @@
 from airflow.providers.fab.auth_manager.security_manager.override import FabAirflowSecurityManagerOverride
 
 # The FAB version that override.py was last aligned with.
-EXPECTED_FAB_VERSION = "5.2.0"
+EXPECTED_FAB_VERSION = "5.2.1"
 
 # FAB public methods that override.py intentionally does NOT implement.
 # Every entry must have a comment explaining why it's excluded.