Generate fab permission table

[baha-bouali]

What

The FAB permission table in providers/fab/docs/auth-manager/access-control.rst is
maintained by hand and has drifted. This generates it from the route definitions instead,
and adds a prek hook so it stays in sync.

#67606 already did this for the core table. This does the same for FAB's, which needs
FAB-specific permission names and the minimum-role column.

The drift

The hand-written table has 57 rows; the API exposes 143.

• /pools GET says Op, but VIEWER_PERMISSIONS grants it to Viewer.
• /eventLogs GET omits the base DAGs.can_read requirement that is actually enforced.
• Stale paths and verbs, e.g. clearTaskInstances listed as PUT when the route is POST.
• Around 90 endpoints are undocumented.

How

scripts/ci/prek/fab_permissions_doc.py reuses extract_permissions.py's parser and
renders the FAB view from the same entries. It reads FAB's own resource maps and role
definitions rather than restating them, and runs statically via ast — no Airflow import
needed.

The table is written in place between markers, following check_integrations_list.py.

Verification

$ python scripts/ci/prek/fab_permissions_doc.py --check
[OK] .../access-control.rst is up to date.

$ sed -i '82s/method="GET"/method="POST"/' \
    airflow-core/src/airflow/api_fastapi/core_api/routes/public/pools.py
$ python scripts/ci/prek/fab_permissions_doc.py --check
[FAIL] .../access-control.rst is stale.

$ git checkout airflow-core/src/airflow/api_fastapi/core_api/routes/public/pools.py
$ python scripts/ci/prek/fab_permissions_doc.py --check
[OK] .../access-control.rst is up to date.

Regenerate with prek run generate-fab-permissions-doc --all-files.

Closes #43430

[github-actions]

Backport failed to create: v3-3-test. View the failure log Run details

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
❌	v3-3-test

You can attempt to backport this manually by running:

cherry_picker 3e93c77 v3-3-test

This should apply the commit to the v3-3-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.

After you have resolved the conflicts, you can continue the backport process by running:

cherry_picker --continue

If you don't have cherry-picker installed, see the installation guide.