[SIP-17] Proposal for using new FAB REST API

[dpgaspar]

Motivation

Take advantage of the new FAB REST API feature available since version 1.13.0. The previous
API endpoints available inside ModelView did not follow a strict RESTful convention, and will be removed in 2 to 3 minors. The following are some improvements:

• API resource protection using JWT and/or flask-login signed cookies (current authentication method). API defaults to JWT only.
• Optional CRUD RESTful API using similar class overrides as ModelViews
• Delegate base API support like handling exceptions to FAB.
• Leverage Rison style URI arguments out of the box with optional JSON schema validation
• OpenAPI automatic spec generation for CRUD, and easy generation for BaseApi method endpoints

Docs: https://flask-appbuilder.readthedocs.io/en/latest/rest_api.html

Proposed Change

I propose migrating current views.Api class to BaseApi. So Superset will have it's new API properly anchored on /api/v1/<resource>/ and start using FAB's new feature.

• The endpoint /api/v1/query does not need to change it's route or HTTP method.

• The endpoint /api/v1/form_data/ would be changed to /api/v1/slice/ using ModelRestApi on readonly mode (can_get, can_info only permissions).

New or Changed Public Interfaces

This SIP affects the following API endpoints:

• /api/v1/form_data GET -> /api/v1/slice GET: exposing a get item and get list leveraging complex filters, pagination, internationalization, ordering, custom select columns (all the way to the database)

Optional Swagger UI for OpenAPI spec visualization.

New dependencies

New dependencies were added to FAB 1.13.0:

• marshmallow
• marshmallow_enum
• marshmallow-sqlalchemy
• Flask-JWT-Extended
• prison
• apispec[yaml]

Migration Plan and Compatibility

A side by side migration plan can be achieved. Since the new API endpoint is exposed on a different route. Access to the old endpoint would log a deprecation log message.

Rejected Alternatives

[DiggidyDave]

This is great. I think the deprecation migration plan is a requirement. (wasn't sure about the language "can be achieved" so just making sure)

[dpgaspar]

I've submitted #7482, but needs FAB>2.1. This PR has no breaking changes.

For the deprecation of the old REST API attached on the ModelView's, I'll be submitting code to replace them. Currently Superset's setup.py is pinned under the deprecation version.
But I would say that this is a different problem outside the context of this SIP.

[rusackas]

@dpgaspar Should this SIP go up for a VOTE?

[villebro]

I believe this can be closed as it's effectively implemented.

[dpgaspar]

Yes, this is implemented