fix(swagger): support URL prefix via APPLICATION_ROOT in OpenAPI and Swagger UI

[rsbhatti]

Description
This PR fixes #33304 by adding support for Superset deployments behind a URL prefix (e.g., when APPLICATION_ROOT or SUPERSET_APP_ROOT is set) in both the OpenAPI specification and the Swagger UI.

Motivation
Currently, when Superset is deployed behind a reverse proxy with a URL prefix, the Swagger UI breaks because it does not correctly generate the OpenAPI server URLs or locate the spec file using the prefix. This makes it impossible to use the Swagger-based API documentation in such environments.

Changes
Introduced a new SupersetOpenApi class to expose OpenAPI specs per version at /api//_openapi, dynamically resolving and registering API views.

Introduced a new SupsersetSwaggerView to render the Swagger UI HTML page with the correct openapi_uri, taking APPLICATION_ROOT into account.

Reused the existing Swagger HTML template (swagger.html), only modifying how it receives the OpenAPI URL.

Provided fallbacks to default behavior for backward compatibility (no prefix set).

Ensured compatibility with both prefixed and non-prefixed deployments.

How to Test
Set APPLICATION_ROOT = "/myprefix"

Visit /myprefix/swagger/v1 and confirm:

Swagger UI loads correctly

OpenAPI spec is loaded from /myprefix/api/v1/_openapi

"Try It Out" works for all endpoints

Related Issues
Fixes: #33304
Fixes #35464

[github-actions]

Congrats on making your first PR and thank you for contributing to Superset! 🎉 ❤️

We hope to see you in our Slack community too! Not signed up? Use our Slack App to self-register.

[korbit-ai]

Review by Korbit AI

Korbit automatically attempts to detect when you fix issues in new commits.

Category	Issue	Status
	Unsafe Use of Host Header in Server URL Construction ▹ view	🧠 Incorrect

Files scanned

​

File Path	Reviewed
superset/openapi/init.py	✅
superset/openapi/manager.py	✅
superset/initialization/init.py	✅
superset/config.py	✅

Explore our documentation to understand the languages and file types we support and the files we ignore.

Check out our docs on how you can make Korbit work best for you and your team.

Loving Korbit!? Share us on LinkedIn Reddit and X

[rusackas]

Hi @rsbhatti 👋

This PR has multiple CI failures (License Check, pre-commit, unit tests, database tests) and has been inactive for about 4 months. Converting to draft until resolved.

When you have time, please:

1. Run pre-commit run --all-files locally
2. Run tests to identify and fix the failures

If you're no longer able to work on this, let us know and we can close it or have someone else pick it up.

Thanks for your contribution!

[rsbhatti]

Okay, thanks for the update. I’ll look into the failures and work on resolving them.

[rusackas]

Thank you for this, @rsbhatti! 🙏 I've adopted it in #40908 (on the origin repo) with you credited as co-author. It keeps your approach and adds a few merge-readiness cleanups — retains the existing FAB_API_SWAGGER_UI flag, drops an unrelated AUTH_ROLE_PUBLIC edit, adds ASF headers + type hints + a unit test, and fixes the Supserset class-name typo. Closing this in favor of #40908; the fix for #33304 lives on there.