fix(dashboard-auth): skip auto-SSO redirect for password-only providers

[divinely4125]

Summary

_auto_sso_response() in hermes_cli/dashboard_auth/middleware.py auto-redirects unauthenticated HTML navigations to /auth/login?provider=<name> when exactly one interactive provider is registered. This is an optimization for the OAuth (Nous Portal) case — it skips the /login interstitial click.

Bug: When the sole registered provider is password-only (e.g. BasicAuthProvider with supports_password = True), the redirect hits /auth/login → p.start_login() → NotImplementedError:

NotImplementedError: BasicAuthProvider is password-only; there is no OAuth redirect flow.
The login page POSTs to /auth/password-login instead.

This produces an Internal Server Error on every unauthenticated dashboard load when basic auth is the only provider — the user never sees the login form.

Fix

Skip the auto-SSO redirect when the single provider has supports_password = True. Falls through to _unauth_response() → the /login interstitial, which renders the credential form and POSTs to /auth/password-login as designed.

Reproduction

1. Configure dashboard.basic_auth (username + password_hash) in config.yaml with no OAuth provider
2. Start dashboard on a non-loopback host: hermes dashboard --host 0.0.0.0 --port 9119
3. Visit the dashboard URL → 500 Internal Server Error

Test plan

• Dashboard with only BasicAuthProvider configured loads the /login interstitial form
• Dashboard with only OAuth provider still auto-redirects to OAuth (no regression)
• Dashboard with 2+ providers still shows /login chooser (no regression)

[alt-glitch]

This was generated by AI during triage.

Duplicate of #54887 — same one-line supports_password guard in _auto_sso_response (hermes_cli/dashboard_auth/middleware.py), fixing the 500 crash introduced by merged #54846 when the dashboard binds a non-loopback host with only a password-only BasicAuthProvider. #54887 (by @sjfkai) is the earliest still-open version of this fix (and is itself a resubmission of the closed #54884). Maintainers: pick one of the three.

[teknium1]

Thanks for the focused fix. This is an automated hermes-sweeper review; current main already implements and tests this exact behavior.

• 3e24b16f566045399012bc1185fe0cdb6e1a1be9 added the supports_password guard in hermes_cli/dashboard_auth/middleware.py:190.
• tests/hermes_cli/test_dashboard_auth_password_login.py:201 verifies that the sole password provider reaches /login and renders the /auth/password-login form.
• The earlier duplicate discussion on fix(dashboard-auth): skip auto-SSO redirect for password-only providers #54887 also records that the same guard was superseded by the merged dashboard-auth work.

Closing as implemented on main.