fix(dashboard): skip auto-SSO redirect for password-only providers

hermes_cli/dashboard_auth/middleware.py

@@ -185,6 +185,13 @@ def _auto_sso_response(request: Request) -> Response | None:
     from hermes_cli.dashboard_auth.prefix import prefix_from_request
 
     provider = providers[0]
+
+    # Password-only providers (e.g. BasicAuthProvider) don't support OAuth
+    # redirect — /auth/login would crash with NotImplementedError.  Let the
+    # /login page render the password form instead.
+    if getattr(provider, "supports_password", False):
+        return None
+
     prefix = prefix_from_request(request)
     next_param = _safe_next_target(request)
     from urllib.parse import quote

tests/hermes_cli/test_dashboard_auth_middleware.py

@@ -117,6 +117,37 @@ def test_gated_html_redirects_to_login(gated_app):
     assert r.headers["location"].startswith("/auth/login?provider=stub")
 
 
+def test_password_only_provider_skips_auto_sso(gated_app):
+    """A password-only provider (basic) must NOT trigger auto-SSO redirect
+    to /auth/login — it should fall through to /login which renders the
+    password form.  Regression for #56130.
+    """
+    import secrets
+
+    import plugins.dashboard_auth.basic as basic_mod
+
+    clear_providers()
+    register_provider(
+        basic_mod.BasicAuthProvider(
+            username="admin",
+            password_hash=basic_mod.hash_password("pw"),
+            secret=secrets.token_bytes(32),
+        )
+    )
+    try:
+        r = gated_app.get("/", follow_redirects=False)
+        # Should redirect to /login (the password form), not /auth/login
+        assert r.status_code == 302
+        location = r.headers.get("location", "")
+        assert "/auth/login" not in location, (
+            f"password-only provider should not auto-SSO to {location}"
+        )
+        assert "/login" in location
+    finally:
+        clear_providers()
+        register_provider(StubAuthProvider())
+
+
 def test_gated_auth_providers_is_public(gated_app):
     r = gated_app.get("/api/auth/providers")
     assert r.status_code == 200