fix(dashboard-auth): skip auto-SSO for password-only provider (500 on login)

[VignanTej]

Problem

With dashboard.basic_auth configured as the only auth provider and the dashboard bound to a non-loopback host (--host 0.0.0.0), every HTML navigation to a protected path returns 500 Internal Server Error and the login form never renders.

Fixes #57211.

Root cause

_auto_sso_response in hermes_cli/dashboard_auth/middleware.py fires whenever exactly one interactive provider is registered, and unconditionally 302-redirects to /auth/login?provider=basic. That route (routes.py) calls provider.start_login(), but BasicAuthProvider.start_login() (plugins/dashboard_auth/basic/__init__.py) raises NotImplementedError — it is password-only and has no OAuth redirect flow. NotImplementedError is not a ProviderError, so it escapes uncaught → 500.

Auto-SSO is documented as being for "the portal OAuth redirect", so it should never target a password provider.

Fix

Skip auto-SSO when the sole provider is password-based (supports_password), so the /login interstitial renders its credential form instead:

provider = providers[0]
if getattr(provider, "supports_password", False):
    return None

After this, an unauthenticated HTML load lands on /login (200, credential form) instead of 500ing.

Test

Adds test_single_password_provider_renders_login_not_auto_sso to TestAutoSsoRedirect, asserting a single supports_password provider redirects to /login rather than /auth/login. Full file passes:

tests/hermes_cli/test_dashboard_auth_401_reauth.py (45 passed)

Reproduction (before fix)

1. Configure dashboard.basic_auth (username + password_hash) as the only provider.
2. hermes dashboard --host 0.0.0.0 --port 9119
3. curl -sL http://localhost:9119/ → Internal Server Error (500).

[alt-glitch]

This was generated by AI during triage.
Duplicate of #54887 — same supports_password early-return guard in the same _auto_sso_response function. This is the 6th identical fix in the dashboard-500 cluster (canonical fix PR #54887; issue anchor #55130). Maintainer to pick one.

[teknium1]

Thanks for the focused reproduction and regression test. This is already implemented on current main by automated hermes-sweeper review.

• Commit 3e24b16f566045399012bc1185fe0cdb6e1a1be9 implements the same supports_password early return in hermes_cli/dashboard_auth/middleware.py:212, so password-only providers fall through to /login rather than auto-SSO.
• The same commit additionally protects direct/stale OAuth-entry requests in hermes_cli/dashboard_auth/routes.py:195-202, redirecting password providers to /login before start_login() can run.
• Regression coverage in tests/hermes_cli/test_dashboard_auth_password_login.py:201-217 verifies both the protected-page redirect and direct /auth/login?provider=testpw behavior.
• This matches the duplicate analysis previously noted for fix(dashboard-auth): skip auto-SSO redirect for password-only providers #54887.