fix(dashboard-auth): skip auto-SSO redirect for password-only providers

hermes_cli/dashboard_auth/middleware.py

@@ -182,9 +182,16 @@ def _auto_sso_response(request: Request) -> Response | None:
         # Zero → nothing to redirect to. Two+ → user must choose at /login.
         return None
 
-    from hermes_cli.dashboard_auth.prefix import prefix_from_request
-
     provider = providers[0]
+    # A password-only provider (e.g. basic auth) cannot participate in the
+    # OAuth redirect flow — ``start_login`` raises NotImplementedError.
+    # Skip the auto-redirect so the /login page renders the password form
+    # (which POSTs to /auth/password-login) instead of bouncing the user
+    # to a 500.
+    if provider.supports_password:
+        return None
+
+    from hermes_cli.dashboard_auth.prefix import prefix_from_request
     prefix = prefix_from_request(request)
     next_param = _safe_next_target(request)
     from urllib.parse import quote

tests/hermes_cli/test_dashboard_auth_401_reauth.py

@@ -406,6 +406,26 @@ class _SecondStub(StubAuthProvider):
         assert r.headers["location"].startswith("/login")
         assert "/auth/login" not in r.headers["location"]
 
+    def test_password_provider_skips_auto_sso(self, gated_app):
+        """A password-only provider must NOT be auto-redirected to the OAuth
+        initiation route (/auth/login) — basic auth cannot participate in the
+        OAuth redirect flow and ``start_login`` raises NotImplementedError.
+        Instead, the middleware should fall through to the /login interstitial
+        which renders the password form (POSTing to /auth/password-login)."""
+        from hermes_cli.dashboard_auth import clear_providers, register_provider
+
+        class _PasswordStub(StubAuthProvider):
+            name = "password-stub"
+            display_name = "Password Stub"
+            supports_password = True
+
+        clear_providers()
+        register_provider(_PasswordStub())
+        r = gated_app.get("/sessions", follow_redirects=False)
+        # Must NOT redirect to /auth/login (the OAuth route) — that would 500.
+        assert r.headers["location"].startswith("/login")
+        assert "/auth/login" not in r.headers["location"]
+
 
 # ---------------------------------------------------------------------------
 # Gate middleware: same-origin next= validation