From 9bcc0558d79119ef2d6f41172457e57ca092cc83 Mon Sep 17 00:00:00 2001 From: Cliff Sch Date: Thu, 2 Jul 2026 23:20:13 +0000 Subject: [PATCH] fix(dashboard-auth): skip OAuth redirect for password-only providers in auto-SSO MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The _auto_sso_response middleware redirects unauthenticated requests to /auth/login?provider= when exactly one session provider is registered. This works for OAuth providers but raises NotImplementedError for password-only providers (e.g. basic auth), whose start_login() is a stub — the login page POSTs to /auth/password-login instead. Add a check: when the single provider has supports_password=True, return None so the request falls through to the server-rendered /login page (which renders the credential form). Without this fix, accessing the dashboard via a non-loopback address (e.g. Tailscale IP) with only basic auth configured results in a 500 error on every page load. --- hermes_cli/dashboard_auth/middleware.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/hermes_cli/dashboard_auth/middleware.py b/hermes_cli/dashboard_auth/middleware.py index 2c5f5b4f7b95..5a188353976d 100644 --- a/hermes_cli/dashboard_auth/middleware.py +++ b/hermes_cli/dashboard_auth/middleware.py @@ -182,9 +182,15 @@ def _auto_sso_response(request: Request) -> Response | None: # Zero → nothing to redirect to. Two+ → user must choose at /login. return None - from hermes_cli.dashboard_auth.prefix import prefix_from_request - provider = providers[0] + + # Password-only providers (e.g. basic auth) don't have an OAuth flow; + # /auth/login?provider= would raise NotImplementedError. + # Fall through to the server-rendered /login page instead. + if getattr(provider, "supports_password", False): + return None + + from hermes_cli.dashboard_auth.prefix import prefix_from_request prefix = prefix_from_request(request) next_param = _safe_next_target(request) from urllib.parse import quote