fix(dashboard-auth): skip password-only providers in auto-SSO redirect (#58237)

[PRATHAMESH75]

What does this PR do?

Fixes a 500 Internal Server Error when the dashboard is secured with only a password-only auth provider (e.g. basic auth) and visited unauthenticated.

_auto_sso_response() in hermes_cli/dashboard_auth/middleware.py auto-initiates the portal OAuth redirect when exactly one interactive (session) provider is registered. It filtered candidates via list_session_providers() (which only checks supports_session=True), so a password-only provider like basic auth was treated as a redirect provider. The middleware then 302'd to /auth/login?provider=basic, whose start_login() is a NotImplementedError stub for password-only providers — yielding a 500 instead of the login form.

The fix drops password-only providers (supports_password=True) from the auto-SSO candidate list. When none remain the function returns None, and the middleware falls through to its ordinary _unauth_response, which already redirects HTML navigation to /login (the credential form) and returns 401 JSON for /api/*. Only the auto-SSO fast-path had the bug.

Related Issue

Fixes #58237

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• hermes_cli/dashboard_auth/middleware.py — in _auto_sso_response, filter out supports_password providers before the single-provider auto-redirect check (they have no OAuth start_login to initiate).
• tests/hermes_cli/test_dashboard_auth_password_login.py — add TestAutoSsoSkipsPasswordOnlyProvider: with only a password-only provider registered, an unauth HTML load falls back to /login (not /auth/login) and does not 500.

How to Test

scripts/run_tests.sh tests/hermes_cli/test_dashboard_auth_password_login.py tests/hermes_cli/test_dashboard_auth_401_reauth.py tests/hermes_cli/test_dashboard_auth_middleware.py

Result: 98 passed. The two new tests fail against upstream/main (reproducing the NotImplementedError 500 from start_login()) and pass with this change.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS (Darwin 25.5.0)

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

[alt-glitch]

This was generated by AI during triage.

Duplicate of #54887 (earliest-open canonical fix). This PR applies the byte-for-byte same supports_password filter in _auto_sso_response() (hermes_cli/dashboard_auth/middleware.py) as the canonical fix, into which #54958 / #58007 / #56082 already dedup. Related: #58237 (target issue), #55498 (cluster crash issue), #54958 / #58007 / #58171 (sibling fix PRs), #54846 (merged regression source). Marking duplicate for DB/search consistency; maintainer picks the canonical PR to merge.

[tonydwb]

Code Review Summary

Verdict: Comment

Summary

Fixes auto-SSO redirect to skip password-only providers, which have no OAuth flow and would cause a silent redirect loop.

Looks Good

• Targeted fix: 2 files, 31 additions
• Clear inline comment explaining why password-only providers are excluded
• Test added for the regression case
• Correct filtering logic: not p.supports_password

---

Reviewed by Hermes Agent

[tonydwb]

Code Review Summary

Verdict: Comment (LGTM — token read-only, formal approval deferred to maintainer)

Documentation fix for himalaya email skill: updates flag add/remove syntax for v1.2.0 which changed from --flag <name> to positional arguments. Also documents batch flag operations. The old syntax is removed in v1.2.0 and would cause errors.

Looks Good

• Accurate documentation update for v1.2.0 syntax change
• Documents both single and batch flag operations

---

Reviewed by Hermes Agent

[teknium1]

Thanks for the focused regression report and test coverage. This is an automated hermes-sweeper review; the reported password-only auto-SSO failure is already fixed on current main.

• hermes_cli/dashboard_auth/middleware.py:212-213 returns None for a sole supports_password provider, which falls through to the ordinary /login form rather than redirecting to /auth/login.
• Commit 3e24b16f566045399012bc1185fe0cdb6e1a1be9 added that guard.
• tests/hermes_cli/test_dashboard_auth_password_login.py:201-209 already exercises the unauthenticated HTML redirect and credential-form fallback.
• The duplicate discussion correctly pointed to canonical PR fix(dashboard-auth): skip auto-SSO redirect for password-only providers #54887; its later maintainer update records that the equivalent fix was superseded by a merged successor.

Closing as implemented on main.