fix(dashboard-auth): skip auto-SSO redirect for password-only providers

[IAnuragMahapatra]

When the sole registered auth provider is password-only (supports_password=True, e.g. BasicAuthProvider), _auto_sso_response redirected to /auth/login which calls start_login() — a method that pure-password providers implement as a NotImplementedError stub. This crashed the dashboard with HTTP 500 on first load.

Now _auto_sso_response returns None for password-only providers, falling through to _unauth_response which correctly renders the /login page with the password form.

Fixes #56067, #57211, #58166

What does this PR do?

Hermes dashboard auto-SSO silently redirects to /auth/login when exactly one auth provider is registered, skipping the login chooser. However, BasicAuthProvider is password-only — its start_login() method raises NotImplementedError (by design).

When basic auth is the only provider, the redirect hits start_login() and crashes the dashboard with an HTTP 500.

This PR adds a supports_password guard in _auto_sso_response so password-only providers fall through to _unauth_response → /login. Users now see the password login form instead of a server crash.

Related Issue

Fixes #56067
Fixes #57211
Fixes #58166

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• hermes_cli/dashboard_auth/middleware.py: Added an early return in _auto_sso_response() when provider.supports_password is True.
• tests/hermes_cli/test_dashboard_auth_middleware.py: Added the regression test test_auto_sso_skips_password_only_provider to ensure BasicAuthProvider correctly routes to /login without crashing.

How to Test

1. Configure hermes-agent with exactly one auth provider: basic.
2. Visit the dashboard root URL (/) without an active session cookie.
3. Observe that you are safely redirected to the /login page containing the basic auth form, rather than encountering an HTTP 500 crash.
4. Run pytest tests/hermes_cli/test_dashboard_auth_middleware.py -v and observe that the new test test_auto_sso_skips_password_only_provider passes.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Windows 11

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

AI Usage Disclosure

• IDE: Antigravity IDE
• Model: Gemini 3.1 Pro
• Used for: Writing tests

[alt-glitch]

This was generated by AI during triage.

Duplicate of #54887 -- the same supports_password early-return guard in _auto_sso_response (hermes_cli/dashboard_auth/middleware.py) for the dashboard auto-SSO 500 on a sole password-only BasicAuthProvider. #54887 is the earliest-open canonical fix into which this cluster (#54958, #58007, #58905, ...) already dedups; issue anchor is #55130. Maintainer: land #54887.

[IAnuragMahapatra]

Hey! I noticed the bot marked this as a duplicate of #54887. I checked the fix and the code in `middleware.py` is exactly the same but this PR also adds a regression test (`test_auto_sso_skips_password_only_provider`). The older PR does not have tests so it might be better to merge this one to avoid breaking the route again in the future. Let me know what you guys think!

[IAnuragMahapatra]

It is perfectly fine if we merge #54887 instead. I just wanted to point out that it is missing a regression test so the route might break again in the future. I am happy to open a quick follow-up PR to add just the test to whichever fix gets merged if that helps.

[teknium1]

Thanks for the focused fix and regression test. This is already implemented on current main; this automated hermes-sweeper review is closing the superseded PR.

• Commit 3e24b16f566045399012bc1185fe0cdb6e1a1be9 added the same password-provider guard at hermes_cli/dashboard_auth/middleware.py:212-213, causing auto-SSO to fall through to /login.
• The same commit also hardens the direct sibling path at hermes_cli/dashboard_auth/routes.py:195-202, so /auth/login cannot invoke start_login() for a password provider.
• Equivalent and broader regression coverage is present at tests/hermes_cli/test_dashboard_auth_password_login.py:201-217, covering both root navigation and direct /auth/login navigation.
• This matches the duplicate discussion: canonical PR fix(dashboard-auth): skip auto-SSO redirect for password-only providers #54887 was subsequently closed as superseded by the later implementation.