fix(dashboard): skip auto-SSO for password-only providers (BasicAuthProvider)

[liuhao1024]

What does this PR do?

Fixes HTTP 500 error when accessing the dashboard root path (/) when only a password-only auth provider (BasicAuthProvider) is configured.

When --host 0.0.0.0 is set and only BasicAuthProvider is registered (no OAuth providers), unauthenticated access to / returns HTTP 500 instead of redirecting to the login page. The /login interstitial itself works correctly — only the root-path auto-redirect is broken.

The auth middleware's _auto_sso_response() function attempts to auto-initiate OAuth redirect when exactly one session provider is registered. For password-only providers like BasicAuthProvider, this redirects to /auth/login?provider=basic, which calls provider.start_login(). However, BasicAuthProvider.start_login() raises NotImplementedError because password authentication doesn't use OAuth flows, causing FastAPI to return a 500 error.

The fix adds a guard in _auto_sso_response() to skip auto-SSO for password-only providers. It checks if the provider has supports_password = True and falls through to the /login interstitial (which correctly renders the password form) instead of attempting OAuth redirect.

Related Issue

Fixes #60105

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• hermes_cli/dashboard_auth/middleware.py: Added guard in _auto_sso_response() to skip auto-SSO redirect for password-only providers (detected by supports_password attribute). Updated docstring to document this condition.
• tests/hermes_cli/test_dashboard_auth_middleware.py: Added test_password_only_provider_no_auto_sso() to verify that when only BasicAuthProvider is registered, requests to / redirect to /login (password form interstitial) instead of /auth/login (OAuth flow).

How to Test

1. Configure dashboard with only BasicAuthProvider:

   dashboard:
     basic_auth:
       username: admin
       password: s3cret

2. Start dashboard with --host 0.0.0.0
3. Access http://localhost:8080/ in a browser without authentication
4. Observed result: Browser receives HTTP 302 redirect to /login and displays the password login form (username + password fields). No HTTP 500 error.

Automated test: pytest tests/hermes_cli/test_dashboard_auth_middleware.py::test_password_only_provider_no_auto_sso -xvs passes.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15.2

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

For New Skills

• This skill is broadly useful to most users (if bundled) — see Contributing Guide
• SKILL.md follows the standard format (frontmatter, trigger conditions, steps, pitfalls)
• No external dependencies that aren't already available (prefer stdlib, curl, existing Hermes tools)
• I've tested the skill end-to-end: hermes --toolsets skills -q "Use the X skill to do Y"

Screenshots / Logs

[alt-glitch]

This was generated by AI during triage.

Duplicate of #54887 — the earliest-open canonical fix. This adds the byte-identical supports_password guard in the same _auto_sso_response() function (hermes_cli/dashboard_auth/middleware.py). Both target the #54846 auto-SSO regression (issue #60105 / anchor #55130). Related open siblings: #56082, #54958.

[liuhao1024]

Closing this PR as it duplicates the earlier-open #54887, which implements the same fix (checking supports_password in _auto_sso_response() to skip auto-SSO redirect for password-only providers). The core change in both PRs is byte-identical: adding the guard if getattr(provider, "supports_password", False): return None. Keeping #54887 as the canonical fix.