fix(dashboard-auth): BasicAuthProvider 500 on /auth/login and auto-SSO redirect

[wen0531]

Problem

Two bugs prevent BasicAuthProvider (username/password dashboard auth) from working on a non-loopback bind (0.0.0.0):

Bug 1: Auto-SSO redirect crashes on password providers

_auto_sso_response in middleware.py checks if there's exactly one session provider, and if so, auto-redirects to /auth/login?provider=N. But BasicAuthProvider.start_login() raises NotImplementedError because it's a password-only provider with no OAuth redirect flow. Result: HTTP 500 on first page load.

Bug 2: /auth/login endpoint crashes on password providers

The /auth/login?provider=basic route calls p.start_login() unconditionally. For password-only providers this also raises NotImplementedError → 500.

Fix

Both fixes add a supports_password check before the OAuth-specific code path:

1. middleware.py: Skip auto-SSO redirect for password providers, fall through to /login which renders the password form.
2. routes.py: Redirect password providers to /login instead of calling start_login().

OAuth providers are completely unaffected — the checks only gate on supports_password=True.

Verification

• All 85 existing dashboard-auth tests pass
• Manual testing with BasicAuthProvider on 0.0.0.0 bind confirms:
  • / → redirect to /login → 200 (was 500)
  • /auth/login?provider=basic → redirect to /login → 200 (was 500)
  • POST /auth/password-login → 200 with session cookies set

[alt-glitch]

This was generated by AI during triage.

Duplicate of #58044 — same both-site supports_password guard (skip auto-SSO in middleware.py + route password providers to /login in routes.py) fixing the HTTP 500 when a sole password-only BasicAuthProvider is configured. #58044 is the earliest open PR with this exact two-site scope. Note: the earlier single-site fix #57214 (middleware-only) is a subset and is related. The prior anchors (#56886, #54887, issue #55130) have since been closed. A maintainer should pick one from this saturated cluster.

[wen0531]

Thanks for the triage! I see #58044 covers the same two-site fix and was filed earlier. Happy to close this in favor of #58044 if that's the one you pick — just let me know. Either way, glad the bug gets fixed.

[tonydwb]

Code Review Summary

Verdict: Approved

Looks Good

• Fix(dashboard-auth): BasicAuthProvider 500 on /auth/login and auto-SSO redirect
• 16 additions, 3 deletions — targeted fix
• No issues detected

---

Reviewed by Hermes Agent

[teknium1]

Thanks for the focused report and implementation. This is already implemented on current main; automated hermes-sweeper review found the PR redundant.

• Commit 3e24b16f566045399012bc1185fe0cdb6e1a1be9 (fix(dashboard): support mobile OAuth login) added the same two guards.
• hermes_cli/dashboard_auth/middleware.py:212 skips auto-SSO for supports_password providers.
• hermes_cli/dashboard_auth/routes.py:195-202 redirects password providers from /auth/login to /login before start_login().
• tests/hermes_cli/test_dashboard_auth_password_login.py:201-217 already covers both redirect paths.

This also resolves the duplicate cluster noted in the prior triage discussion.