fix: skip auto-SSO redirect for password-only auth providers

[hashbender]

What does this PR do?

_auto_sso_response() unconditionally redirects to /auth/login when there is exactly one session provider. For password-only providers (e.g. BasicAuthProvider), /auth/login calls start_login() which raises NotImplementedError → 500 Internal Server Error.

Fix: check provider.supports_password before redirecting. If True, return None to let the /login interstitial render the credential form.

Related Issue

Fixes NousResearch#56067

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)

Changes Made

• hermes_cli/dashboard_auth/middleware.py: Added guard in _auto_sso_response() to skip auto-redirect when the sole provider is password-only.

How to Test

1. Configure dashboard with only a basic auth provider
2. Visit http://host:9119/ in browser
3. Should render /login with credential form (not 500)

Checklist

• ruff check passes
• Fixes Dashboard 500 on password-only auth provider: _auto_sso_response redirects to /auth/login instead of /login NousResearch/hermes-agent#56067
• No new dependencies

---

Mirror-of: NousResearch#56082
NousResearch#56082

[tenki-reviewer]

Review Complete
No issues found!

Risk: 🟢 Low (5/100) — no findings · 8 LOC across 1 file

---

Single-file PR adding dashboard authentication middleware with OAuth provider abstraction and session cookie management. No issues found.

Files Reviewed (1 files)

hermes_cli/dashboard_auth/middleware.py