Dashboard auto-SSO redirect breaks for basic_auth (password-only) providers

[Goblin05]

Describe the bug

When dashboard.basic_auth (the username/password auth provider) is configured as the only auth provider, accessing any protected page on the Dashboard (port 9119) triggers an HTTP 500 error.

The auto-SSO redirect sends the browser to /auth/login?provider=basic&next=... instead of /login (the password login form), and BasicAuthProvider.start_login() raises NotImplementedError because it is password-only — it has no OAuth redirect flow.

To Reproduce

1. Configure basic auth in config.yaml:

dashboard:
  basic_auth:
    username: admin
    password_hash: ...

2. Restart the dashboard
3. Open http://localhost:9119 in a browser
4. Expected: See the password login form at /login
5. Actual: Redirected to /auth/login?provider=basic&next=... → 500 error page

Root Cause

_auto_sso_response() in hermes_cli/dashboard_auth/middleware.py is designed for OAuth providers (silent redirect to the IdP). When exactly one provider is registered, it assumes it's an OAuth provider and redirects to /auth/login?provider=.... BasicAuthProvider has supports_password = True and start_login() raises NotImplementedError, producing a 500.

# Line ~180 in middleware.py
providers = list_session_providers()
if len(providers) != 1:
    return None
# ↓ reaches here for password-only providers
provider = providers[0]
# ... builds /auth/login?provider=... URL

Fix

Skip auto-SSO when the single provider is password-only:

provider = providers[0]
if getattr(provider, 'supports_password', False):
    return None  # password-only provider, show /login form instead

Environment

• Hermes Agent version: 0.18.2
• Dashboard with basic_auth (password-only, no OAuth)
• OS: Linux

Additional context

Introduced when _auto_sso_response was added for OAuth SSO convenience. It never considered password-only providers. v0.17.x did not have this issue.

[alt-glitch]

This was generated by AI during triage.

Duplicate of #55130 — same mechanism: _auto_sso_response() in hermes_cli/dashboard_auth/middleware.py treats the sole registered provider as OAuth and redirects to /auth/login?provider=basic, but BasicAuthProvider.start_login() raises NotImplementedError (password-only) → HTTP 500 before the /login form is reached. #55130 is the open canonical anchor for this password-only auto-SSO cluster (fix PRs track it). Marking duplicate for tracking; the fix will resolve this.

[adminnewtech]

Closing as duplicate of #55130 (Dashboard 500s on every page load when basic (password) auth is the only provider — auto-SSO calls start_login() on a password-only provider). The same root cause (auto-SSO redirect to /auth/login?provider=basic raises NotImplementedError in BasicAuthProvider) was already reported in #55130 (oldest of 7 duplicates: #55130, #55498, #56130, #57211, #58237, #58626, #60105, #64424).

[adminnewtech]

Closed as duplicate of #55130 (8-way dup family for Dashboard basic_auth auto-SSO NotImplementedError)

[adminnewtech]

This issue is a duplicate of #55130 (Dashboard 500s on every page load when basic (password) auth is the only provider, 2026-06-29T19:54:44Z). The PM Agent has identified an 8-way duplicate family with identical root cause (basic_auth password-only provider breaks auto-SSO redirect): #55130 (oldest, canonical) → #55498 → #56130 → #57211 → #58237 → #58626 → #60105 → #64424 (this issue).

PM Agent attempted gh issue close 64424 but the admin bot is denied closeIssue GraphQL permission (per v1.37.25 patch A); issue remains OPEN pending founder or maintainer with close permissions.

Founder action: please close #64424 as a duplicate of #55130 (the canonical, oldest issue in the family). The comment + label evidence (alt-glitch applied duplicate at 2026-07-14T13:32:35Z) is already in the thread.

[teknium1]

Implemented on current main by automated hermes-sweeper review.

• 3e24b16f566045399012bc1185fe0cdb6e1a1be9 added the requested password-provider exclusion at hermes_cli/dashboard_auth/middleware.py:212; a sole password provider now falls through to /login rather than auto-redirecting to OAuth login.
• The same change hardens direct or stale requests at hermes_cli/dashboard_auth/routes.py:195, redirecting password providers to /login before start_login() can raise.
• Regression coverage at tests/hermes_cli/test_dashboard_auth_password_login.py:201 verifies both the root-page and direct /auth/login?provider=testpw paths redirect to the password form.

This also resolves the duplicate family noted in the discussion, including canonical issue #55130.