hermes-bsd/plugins/dashboard_auth/basic/plugin.yaml

name: basic
version: 1.0.0
description: "Dashboard auth provider — username/password (no OAuth IDP). A self-hosted 'just put a password on my dashboard' provider. Activates when dashboard.basic_auth.username plus a password (or password_hash) are configured via config.yaml (canonical surface) or the HERMES_DASHBOARD_BASIC_AUTH_* env vars. Sessions are stateless HMAC-signed tokens minted by the provider; password hashing uses stdlib scrypt (no third-party dependency). Set dashboard.basic_auth.secret for restart-surviving / multi-worker sessions."
author: NousResearch
kind: backend
requires_env:
  - HERMES_DASHBOARD_BASIC_AUTH_USERNAME
feat(dashboard-auth): add BasicAuthProvider username/password plugin A bundled, zero-infrastructure 'just put a password on my dashboard' provider that uses the supports_password extension point. No external IDP, no database: sessions are stateless HMAC-signed tokens the provider mints and verifies itself, and passwords are hashed with stdlib scrypt (no third-party dependency — deliberately avoids bcrypt to keep the dep surface unchanged). - plugins/dashboard_auth/basic: BasicAuthProvider (scrypt verify with a constant-time dummy-hash path for unknown users so the endpoint is not a username-timing oracle; access/refresh tokens carry a 'kind' claim that verify/refresh enforce; cross-secret tokens are rejected). The register() entry point mirrors the Nous plugin's config/env precedence (env wins; empty treated as unset) and LAST_SKIP_REASON channel. - config.py: document the canonical dashboard.basic_auth.* surface (username / password_hash / password / secret / session_ttl_seconds). Activates only when username + (password or password_hash) are set, so OAuth users and loopback/--insecure operators are unaffected. Without an explicit secret a random per-process key is generated (logged): fine for a single process, but sessions then don't survive restart or span workers. 2026-06-04 17:26:32 +10:00			`name: basic`
			`version: 1.0.0`
			description: "Dashboard auth provider — username/password (no OAuth IDP). A self-hosted 'just put a password on my dashboard' provider. Activates when dashboard.basic_auth.username plus a password (or password_hash) are configured via config.yaml (canonical surface) or the HERMES_DASHBOARD_BASIC_AUTH_* env vars. Sessions are stateless HMAC-signed tokens minted by the provider; password hashing uses stdlib scrypt (no third-party dependency). Set dashboard.basic_auth.secret for restart-surviving / multi-worker sessions."
			`author: NousResearch`
			`kind: backend`
			`requires_env:`
			`- HERMES_DASHBOARD_BASIC_AUTH_USERNAME`