From 2808c7894ebdcaa772e3f3db1d74eaa24c3209b6 Mon Sep 17 00:00:00 2001
From: isaacclad <sense.corporate@gmail.com>
Date: Tue, 30 Jun 2026 16:49:15 +0000
Subject: [PATCH] Throttle platform SSO session checks to cut per-request auth
 latency.

Verify auth.ladill.com at most once every 90s; recommend Redis for session/cache in .env.example.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .env.example                                  | 11 ++++++++--
 app/Http/Middleware/EnsurePlatformSession.php | 15 +++++++++++++
 .../views/partials/sso-keepalive.blade.php    | 21 +++++++++++++++++++
 3 files changed, 45 insertions(+), 2 deletions(-)
 create mode 100644 resources/views/partials/sso-keepalive.blade.php

diff --git a/.env.example b/.env.example
index ab5a9be..3ccefa5 100644
--- a/.env.example
+++ b/.env.example
@@ -14,9 +14,16 @@ DB_CONNECTION=sqlite
 DB_DATABASE=database/database.sqlite
 # Production: DB_CONNECTION=mysql, DB_HOST=127.0.0.1, DB_DATABASE=ladill_care, DB_USERNAME=ladill_care
 
-SESSION_DRIVER=database
+# Production: DB_CONNECTION=mysql, DB_HOST=127.0.0.1, DB_DATABASE=ladill_care, DB_USERNAME=ladill_care
+
+REDIS_CLIENT=phpredis
+REDIS_HOST=127.0.0.1
+REDIS_PASSWORD=null
+REDIS_PORT=6379
+
+SESSION_DRIVER=redis
 SESSION_LIFETIME=1440
-CACHE_STORE=database
+CACHE_STORE=redis
 QUEUE_CONNECTION=database
 
 # Ladill Queue service API (in-app service queue console)
diff --git a/app/Http/Middleware/EnsurePlatformSession.php b/app/Http/Middleware/EnsurePlatformSession.php
index db642f5..a3af287 100644
--- a/app/Http/Middleware/EnsurePlatformSession.php
+++ b/app/Http/Middleware/EnsurePlatformSession.php
@@ -11,9 +11,14 @@ use Symfony\Component\HttpFoundation\Response;
 /**
  * App sessions are subordinate to the platform (auth.ladill.com) session.
  * When the platform session ends, clear this app's local session too.
+ *
+ * Re-checks auth.ladill.com at most once per TTL — not on every request.
+ * Client-side sso-keepalive still pings periodically between checks.
  */
 class EnsurePlatformSession
 {
+    private const VERIFY_TTL_SECONDS = 90;
+
     public function handle(Request $request, Closure $next): Response
     {
         if (! Auth::check()) {
@@ -25,6 +30,11 @@ class EnsurePlatformSession
             return $next($request);
         }
 
+        $verifiedAt = (int) $request->session()->get('platform_session_verified_at', 0);
+        if ($verifiedAt > 0 && (time() - $verifiedAt) < self::VERIFY_TTL_SECONDS) {
+            return $next($request);
+        }
+
         $cookieHeader = (string) $request->headers->get('Cookie', '');
         if ($cookieHeader === '') {
             return $this->clearAppSession($request);
@@ -33,6 +43,7 @@ class EnsurePlatformSession
         try {
             $response = Http::withHeaders(['Cookie' => $cookieHeader])
                 ->timeout(3)
+                ->connectTimeout(2)
                 ->get('https://'.$authDomain.'/sso/ping');
         } catch (\Throwable) {
             return $next($request);
@@ -42,6 +53,10 @@ class EnsurePlatformSession
             return $this->clearAppSession($request);
         }
 
+        if ($response->successful()) {
+            $request->session()->put('platform_session_verified_at', time());
+        }
+
         return $next($request);
     }
 
diff --git a/resources/views/partials/sso-keepalive.blade.php b/resources/views/partials/sso-keepalive.blade.php
new file mode 100644
index 0000000..2d297c5
--- /dev/null
+++ b/resources/views/partials/sso-keepalive.blade.php
@@ -0,0 +1,21 @@
+@if (auth()->check())
+    @php
+        $authPing = 'https://'.config('app.auth_domain').'/sso/ping';
+        $platformSignedOutUrl = route('sso.platform-signed-out', ['redirect' => url()->current()]);
+    @endphp
+    <script>
+        (function () {
+            const pingUrl = @js($authPing);
+            const signedOutUrl = @js($platformSignedOutUrl);
+            const ping = () => fetch(pingUrl, { credentials: 'include' })
+                .then((response) => {
+                    if (response.status === 401) {
+                        window.location.href = signedOutUrl;
+                    }
+                })
+                .catch(() => {});
+            ping();
+            setInterval(ping, 5 * 60 * 1000);
+        })();
+    </script>
+@endif