From 8ae599dc65d6514cbeb4ca2bac9972fa26aecb56 Mon Sep 17 00:00:00 2001
From: isaacclad <sense.corporate@gmail.com>
Date: Wed, 1 Jul 2026 21:35:10 +0000
Subject: [PATCH] Fix SSO redirect loop from false platform session ping
 failures.

Server-side auth ping cannot reliably see auth.ladill.com cookies, so treat 401 as inconclusive and use client keepalive instead of signing users out.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 app/Http/Middleware/EnsurePlatformSession.php | 24 ++++++++++++++-----
 .../views/components/app-layout.blade.php     |  1 +
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/app/Http/Middleware/EnsurePlatformSession.php b/app/Http/Middleware/EnsurePlatformSession.php
index a3af287..94e898e 100644
--- a/app/Http/Middleware/EnsurePlatformSession.php
+++ b/app/Http/Middleware/EnsurePlatformSession.php
@@ -35,12 +35,12 @@ class EnsurePlatformSession
             return $next($request);
         }
 
-        $cookieHeader = (string) $request->headers->get('Cookie', '');
-        if ($cookieHeader === '') {
-            return $this->clearAppSession($request);
-        }
-
         try {
+            $cookieHeader = (string) $request->headers->get('Cookie', '');
+            if ($cookieHeader === '') {
+                return $this->deferPlatformCheck($request, $next);
+            }
+
             $response = Http::withHeaders(['Cookie' => $cookieHeader])
                 ->timeout(3)
                 ->connectTimeout(2)
@@ -50,7 +50,11 @@ class EnsurePlatformSession
         }
 
         if ($response->status() === 401) {
-            return $this->clearAppSession($request);
+            // Server-side ping forwards cookies from this app's host only. Platform
+            // session cookies on auth.ladill.com are often absent, which yields a
+            // false 401 and an infinite /sso/connect loop if we sign the user out.
+            // Client keepalive (sso-keepalive partial) performs the real check.
+            return $this->deferPlatformCheck($request, $next);
         }
 
         if ($response->successful()) {
@@ -60,6 +64,13 @@ class EnsurePlatformSession
         return $next($request);
     }
 
+    private function deferPlatformCheck(Request $request, Closure $next): Response
+    {
+        $request->session()->put('platform_session_verified_at', time());
+
+        return $next($request);
+    }
+
     private function clearAppSession(Request $request): Response
     {
         Auth::logout();
@@ -68,6 +79,7 @@ class EnsurePlatformSession
 
         return redirect()->route('sso.connect', [
             'redirect' => $request->fullUrl(),
+            'interactive' => 1,
         ]);
     }
 }
diff --git a/resources/views/components/app-layout.blade.php b/resources/views/components/app-layout.blade.php
index 981178b..9433126 100644
--- a/resources/views/components/app-layout.blade.php
+++ b/resources/views/components/app-layout.blade.php
@@ -57,5 +57,6 @@
     @endauth
     @include('partials.afia')
     @include('partials.wallet-topup-modal', ['openOnLoad' => (bool) session('topup_required')])
+    @include('partials.sso-keepalive')
 </body>
 </html>