Fix SSO redirect loop from false platform session ping failures.

Server-side auth ping cannot reliably see auth.ladill.com cookies, so treat 401 as inconclusive and use client keepalive instead of signing users out.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Middleware/EnsurePlatformSession.php

@@ -35,12 +35,12 @@ class EnsurePlatformSession
             return $next($request);
         }
 
+        try {
             $cookieHeader = (string) $request->headers->get('Cookie', '');
             if ($cookieHeader === '') {
-            return $this->clearAppSession($request);
+                return $this->deferPlatformCheck($request, $next);
             }
 
-        try {
             $response = Http::withHeaders(['Cookie' => $cookieHeader])
                 ->timeout(3)
                 ->connectTimeout(2)
@@ -50,7 +50,11 @@ class EnsurePlatformSession
         }
 
         if ($response->status() === 401) {
-            return $this->clearAppSession($request);
+            // Server-side ping forwards cookies from this app's host only. Platform
+            // session cookies on auth.ladill.com are often absent, which yields a
+            // false 401 and an infinite /sso/connect loop if we sign the user out.
+            // Client keepalive (sso-keepalive partial) performs the real check.
+            return $this->deferPlatformCheck($request, $next);
         }
 
         if ($response->successful()) {
@@ -60,6 +64,13 @@ class EnsurePlatformSession
         return $next($request);
     }
 
+    private function deferPlatformCheck(Request $request, Closure $next): Response
+    {
+        $request->session()->put('platform_session_verified_at', time());
+
+        return $next($request);
+    }
+
     private function clearAppSession(Request $request): Response
     {
         Auth::logout();
@@ -68,6 +79,7 @@ class EnsurePlatformSession
 
         return redirect()->route('sso.connect', [
             'redirect' => $request->fullUrl(),
+            'interactive' => 1,
         ]);
     }
 }

resources/views/components/app-layout.blade.php

@@ -57,5 +57,6 @@
     @endauth
     @include('partials.afia')
     @include('partials.wallet-topup-modal', ['openOnLoad' => (bool) session('topup_required')])
+    @include('partials.sso-keepalive')
 </body>
 </html>