Initial Ladill Meet release.

Phases 0–18: core meetings, webinar, breakouts, team chat, live streaming, town hall, billing, and Ladill Mail calendar wiring.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Middleware/AuthenticateService.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Generic service-to-service auth for internal APIs. Validates the bearer token
+ * against per-consumer keys in config("{namespace}.service_api_keys") with a
+ * constant-time compare, and records the caller. Usage: auth.service:crm.
+ */
+class AuthenticateService
+{
+    public function handle(Request $request, Closure $next, string $namespace = 'crm'): Response
+    {
+        $token = (string) $request->bearerToken();
+        $caller = null;
+
+        if ($token !== '') {
+            foreach ((array) config("{$namespace}.service_api_keys", []) as $name => $key) {
+                if (is_string($key) && $key !== '' && hash_equals($key, $token)) {
+                    $caller = $name;
+                    break;
+                }
+            }
+        }
+
+        if ($caller === null) {
+            return response()->json(['error' => 'Unauthorized.'], 401);
+        }
+
+        $request->attributes->set('service_caller', $caller);
+
+        return $next($request);
+    }
+}

app/Http/Middleware/EnsureMeetAbility.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Services\Meet\MeetPermissions;
+use App\Services\Meet\OrganizationResolver;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureMeetAbility
+{
+    public function __construct(
+        protected OrganizationResolver $organizations,
+        protected MeetPermissions $permissions,
+    ) {}
+
+    public function handle(Request $request, Closure $next, string $ability): Response
+    {
+        $user = $request->user();
+        abort_unless($user, 403);
+
+        $organization = $this->organizations->resolveForUser($user);
+        abort_unless($organization, 403);
+
+        $member = $this->organizations->memberFor($user, $organization);
+        abort_unless($this->permissions->can($member, $ability), 403);
+
+        $request->attributes->set('meet.organization', $organization);
+        $request->attributes->set('meet.member', $member);
+
+        return $next($request);
+    }
+}

app/Http/Middleware/EnsureOrganizationSetup.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Services\Meet\OrganizationResolver;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureOrganizationSetup
+{
+    public function __construct(
+        protected OrganizationResolver $organizations,
+    ) {}
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = $request->user();
+        if (! $user) {
+            return $next($request);
+        }
+
+        if ($request->routeIs('meet.onboarding*')) {
+            return $next($request);
+        }
+
+        if (! $this->organizations->isOnboarded($user)) {
+            return redirect()->route('meet.onboarding.show');
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/EnsurePlatformSession.php

@@ -0,0 +1,73 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Http;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * App sessions are subordinate to the platform (auth.ladill.com) session.
+ * When the platform session ends, clear this app's local session too.
+ *
+ * Re-checks auth.ladill.com at most once per TTL — not on every request.
+ * Client-side sso-keepalive still pings periodically between checks.
+ */
+class EnsurePlatformSession
+{
+    private const VERIFY_TTL_SECONDS = 90;
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! Auth::check()) {
+            return $next($request);
+        }
+
+        $authDomain = trim((string) config('app.auth_domain', ''));
+        if ($authDomain === '') {
+            return $next($request);
+        }
+
+        $verifiedAt = (int) $request->session()->get('platform_session_verified_at', 0);
+        if ($verifiedAt > 0 && (time() - $verifiedAt) < self::VERIFY_TTL_SECONDS) {
+            return $next($request);
+        }
+
+        $cookieHeader = (string) $request->headers->get('Cookie', '');
+        if ($cookieHeader === '') {
+            return $this->clearAppSession($request);
+        }
+
+        try {
+            $response = Http::withHeaders(['Cookie' => $cookieHeader])
+                ->timeout(3)
+                ->connectTimeout(2)
+                ->get('https://'.$authDomain.'/sso/ping');
+        } catch (\Throwable) {
+            return $next($request);
+        }
+
+        if ($response->status() === 401) {
+            return $this->clearAppSession($request);
+        }
+
+        if ($response->successful()) {
+            $request->session()->put('platform_session_verified_at', time());
+        }
+
+        return $next($request);
+    }
+
+    private function clearAppSession(Request $request): Response
+    {
+        Auth::logout();
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect()->route('sso.connect', [
+            'redirect' => $request->fullUrl(),
+        ]);
+    }
+}

app/Http/Middleware/SetActingAccount.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\View;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Shares the signed-in account with views. CRM data is scoped per account by
+ * the user's public_id (owner_ref); today every user acts as their own
+ * account (team support graduates here later, like the platform pattern).
+ */
+class SetActingAccount
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if ($user = $request->user()) {
+            $request->attributes->set('actingAccount', $user);
+
+            if (! $request->is('api/*')) {
+                View::share('actingAccount', $user);
+            }
+        }
+
+        return $next($request);
+    }
+}