From 094bd5b88607727def283d4b0ca15552b694bf90 Mon Sep 17 00:00:00 2001
From: isaacclad <sense.corporate@gmail.com>
Date: Sat, 20 Jun 2026 08:26:30 +0000
Subject: [PATCH] Bind app sessions to the platform auth session.

Clear local sessions when auth.ladill.com signs out and ping the platform session from keepalive.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../Controllers/Auth/SsoLoginController.php   | 12 ++++
 app/Http/Middleware/EnsurePlatformSession.php | 58 +++++++++++++++++++
 bootstrap/app.php                             |  3 +
 .../views/partials/sso-keepalive.blade.php    | 16 +++--
 routes/web.php                                |  3 +-
 5 files changed, 87 insertions(+), 5 deletions(-)
 create mode 100644 app/Http/Middleware/EnsurePlatformSession.php

diff --git a/app/Http/Controllers/Auth/SsoLoginController.php b/app/Http/Controllers/Auth/SsoLoginController.php
index b413343..c7b7933 100644
--- a/app/Http/Controllers/Auth/SsoLoginController.php
+++ b/app/Http/Controllers/Auth/SsoLoginController.php
@@ -138,6 +138,18 @@ class SsoLoginController extends Controller
         return redirect()->away($this->defaultSignedOutUrl());
     }
 
+    /** Platform session ended — clear this app and offer silent sign-in again. */
+    public function platformSignedOut(Request $request): RedirectResponse
+    {
+        Auth::logout();
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect()->route('sso.connect', [
+            'redirect' => (string) $request->query('redirect', ''),
+        ]);
+    }
+
     public function logoutBridge(Request $request): View
     {
         $return = $this->safeReturnUrl((string) $request->query('return', ''));
diff --git a/app/Http/Middleware/EnsurePlatformSession.php b/app/Http/Middleware/EnsurePlatformSession.php
new file mode 100644
index 0000000..db642f5
--- /dev/null
+++ b/app/Http/Middleware/EnsurePlatformSession.php
@@ -0,0 +1,58 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Http;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * App sessions are subordinate to the platform (auth.ladill.com) session.
+ * When the platform session ends, clear this app's local session too.
+ */
+class EnsurePlatformSession
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! Auth::check()) {
+            return $next($request);
+        }
+
+        $authDomain = trim((string) config('app.auth_domain', ''));
+        if ($authDomain === '') {
+            return $next($request);
+        }
+
+        $cookieHeader = (string) $request->headers->get('Cookie', '');
+        if ($cookieHeader === '') {
+            return $this->clearAppSession($request);
+        }
+
+        try {
+            $response = Http::withHeaders(['Cookie' => $cookieHeader])
+                ->timeout(3)
+                ->get('https://'.$authDomain.'/sso/ping');
+        } catch (\Throwable) {
+            return $next($request);
+        }
+
+        if ($response->status() === 401) {
+            return $this->clearAppSession($request);
+        }
+
+        return $next($request);
+    }
+
+    private function clearAppSession(Request $request): Response
+    {
+        Auth::logout();
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect()->route('sso.connect', [
+            'redirect' => $request->fullUrl(),
+        ]);
+    }
+}
diff --git a/bootstrap/app.php b/bootstrap/app.php
index 8e63454..5955084 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -19,6 +19,9 @@ return Application::configure(basePath: dirname(__DIR__))
         $middleware->web(append: [
             \App\Http\Middleware\SetActingAccount::class,
         ]);
+        $middleware->alias([
+            'platform.session' => \App\Http\Middleware\EnsurePlatformSession::class,
+        ]);
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         //
diff --git a/resources/views/partials/sso-keepalive.blade.php b/resources/views/partials/sso-keepalive.blade.php
index bc14950..2d297c5 100644
--- a/resources/views/partials/sso-keepalive.blade.php
+++ b/resources/views/partials/sso-keepalive.blade.php
@@ -1,11 +1,19 @@
 @if (auth()->check())
-    @php $authPing = 'https://'.config('app.auth_domain').'/sso/ping'; @endphp
-    {{-- Same-site pings keep the shared auth.ladill.com session warm while using this app. --}}
-    <iframe src="{{ $authPing }}" hidden width="0" height="0" title=""></iframe>
+    @php
+        $authPing = 'https://'.config('app.auth_domain').'/sso/ping';
+        $platformSignedOutUrl = route('sso.platform-signed-out', ['redirect' => url()->current()]);
+    @endphp
     <script>
         (function () {
             const pingUrl = @js($authPing);
-            const ping = () => fetch(pingUrl, { credentials: 'include', mode: 'no-cors' }).catch(() => {});
+            const signedOutUrl = @js($platformSignedOutUrl);
+            const ping = () => fetch(pingUrl, { credentials: 'include' })
+                .then((response) => {
+                    if (response.status === 401) {
+                        window.location.href = signedOutUrl;
+                    }
+                })
+                .catch(() => {});
             ping();
             setInterval(ping, 5 * 60 * 1000);
         })();
diff --git a/routes/web.php b/routes/web.php
index 8eb5bb8..53563d6 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -24,6 +24,7 @@ Route::get('/sso/callback', [SsoLoginController::class, 'callback'])->name('sso.
 Route::post('/logout', [SsoLoginController::class, 'logout'])->name('logout');
 Route::get('/sso/logout-bridge', [SsoLoginController::class, 'logoutBridge'])->name('sso.logout-bridge');
 Route::get('/sso/logout-frontchannel', [SsoLoginController::class, 'frontchannelLogout'])->name('sso.logout-frontchannel');
+Route::get('/sso/platform-signed-out', [SsoLoginController::class, 'platformSignedOut'])->name('sso.platform-signed-out');
 Route::get('/signed-out', fn () => auth()->check() ? redirect()->route('mini.dashboard') : view('mini.signed-out'))->name('mini.signed-out');
 
 Route::get('/q/{shortCode}', [QrScanController::class, 'resolve'])->name('qr.public.resolve');
@@ -31,7 +32,7 @@ Route::get('/q/{shortCode}/payment-logo', [QrScanController::class, 'paymentLogo
 Route::post('/q/{shortCode}/pay', [PaymentController::class, 'pay'])->name('qr.public.payment.pay');
 Route::get('/q/{shortCode}/pay/callback', [PaymentController::class, 'callback'])->name('qr.public.payment.callback');
 
-Route::middleware(['auth'])->group(function () {
+Route::middleware(['auth', 'platform.session'])->group(function () {
     Route::get('/notifications', [NotificationController::class, 'index'])->name('notifications.index');
     Route::get('/notifications/unread', [NotificationController::class, 'unread'])->name('notifications.unread');
     Route::post('/notifications/{id}/read', [NotificationController::class, 'markAsRead'])->name('notifications.mark-read');