Throttle platform SSO session checks to cut per-request auth latency.

Verify auth.ladill.com at most once every 90s; recommend Redis for session/cache in .env.example.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -17,13 +17,18 @@ DB_DATABASE=ladill_pos
 DB_USERNAME=ladill_pos
 DB_PASSWORD=
 
+REDIS_CLIENT=phpredis
+REDIS_HOST=127.0.0.1
+REDIS_PASSWORD=null
+REDIS_PORT=6379
+
 PLATFORM_DB_HOST=127.0.0.1
 PLATFORM_DB_PORT=3306
 PLATFORM_DB_DATABASE=ladilldb
 PLATFORM_DB_USERNAME=ladill_pos
 PLATFORM_DB_PASSWORD=
 
-SESSION_DRIVER=database
+SESSION_DRIVER=redis
 # Idle web session length in minutes (1440 = 24 hours of inactivity).
 SESSION_LIFETIME=1440
 SESSION_DOMAIN=.ladill.com

app/Http/Middleware/EnsurePlatformSession.php

@@ -11,9 +11,14 @@ use Symfony\Component\HttpFoundation\Response;
 /**
  * App sessions are subordinate to the platform (auth.ladill.com) session.
  * When the platform session ends, clear this app's local session too.
+ *
+ * Re-checks auth.ladill.com at most once per TTL — not on every request.
+ * Client-side sso-keepalive still pings periodically between checks.
  */
 class EnsurePlatformSession
 {
+    private const VERIFY_TTL_SECONDS = 90;
+
     public function handle(Request $request, Closure $next): Response
     {
         if (! Auth::check()) {
@@ -25,6 +30,11 @@ class EnsurePlatformSession
             return $next($request);
         }
 
+        $verifiedAt = (int) $request->session()->get('platform_session_verified_at', 0);
+        if ($verifiedAt > 0 && (time() - $verifiedAt) < self::VERIFY_TTL_SECONDS) {
+            return $next($request);
+        }
+
         $cookieHeader = (string) $request->headers->get('Cookie', '');
         if ($cookieHeader === '') {
             return $this->clearAppSession($request);
@@ -33,6 +43,7 @@ class EnsurePlatformSession
         try {
             $response = Http::withHeaders(['Cookie' => $cookieHeader])
                 ->timeout(3)
+                ->connectTimeout(2)
                 ->get('https://'.$authDomain.'/sso/ping');
         } catch (\Throwable) {
             return $next($request);
@@ -42,6 +53,10 @@ class EnsurePlatformSession
             return $this->clearAppSession($request);
         }
 
+        if ($response->successful()) {
+            $request->session()->put('platform_session_verified_at', time());
+        }
+
         return $next($request);
     }
 

resources/views/partials/sso-keepalive.blade.php

@@ -0,0 +1,21 @@
+@if (auth()->check())
+    @php
+        $authPing = 'https://'.config('app.auth_domain').'/sso/ping';
+        $platformSignedOutUrl = route('sso.platform-signed-out', ['redirect' => url()->current()]);
+    @endphp
+    <script>
+        (function () {
+            const pingUrl = @js($authPing);
+            const signedOutUrl = @js($platformSignedOutUrl);
+            const ping = () => fetch(pingUrl, { credentials: 'include' })
+                .then((response) => {
+                    if (response.status === 401) {
+                        window.location.href = signedOutUrl;
+                    }
+                })
+                .catch(() => {});
+            ping();
+            setInterval(ping, 5 * 60 * 1000);
+        })();
+    </script>
+@endif