From 31c292c5e5f2a855d7c70ab4e9e6eef29155f073 Mon Sep 17 00:00:00 2001
From: isaacclad <sense.corporate@gmail.com>
Date: Tue, 30 Jun 2026 16:51:12 +0000
Subject: [PATCH] Throttle platform SSO session checks to cut per-request auth
 latency.

Verify auth.ladill.com at most once every 90s; recommend Redis for session/cache in .env.example.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .env.example                                  |  7 ++++++-
 app/Http/Middleware/EnsurePlatformSession.php | 15 +++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index 57590ca..2dd537d 100644
--- a/.env.example
+++ b/.env.example
@@ -17,7 +17,12 @@ DB_DATABASE=ladill_qr_plus
 DB_USERNAME=ladill_qr_plus
 DB_PASSWORD=
 
-SESSION_DRIVER=database
+REDIS_CLIENT=phpredis
+REDIS_HOST=127.0.0.1
+REDIS_PASSWORD=null
+REDIS_PORT=6379
+
+SESSION_DRIVER=redis
 # Idle web session length in minutes (1440 = 24 hours of inactivity).
 SESSION_LIFETIME=1440
 SESSION_DOMAIN=.ladill.com
diff --git a/app/Http/Middleware/EnsurePlatformSession.php b/app/Http/Middleware/EnsurePlatformSession.php
index db642f5..a3af287 100644
--- a/app/Http/Middleware/EnsurePlatformSession.php
+++ b/app/Http/Middleware/EnsurePlatformSession.php
@@ -11,9 +11,14 @@ use Symfony\Component\HttpFoundation\Response;
 /**
  * App sessions are subordinate to the platform (auth.ladill.com) session.
  * When the platform session ends, clear this app's local session too.
+ *
+ * Re-checks auth.ladill.com at most once per TTL — not on every request.
+ * Client-side sso-keepalive still pings periodically between checks.
  */
 class EnsurePlatformSession
 {
+    private const VERIFY_TTL_SECONDS = 90;
+
     public function handle(Request $request, Closure $next): Response
     {
         if (! Auth::check()) {
@@ -25,6 +30,11 @@ class EnsurePlatformSession
             return $next($request);
         }
 
+        $verifiedAt = (int) $request->session()->get('platform_session_verified_at', 0);
+        if ($verifiedAt > 0 && (time() - $verifiedAt) < self::VERIFY_TTL_SECONDS) {
+            return $next($request);
+        }
+
         $cookieHeader = (string) $request->headers->get('Cookie', '');
         if ($cookieHeader === '') {
             return $this->clearAppSession($request);
@@ -33,6 +43,7 @@ class EnsurePlatformSession
         try {
             $response = Http::withHeaders(['Cookie' => $cookieHeader])
                 ->timeout(3)
+                ->connectTimeout(2)
                 ->get('https://'.$authDomain.'/sso/ping');
         } catch (\Throwable) {
             return $next($request);
@@ -42,6 +53,10 @@ class EnsurePlatformSession
             return $this->clearAppSession($request);
         }
 
+        if ($response->successful()) {
+            $request->session()->put('platform_session_verified_at', time());
+        }
+
         return $next($request);
     }