Throttle platform SSO session checks to cut per-request auth latency.

Verify auth.ladill.com at most once every 90s; recommend Redis for session/cache in .env.example.

Co-authored-by: Cursor <cursoragent@cursor.com>

.env.example

@@ -17,7 +17,12 @@ DB_DATABASE=ladill_qr_plus
 DB_USERNAME=ladill_qr_plus
 DB_PASSWORD=
 
-SESSION_DRIVER=database
+REDIS_CLIENT=phpredis
+REDIS_HOST=127.0.0.1
+REDIS_PASSWORD=null
+REDIS_PORT=6379
+
+SESSION_DRIVER=redis
 # Idle web session length in minutes (1440 = 24 hours of inactivity).
 SESSION_LIFETIME=1440
 SESSION_DOMAIN=.ladill.com

app/Http/Middleware/EnsurePlatformSession.php

@@ -11,9 +11,14 @@ use Symfony\Component\HttpFoundation\Response;
 /**
  * App sessions are subordinate to the platform (auth.ladill.com) session.
  * When the platform session ends, clear this app's local session too.
+ *
+ * Re-checks auth.ladill.com at most once per TTL — not on every request.
+ * Client-side sso-keepalive still pings periodically between checks.
  */
 class EnsurePlatformSession
 {
+    private const VERIFY_TTL_SECONDS = 90;
+
     public function handle(Request $request, Closure $next): Response
     {
         if (! Auth::check()) {
@@ -25,6 +30,11 @@ class EnsurePlatformSession
             return $next($request);
         }
 
+        $verifiedAt = (int) $request->session()->get('platform_session_verified_at', 0);
+        if ($verifiedAt > 0 && (time() - $verifiedAt) < self::VERIFY_TTL_SECONDS) {
+            return $next($request);
+        }
+
         $cookieHeader = (string) $request->headers->get('Cookie', '');
         if ($cookieHeader === '') {
             return $this->clearAppSession($request);
@@ -33,6 +43,7 @@ class EnsurePlatformSession
         try {
             $response = Http::withHeaders(['Cookie' => $cookieHeader])
                 ->timeout(3)
+                ->connectTimeout(2)
                 ->get('https://'.$authDomain.'/sso/ping');
         } catch (\Throwable) {
             return $next($request);
@@ -42,6 +53,10 @@ class EnsurePlatformSession
             return $this->clearAppSession($request);
         }
 
+        if ($response->successful()) {
+            $request->session()->put('platform_session_verified_at', time());
+        }
+
         return $next($request);
     }