Scaffold Ladill Woo Manager for WooCommerce order fulfillment.

Standalone app with SSO shell, WordPress plugin connect flow, webhook ingest,
fulfillment inbox, and plugin activation API — no payment processing.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Middleware/EnsurePlatformSession.php

@@ -0,0 +1,73 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Http;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * App sessions are subordinate to the platform (auth.ladill.com) session.
+ * When the platform session ends, clear this app's local session too.
+ *
+ * Re-checks auth.ladill.com at most once per TTL — not on every request.
+ * Client-side sso-keepalive still pings periodically between checks.
+ */
+class EnsurePlatformSession
+{
+    private const VERIFY_TTL_SECONDS = 90;
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (! Auth::check()) {
+            return $next($request);
+        }
+
+        $authDomain = trim((string) config('app.auth_domain', ''));
+        if ($authDomain === '') {
+            return $next($request);
+        }
+
+        $verifiedAt = (int) $request->session()->get('platform_session_verified_at', 0);
+        if ($verifiedAt > 0 && (time() - $verifiedAt) < self::VERIFY_TTL_SECONDS) {
+            return $next($request);
+        }
+
+        $cookieHeader = (string) $request->headers->get('Cookie', '');
+        if ($cookieHeader === '') {
+            return $this->clearAppSession($request);
+        }
+
+        try {
+            $response = Http::withHeaders(['Cookie' => $cookieHeader])
+                ->timeout(3)
+                ->connectTimeout(2)
+                ->get('https://'.$authDomain.'/sso/ping');
+        } catch (\Throwable) {
+            return $next($request);
+        }
+
+        if ($response->status() === 401) {
+            return $this->clearAppSession($request);
+        }
+
+        if ($response->successful()) {
+            $request->session()->put('platform_session_verified_at', time());
+        }
+
+        return $next($request);
+    }
+
+    private function clearAppSession(Request $request): Response
+    {
+        Auth::logout();
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return redirect()->route('sso.connect', [
+            'redirect' => $request->fullUrl(),
+        ]);
+    }
+}

app/Http/Middleware/InjectBootSplash.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\View;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Injects a branded boot splash (Ladill Mail style) into authenticated HTML
+ * pages. The splash shows once per browser session while the app loads, then
+ * fades out — masking the client-side boot so the app feels instant.
+ */
+class InjectBootSplash
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $response = $next($request);
+
+        if (! $request->isMethod('GET') || ! Auth::check()) {
+            return $response;
+        }
+
+        if (! str_contains((string) $response->headers->get('Content-Type', ''), 'text/html')) {
+            return $response;
+        }
+
+        $content = $response->getContent();
+        if (! is_string($content)
+            || stripos($content, '<body') === false
+            || str_contains($content, 'id="ladill-boot"')) {
+            return $response;
+        }
+
+        $splash = View::make('partials.boot-splash')->render();
+        $content = preg_replace_callback('/<body\b[^>]*>/i', fn ($m) => $m[0].$splash, $content, 1);
+
+        if (is_string($content)) {
+            $response->setContent($content);
+        }
+
+        return $response;
+    }
+}

app/Http/Middleware/SetActingAccount.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class SetActingAccount
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if ($user = $request->user()) {
+            $request->attributes->set('actingAccount', $user);
+        }
+
+        return $next($request);
+    }
+}