Session api token validation

app/Http/Controllers/FeedController.php

@@ -3,7 +3,9 @@
 namespace App\Http\Controllers;
 
 use App\Models\UserAction;
+use App\Models\UserFlight;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Cache;
 use Inertia\Inertia;
 
 class FeedController extends Controller
@@ -28,4 +30,49 @@ class FeedController extends Controller
             'feed' => $feed,
         ]);
     }
+
+    public function following()
+    {
+        $user = auth()->user();
+
+        return Cache::remember(
+            "user:{$user->id}:following",
+            now()->addMinutes(15),
+            fn () => $user->following()
+                ->with('followee')
+                ->get()
+                ->pluck('followee')
+                ->filter()
+                ->values()
+                ->toArray()
+        );
+    }
+
+    public function followingFlights()
+    {
+        $user = auth()->user();
+
+        return Cache::remember(
+            "user_following_flights_{$user->id}",
+            now()->addDays(30),
+            function () use ($user) {
+                $followingIds = $user->following()
+                    ->with('followee')
+                    ->get()
+                    ->pluck('followee')
+                    ->filter()
+                    ->reject(fn ($followee) => ($followee->settings['profile_privacy'] ?? 'public') === 'private')
+                    ->pluck('id');
+
+                return UserFlight::query()
+                    ->with(['departureAirport', 'arrivalAirport', 'user'])
+                    ->whereIn('user_id', $followingIds)
+                    ->orderByDesc('departure_date')
+                    ->limit(100)
+                    ->get()
+                    ->values()
+                    ->toArray();
+            }
+        );
+    }
 }

app/Http/Controllers/FollowerController.php

@@ -7,6 +7,8 @@ use App\Models\Notification;
 use App\Models\User;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Gate;
 
 class FollowerController extends Controller
 {
@@ -24,6 +26,43 @@ class FollowerController extends Controller
         return response()->json($followers);
     }
 
+    public function follow(User $user): JsonResponse
+    {
+        abort_if($user->id === auth()->id(), 403);
+
+        $existing = Followee::where('user_id', auth()->id())
+            ->where('followee_id', $user->id)
+            ->first();
+
+        if ($existing) {
+            $existing->delete();
+            $this->clearFollowingCache(auth()->user());
+            return response()->json(['status' => 'none']);
+        }
+
+        $canView = Gate::allows('viewProfileData', $user);
+
+        Followee::create([
+            'user_id'     => auth()->id(),
+            'followee_id' => $user->id,
+            'verified'    => $canView,
+        ]);
+
+        $this->clearFollowingCache(auth()->user());
+
+        Notification::create([
+            'user_id'        => $user->id,
+            'title'          => $canView ? 'New follower' : 'Follow request',
+            'body'           => $canView
+                ? auth()->user()->name . ' is now following you.'
+                : auth()->user()->name . ' wants to follow you.',
+            'is_achievement' => false,
+            'url'            => $canView ? '/u/' . auth()->user()->name : '/follow-requests',
+        ]);
+
+        return response()->json(['status' => $canView ? 'following' : 'requested']);
+    }
+
     public function approve(User $follower): JsonResponse
     {
         $followee = Followee::where('user_id', $follower->id)
@@ -33,6 +72,8 @@ class FollowerController extends Controller
 
         $followee->update(['verified' => true]);
 
+        $this->clearFollowingCache($follower);
+
         Notification::create([
             'user_id'        => $follower->id,
             'title'          => 'Follow request accepted',
@@ -51,6 +92,8 @@ class FollowerController extends Controller
             ->pending()
             ->delete();
 
+        $this->clearFollowingCache($follower);
+
         return response()->json(['status' => 'denied']);
     }
 
@@ -61,6 +104,14 @@ class FollowerController extends Controller
             ->verified()
             ->delete();
 
+        $this->clearFollowingCache($follower);
+
         return response()->json(['status' => 'removed']);
     }
+
+    protected function clearFollowingCache(User $user): void
+    {
+        Cache::forget("user:{$user->id}:following");
+        Cache::forget("user_following_flights_{$user->id}");
+    }
 }

app/Http/Controllers/HomePageController.php

@@ -5,6 +5,7 @@ namespace App\Http\Controllers;
 use App\Models\UserFlight;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
 use Inertia\Inertia;
 use Inertia\Response;
 
@@ -14,9 +15,9 @@ class HomePageController extends Controller
     {
         return Cache::remember('splash_flights', now()->addHours(12), function () {
             return UserFlight::query()
-                ->with(['departureAirport', 'arrivalAirport'])
+                ->with(['departureAirport', 'arrivalAirport', 'user'])
                 ->whereHas('user', function ($query) {
-                    $query->whereRaw("settings->>'profile_privacy' is distinct from 'private'");
+                    $query->whereRaw(DB::raw("settings->>'profile_privacy' is distinct from 'private'"));
                 })
                 ->orderByDesc('departure_date')
                 ->limit(50)

app/Http/Controllers/UserController.php

@@ -9,74 +9,12 @@ use App\Settings\SettingsRegistry;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Gate;
 use Inertia\Inertia;
 
 class UserController extends Controller
 {
-    public function follow(User $user): JsonResponse
-    {
-        abort_if($user->id === auth()->id(), 403);
-
-        $existing = Followee::where('user_id', auth()->id())
-            ->where('followee_id', $user->id)
-            ->first();
-
-        if ($existing) {
-            $existing->delete();
-            return response()->json(['status' => 'none']);
-        }
-
-        $canView = Gate::allows('viewProfileData', $user);
-
-        Followee::create([
-            'user_id'     => auth()->id(),
-            'followee_id' => $user->id,
-            'verified'    => $canView,
-        ]);
-
-        Notification::create([
-            'user_id'        => $user->id,
-            'title'          => $canView ? 'New follower' : 'Follow request',
-            'body'           => $canView
-                ? auth()->user()->name . ' is now following you.'
-                : auth()->user()->name . ' wants to follow you.',
-            'is_achievement' => false,
-            'url'            => $canView ? '/u/' . auth()->user()->name : '/follow-requests',
-        ]);
-
-        return response()->json(['status' => $canView ? 'following' : 'requested']);
-    }
-
-    public function approveRequest(User $follower): JsonResponse
-    {
-        $followee = Followee::where('user_id', $follower->id)
-            ->where('followee_id', auth()->id())
-            ->pending()
-            ->firstOrFail();
-
-        $followee->update(['verified' => true]);
-
-        Notification::create([
-            'user_id'        => $follower->id,
-            'title'          => 'Follow request accepted',
-            'body'           => auth()->user()->name . ' accepted your follow request.',
-            'is_achievement' => false,
-            'url'            => '/u/' . auth()->user()->name,
-        ]);
-
-        return response()->json(['approved' => true]);
-    }
-
-    public function denyRequest(User $follower): JsonResponse
-    {
-        Followee::where('user_id', $follower->id)
-            ->where('followee_id', auth()->id())
-            ->pending()
-            ->delete();
-
-        return response()->json(['denied' => true]);
-    }
 
     public function settings(?string $category = null){
         $allowedTabs = ['general', 'followers'];

app/Http/Middleware/RefreshApiToken.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Listeners\IssueApiToken;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class RefreshApiToken
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        if (!$request->user() || !session('api_token_id')) {
+            return $next($request);
+        }
+
+        $token = $request->user()
+            ->tokens()
+            ->find(session('api_token_id'));
+
+        // Refresh if expired or within 30 minutes of expiry
+        if (!$token || $token->expires_at->subMinutes(30)->isPast()) {
+            app(IssueApiToken::class)->createToken($request->user());
+        }
+
+        return $next($request);
+    }
+}