*/ public const BLOCKED_ROUTES = [ 'two-factor.enable', 'two-factor.confirm', 'two-factor.disable', 'two-factor.qr-code', 'two-factor.secret-key', 'two-factor.recovery-codes', 'two-factor.regenerate-recovery-codes', // Passkeys löscht die Sicherheitsseite mit Identitätsnachweis // (Entscheidung 5, 07.10.2026). 'passkey.destroy', ]; public function handle(Request $request, Closure $next): Response { if (in_array($request->route()?->getName(), self::BLOCKED_ROUTES, true)) { abort(404); } return $next($request); } }