Setup Wizard middleware implemented

src/App/Http/Kernel.php

@@ -1,7 +1,9 @@
 <?php
+
 namespace App\Http;
 
 use Fruitcake\Cors\HandleCors;
+use Support\Middleware\ProtectSetupWizardRoutes;
 use Support\Middleware\TrimStrings;
 use Support\Middleware\TrustProxies;
 use Support\Middleware\EncryptCookies;
@@ -73,5 +75,6 @@ class Kernel extends HttpKernel
         'signed'           => \Illuminate\Routing\Middleware\ValidateSignature::class,
         'throttle'         => \Illuminate\Routing\Middleware\ThrottleRequests::class,
         'verified'         => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
+        'setup-wizard'     => ProtectSetupWizardRoutes::class,
     ];
 }

src/App/Providers/RouteServiceProvider.php

@@ -108,8 +108,7 @@ class RouteServiceProvider extends ServiceProvider
 
     protected function mapSetupWizardApiRoutes()
     {
-        Route::prefix('api/setup')
-            ->middleware('api')
+        Route::middleware(['setup-wizard'])
             ->group(base_path('routes/setup.php'));
     }
 }

src/Support/Middleware/ProtectSetupWizardRoutes.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Support\Middleware;
+
+use Closure;
+use Doctrine\DBAL\Driver\PDOException;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Schema;
+
+class ProtectSetupWizardRoutes
+{
+    /**
+     * Prevent access for setup wizard controllers after initial app installation.
+     */
+    public function handle(Request $request, Closure $next): mixed
+    {
+        try {
+            // Check database connections
+            DB::getPdo();
+
+            // Get setup_wizard status
+            if (Schema::hasTable('settings') && get_setting('setup_wizard_success')) {
+                return response('Gone', 410);
+            }
+
+            return $next($request);
+
+        } catch (PDOException $e) {
+            return $next($request);
+        }
+    }
+}