'verified' route middleware on every dashboard route is structurally dead code — email verification can never be enforced

[morcen]

What

routes/web.php:81 wraps the core authenticated routes (/dashboard, /endpoints, /events, /deliveries, etc.) in Laravel's 'verified' middleware group. That middleware (Illuminate\Auth\Middleware\EnsureEmailIsVerified) only takes action when $request->user() instanceof MustVerifyEmail — otherwise it's a silent no-op and lets every request through unconditionally.

In this app, that interface is never implemented:

• app/Models/User.php:5 — // use Illuminate\Contracts\Auth\MustVerifyEmail; is commented out, and the User class doesn't implement it.
• config/fortify.php:149 — // Features::emailVerification(), is commented out, so Fortify's verification feature (routes, notifications, the "must verify" flow) is entirely disabled too.

Why it matters

Because User never implements MustVerifyEmail, the 'verified' middleware guarding every dashboard/API-surface web route is guaranteed to be a permanent no-op — not "email verification is currently off," but "this middleware structurally cannot ever enforce anything, for any user, regardless of future config changes to that route file alone." A reader of routes/web.php reasonably infers that unverified users are blocked from the dashboard; they are not, and never were. This is related to but distinct from already-tracked issue #162 (a dead, always-skipped test file for email verification) — that issue is about test coverage; this one is about the production route middleware itself being non-functional. Fixing #162 in isolation (e.g. just re-enabling Features::emailVerification() in Fortify config) would not fix this, since User still wouldn't implement MustVerifyEmail and Fortify's feature flag alone doesn't wire that up.

Suggested fix

Pick one of two directions and make the code match the apparent intent:

1. If email verification is meant to be enforced (which the presence of 'verified' middleware on every core route strongly implies): implement MustVerifyEmail on App\Models\User, uncomment Features::emailVerification() in config/fortify.php, and add coverage that an unverified user is actually redirected away from /dashboard.
2. If email verification is intentionally not required: remove the 'verified' middleware from routes/web.php so the route definitions don't mislead readers/reviewers into believing there's an enforcement boundary that doesn't exist, and close out EmailVerificationTest is an always-skipped test file — a 4th dead file beyond the 3 already tracked in #154 #162's dead test file as "won't implement" rather than "re-enable."

Either way, a test asserting the actual (rather than apparent) behavior of these routes for an unverified user would have caught this drift.