fitness/app/Http/Controllers/Api/TrainerController.php

<?php

namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use App\Http\Resources\UserResource;
use App\Http\Resources\WorkoutResource;
use App\Models\User;
use App\Models\Workout;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class TrainerController extends Controller
{
    public function clients(): JsonResponse
    {
        $trainer = Auth::user();
        $clients = $trainer->clients()
            ->with(['workouts' => function ($q) use ($trainer) {
                $q->where('assigned_by_trainer_id', $trainer->id)->latest();
            }])
            ->orderBy('name')
            ->get();

        return response()->json([
            'data' => $clients->map(fn ($client) => [
                'client' => new UserResource($client),
                'assigned_workouts' => WorkoutResource::collection($client->workouts),
            ]),
        ]);
    }

    public function addClient(Request $request): JsonResponse
    {
        $trainer = Auth::user();
        $data = $request->validate([
            'email' => ['required', 'email', 'exists:users,email'],
        ]);

        $client = User::where('email', $data['email'])->firstOrFail();

        if ($client->id === $trainer->id) {
            return response()->json(['message' => 'You cannot add yourself as a client.'], 422);
        }

        if ($trainer->clients()->where('client_id', $client->id)->exists()) {
            return response()->json(['message' => 'This person is already one of your clients.'], 422);
        }

        $trainer->clients()->attach($client->id);

        return response()->json(['message' => 'Client added', 'client' => new UserResource($client)], 201);
    }

    public function removeClient(User $client): JsonResponse
    {
        Auth::user()->clients()->detach($client->id);

        return response()->json(['message' => 'Client removed']);
    }

    public function storeWorkout(Request $request, User $client): JsonResponse
    {
        $this->authorizeClient($client);

        $data = $request->validate([
            'title' => ['required', 'string', 'max:255'],
            'notes' => ['nullable', 'string'],
            'estimated_minutes' => ['nullable', 'integer', 'min:1', 'max:600'],
        ]);

        $workout = Workout::create([
            'user_id' => $client->id,
            'assigned_by_trainer_id' => Auth::id(),
            'title' => $data['title'],
            'notes' => $data['notes'] ?? null,
            'estimated_minutes' => $data['estimated_minutes'] ?? null,
        ]);

        return response()->json(['workout' => new WorkoutResource($workout)], 201);
    }

    protected function authorizeClient(User $client): void
    {
        if (!Auth::user()->clients()->where('client_id', $client->id)->exists()) {
            abort(403);
        }
    }
}