fitness/app/Http/Controllers/WorkoutController.php

<?php

namespace App\Http\Controllers;

use App\Models\Exercise;
use App\Models\Workout;
use App\Models\WorkoutExercise;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class WorkoutController extends Controller
{
    public function __construct()
    {
        //$this->middleware('auth');
    }

    public function index()
    {
        $workouts = Auth::user()->workouts()->with('assignedByTrainer')->latest()->paginate(10);
        return view('workouts.index', compact('workouts'));
    }

    public function create()
    {
        // Simple create form (builder-like)
        return view('workouts.create');
    }

    public function store(Request $request)
    {
        $data = $request->validate([
            'title' => 'required|string|max:255',
            'notes' => 'nullable|string',
            'estimated_minutes' => 'nullable|integer|min:1|max:600',
        ]);
        $workout = Auth::user()->workouts()->create($data);
        return redirect()->route('workouts.show', $workout)->with('status', 'Workout created');
    }

    public function show(Workout $workout)
    {
        $this->authorizeWorkout($workout);
        $workout->load(['items.exercise', 'assignedByTrainer']);
        $exercises = Exercise::orderBy('name')->limit(20)->get(['id','name','slug']);
        return view('workouts.show', compact('workout', 'exercises'));
    }

    public function searchExercises(Request $request, Workout $workout)
    {
        $this->authorizeWorkout($workout);
        $q = trim((string) $request->query('q', ''));

        $exercises = Exercise::query()
            ->with(['aliases' => fn ($rel) => $rel->where('user_id', Auth::id())])
            ->when($q !== '', fn ($qb) => $qb->where('name', 'like', "%{$q}%"))
            ->orderBy('name')
            ->limit(20)
            ->get(['id', 'name'])
            ->map(fn ($e) => ['id' => $e->id, 'name' => $e->display_name]);

        return response()->json($exercises);
    }

    // Legacy builder route -> redirect to create
    public function builder()
    {
        return redirect()->route('workouts.create');
    }

    public function addExercise(Request $request, Workout $workout)
    {
        $this->authorizeWorkout($workout);
        $data = $request->validate([
            'exercise_id' => 'required|exists:exercises,id',
            'position' => 'nullable|integer|min:1',
            'sets' => 'nullable|integer|min:1|max:20',
            'reps' => 'nullable|integer|min:1|max:200',
            'weight' => 'nullable|numeric|min:0|max:999.99',
            'rest_seconds' => 'nullable|integer|min:0|max:600',
            'notes' => 'nullable|string',
        ]);
        $nextPos = ($workout->items()->max('position') ?? 0) + 1;
        $data['position'] = $data['position'] ?? $nextPos;
        $item = $workout->items()->create($data);
        return back()->with('status', 'Exercise added to workout');
    }

    public function updateExercise(Request $request, Workout $workout, WorkoutExercise $item)
    {
        $this->authorizeWorkout($workout);
        if ($item->workout_id !== $workout->id) { abort(404); }
        $data = $request->validate([
            'position' => 'nullable|integer|min:1',
            'sets' => 'nullable|integer|min:1|max:20',
            'reps' => 'nullable|integer|min:1|max:200',
            'weight' => 'nullable|numeric|min:0|max:999.99',
            'rest_seconds' => 'nullable|integer|min:0|max:600',
            'notes' => 'nullable|string',
        ]);
        $item->update($data);
        return back()->with('status', 'Exercise updated');
    }

    public function removeExercise(Workout $workout, WorkoutExercise $item)
    {
        $this->authorizeWorkout($workout);
        if ($item->workout_id !== $workout->id) { abort(404); }
        $item->delete();
        return back()->with('status', 'Exercise removed');
    }

    public function destroy(Workout $workout)
    {
        // Deletion stays strictly owner-only, even for a trainer-assigned workout.
        if ($workout->user_id !== Auth::id()) {
            abort(403);
        }
        $workout->delete();
        return redirect()->route('workouts.index')->with('status', 'Workout deleted');
    }

    // Allows the owner, or the trainer who assigned this workout, to view and edit it.
    // Session/completion data is intentionally not exposed to the trainer here - only
    // the workout structure they authored.
    protected function authorizeWorkout(Workout $workout): void
    {
        if ($workout->user_id === Auth::id()) {
            return;
        }
        if ($workout->assigned_by_trainer_id && $workout->assigned_by_trainer_id === Auth::id()) {
            return;
        }
        abort(403);
    }
}