Build out the trainer role

is_trainer was captured at signup and stored, but nothing in the app
used it - no client roster, no way to assign anything, a dead flag that
misled users who checked it during registration.

Adds a trainer/client link (a trainer adds a client by the email they
registered with) and lets a trainer create workouts directly on a
client's account (assigned_by_trainer_id on workouts). Deliberately
scoped for privacy: a trainer only ever sees/manages the workouts they
authored and assigned - not a client's other private data (their own
workouts, weight log, health notes, session/completion history). That
boundary needs a consent or notification system to relax safely, which
doesn't exist yet, so it's left for a follow-up rather than building it
half-safe.

WorkoutController's authorization now distinguishes "manage" (owner or
assigning trainer - view, add/edit exercises) from "own" (owner only -
delete), so a trainer can build out an assigned workout's exercises
after creating it, but can't delete a client's workout out from under
them.

Found a real bug via live testing before committing: the client roster
page eager-loaded `assignedWorkouts` (keyed by assigned_by_trainer_id)
on each client record, which is the trainer's own perspective, not the
client's - so it silently showed "no workouts assigned" even after
assigning one. Fixed to eager-load `workouts` filtered by
assigned_by_trainer_id instead, with a regression test.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/Http/Controllers/TrainerController.php

@@ -0,0 +1,92 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Models\User;
+use App\Models\Workout;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\View\View;
+
+class TrainerController extends Controller
+{
+    public function clients(): View
+    {
+        $trainer = Auth::user();
+        // Note: `workouts` (user_id) is what a client was assigned, not `assignedWorkouts`
+        // (assigned_by_trainer_id), which belongs to the trainer's own perspective.
+        $clients = $trainer->clients()
+            ->with(['workouts' => function ($q) use ($trainer) {
+                $q->where('assigned_by_trainer_id', $trainer->id)->latest();
+            }])
+            ->orderBy('name')
+            ->get();
+
+        return view('trainer.clients', compact('clients'));
+    }
+
+    public function addClient(Request $request): RedirectResponse
+    {
+        $trainer = Auth::user();
+        $data = $request->validate([
+            'email' => ['required', 'email', 'exists:users,email'],
+        ]);
+
+        $client = User::where('email', $data['email'])->firstOrFail();
+
+        if ($client->id === $trainer->id) {
+            return back()->withErrors(['email' => 'You cannot add yourself as a client.']);
+        }
+
+        if ($trainer->clients()->where('client_id', $client->id)->exists()) {
+            return back()->withErrors(['email' => 'This person is already one of your clients.']);
+        }
+
+        $trainer->clients()->attach($client->id);
+
+        return back()->with('status', 'Client added');
+    }
+
+    public function removeClient(User $client): RedirectResponse
+    {
+        Auth::user()->clients()->detach($client->id);
+
+        return back()->with('status', 'Client removed');
+    }
+
+    public function createWorkout(User $client): View
+    {
+        $this->authorizeClient($client);
+
+        return view('trainer.assign-workout', compact('client'));
+    }
+
+    public function storeWorkout(Request $request, User $client): RedirectResponse
+    {
+        $this->authorizeClient($client);
+
+        $data = $request->validate([
+            'title' => ['required', 'string', 'max:255'],
+            'notes' => ['nullable', 'string'],
+            'estimated_minutes' => ['nullable', 'integer', 'min:1', 'max:600'],
+        ]);
+
+        $workout = Workout::create([
+            'user_id' => $client->id,
+            'assigned_by_trainer_id' => Auth::id(),
+            'title' => $data['title'],
+            'notes' => $data['notes'] ?? null,
+            'estimated_minutes' => $data['estimated_minutes'] ?? null,
+        ]);
+
+        return redirect()->route('trainer.clients')->with('status', "Workout assigned to {$client->name}");
+    }
+
+    protected function authorizeClient(User $client): void
+    {
+        if (!Auth::user()->clients()->where('client_id', $client->id)->exists()) {
+            abort(403);
+        }
+    }
+}

app/Http/Controllers/WorkoutController.php

@@ -17,7 +17,7 @@ class WorkoutController extends Controller
 
     public function index()
     {
-        $workouts = Auth::user()->workouts()->latest()->paginate(10);
+        $workouts = Auth::user()->workouts()->with('assignedByTrainer')->latest()->paginate(10);
         return view('workouts.index', compact('workouts'));
     }
 
@@ -41,7 +41,7 @@ class WorkoutController extends Controller
     public function show(Workout $workout)
     {
         $this->authorizeWorkout($workout);
-        $workout->load(['items.exercise']);
+        $workout->load(['items.exercise', 'assignedByTrainer']);
         $exercises = Exercise::orderBy('name')->limit(20)->get(['id','name','slug']);
         return view('workouts.show', compact('workout', 'exercises'));
     }
@@ -112,15 +112,25 @@ class WorkoutController extends Controller
 
     public function destroy(Workout $workout)
     {
-        $this->authorizeWorkout($workout);
+        // Deletion stays strictly owner-only, even for a trainer-assigned workout.
+        if ($workout->user_id !== Auth::id()) {
+            abort(403);
+        }
         $workout->delete();
         return redirect()->route('workouts.index')->with('status', 'Workout deleted');
     }
 
+    // Allows the owner, or the trainer who assigned this workout, to view and edit it.
+    // Session/completion data is intentionally not exposed to the trainer here - only
+    // the workout structure they authored.
     protected function authorizeWorkout(Workout $workout): void
     {
-        if ($workout->user_id !== Auth::id()) {
+        if ($workout->user_id === Auth::id()) {
-            abort(403);
+            return;
         }
+        if ($workout->assigned_by_trainer_id && $workout->assigned_by_trainer_id === Auth::id()) {
+            return;
+        }
+        abort(403);
     }
 }

app/Http/Middleware/Trainer.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Symfony\Component\HttpFoundation\Response;
+
+class Trainer
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = Auth::user();
+        if (!$user || !$user->is_trainer) {
+            abort(403);
+        }
+        return $next($request);
+    }
+}

app/Models/User.php

@@ -74,6 +74,22 @@ class User extends Authenticatable
         return $this->hasMany(Program::class);
     }
 
+    // Trainer/client relationships
+    public function clients()
+    {
+        return $this->belongsToMany(User::class, 'trainer_clients', 'trainer_id', 'client_id')->withTimestamps();
+    }
+
+    public function trainers()
+    {
+        return $this->belongsToMany(User::class, 'trainer_clients', 'client_id', 'trainer_id')->withTimestamps();
+    }
+
+    public function assignedWorkouts()
+    {
+        return $this->hasMany(Workout::class, 'assigned_by_trainer_id');
+    }
+
     public function favoriteExercises()
     {
         return $this->belongsToMany(Exercise::class, 'exercise_favorites')->withTimestamps();

app/Models/Workout.php

@@ -20,6 +20,7 @@ class Workout extends Model
         'program_id',
         'week_number',
         'day_number',
+        'assigned_by_trainer_id',
     ];
 
     protected $casts = [
@@ -38,6 +39,11 @@ class Workout extends Model
         return $this->belongsTo(Program::class);
     }
 
+    public function assignedByTrainer(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'assigned_by_trainer_id');
+    }
+
     public function items(): HasMany
     {
         return $this->hasMany(WorkoutExercise::class)->orderBy('position');

bootstrap/app.php

@@ -17,6 +17,7 @@ return Application::configure(basePath: dirname(__DIR__))
         ]);
         $middleware->alias([
             'admin' => \App\Http\Middleware\Admin::class,
+            'trainer' => \App\Http\Middleware\Trainer::class,
         ]);
     })
     ->withExceptions(function (Exceptions $exceptions): void {

database/migrations/2026_08_10_092220_add_assigned_by_trainer_to_workouts_table.php

@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('workouts', function (Blueprint $table) {
+            $table->foreignId('assigned_by_trainer_id')->nullable()->after('day_number')->constrained('users')->nullOnDelete();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('workouts', function (Blueprint $table) {
+            $table->dropConstrainedForeignId('assigned_by_trainer_id');
+        });
+    }
+};

database/migrations/2026_08_10_092220_create_trainer_clients_table.php

@@ -0,0 +1,31 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('trainer_clients', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('trainer_id')->constrained('users')->cascadeOnDelete();
+            $table->foreignId('client_id')->constrained('users')->cascadeOnDelete();
+            $table->timestamps();
+
+            $table->unique(['trainer_id', 'client_id']);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('trainer_clients');
+    }
+};

lang/en/app.php

@@ -9,6 +9,7 @@ return [
             'build_workout' => 'Build a Workout',
             'dashboard' => 'Dashboard',
             'programs' => 'Programs',
+            'clients' => 'Clients',
             'admin' => 'Admin',
         'profile' => 'Profile',
         'logout' => 'Log Out',

lang/ro/app.php

@@ -9,6 +9,7 @@ return [
             'build_workout' => 'Creează un antrenament',
             'dashboard' => 'Tabloul de bord',
             'programs' => 'Programe',
+            'clients' => 'Clienți',
             'admin' => 'Admin',
         'profile' => 'Profil',
         'logout' => 'Deconectare',

resources/views/layouts/navigation.blade.php

@@ -20,6 +20,9 @@
                     @auth
                         <a href="{{ route('dashboard') }}" class="text-sm font-medium text-gray-700 dark:text-gray-300 hover:text-gray-900 dark:hover:text-white">{{ __('app.nav.dashboard') }}</a>
                         <a href="{{ route('programs.index') }}" class="text-sm font-medium text-gray-700 dark:text-gray-300 hover:text-gray-900 dark:hover:text-white">{{ __('app.nav.programs') }}</a>
+                        @if(Auth::user()->is_trainer)
+                            <a href="{{ route('trainer.clients') }}" class="text-sm font-medium text-gray-700 dark:text-gray-300 hover:text-gray-900 dark:hover:text-white">{{ __('app.nav.clients') }}</a>
+                        @endif
                         @if(Auth::user()->is_admin)
                             <a href="{{ route('admin.dashboard') }}" class="text-sm font-medium text-indigo-700 dark:text-indigo-300 hover:text-indigo-900 dark:hover:text-indigo-200">{{ __('app.nav.admin') }}</a>
                         @endif
@@ -100,6 +103,9 @@
             @auth
                 <x-responsive-nav-link :href="route('dashboard')">{{ __('app.nav.dashboard') }}</x-responsive-nav-link>
                 <x-responsive-nav-link :href="route('programs.index')">{{ __('app.nav.programs') }}</x-responsive-nav-link>
+                @if(Auth::user()->is_trainer)
+                    <x-responsive-nav-link :href="route('trainer.clients')">{{ __('app.nav.clients') }}</x-responsive-nav-link>
+                @endif
                 @if(Auth::user()->is_admin)
                     <x-responsive-nav-link :href="route('admin.dashboard')">{{ __('app.nav.admin') }}</x-responsive-nav-link>
                 @endif

resources/views/trainer/assign-workout.blade.php

@@ -0,0 +1,37 @@
+<x-app-layout>
+    <section class="bg-white dark:bg-gray-900 border-b border-gray-100 dark:border-gray-800">
+        <div class="mx-auto max-w-7xl px-4 sm:px-6 lg:px-8 py-8">
+            <a href="{{ route('trainer.clients') }}" class="text-sm text-gray-600 dark:text-gray-300 hover:text-gray-900 dark:hover:text-white">&larr; My Clients</a>
+            <h1 class="mt-2 text-2xl sm:text-3xl font-extrabold tracking-tight text-gray-900 dark:text-white">Assign a Workout to {{ $client->name }}</h1>
+            <p class="mt-2 text-gray-600 dark:text-gray-300">You'll be able to add exercises to it right after creating it.</p>
+        </div>
+    </section>
+
+    <section class="mx-auto max-w-2xl px-4 sm:px-6 lg:px-8 py-8">
+        @if ($errors->any())
+            <div class="mb-4 rounded-xl bg-red-50 text-red-700 px-4 py-3">
+                <ul class="list-disc ms-5 text-sm">
+                    @foreach ($errors->all() as $error)
+                        <li>{{ $error }}</li>
+                    @endforeach
+                </ul>
+            </div>
+        @endif
+        <form method="POST" action="{{ route('trainer.workouts.store', $client) }}" class="space-y-5 bg-white dark:bg-gray-800 rounded-2xl p-6 ring-1 ring-gray-200 dark:ring-gray-700">
+            @csrf
+            <div>
+                <label class="block text-sm font-medium text-gray-700 dark:text-gray-300">Title</label>
+                <input type="text" name="title" required placeholder="e.g. Week 1 - Push Day" class="mt-1 w-full rounded-xl border-gray-300 dark:border-gray-700 bg-white/80 dark:bg-gray-900 text-gray-900 dark:text-gray-100 px-3 py-2">
+            </div>
+            <div>
+                <label class="block text-sm font-medium text-gray-700 dark:text-gray-300">Estimated minutes</label>
+                <input type="number" name="estimated_minutes" min="1" max="600" class="mt-1 w-32 rounded-xl border-gray-300 dark:border-gray-700 bg-white/80 dark:bg-gray-900 text-gray-900 dark:text-gray-100 px-3 py-2">
+            </div>
+            <div>
+                <label class="block text-sm font-medium text-gray-700 dark:text-gray-300">Notes</label>
+                <textarea name="notes" rows="3" class="mt-1 w-full rounded-xl border-gray-300 dark:border-gray-700 bg-white/80 dark:bg-gray-900 text-gray-900 dark:text-gray-100 px-3 py-2"></textarea>
+            </div>
+            <button type="submit" class="inline-flex items-center rounded-xl bg-gradient-to-r from-fuchsia-600 to-indigo-600 px-4 py-2 text-sm font-semibold text-white shadow hover:from-fuchsia-500 hover:to-indigo-500">Assign Workout</button>
+        </form>
+    </section>
+</x-app-layout>

resources/views/trainer/clients.blade.php

@@ -0,0 +1,70 @@
+<x-app-layout>
+    <section class="bg-white dark:bg-gray-900 border-b border-gray-100 dark:border-gray-800">
+        <div class="mx-auto max-w-7xl px-4 sm:px-6 lg:px-8 py-8">
+            <h1 class="text-2xl sm:text-3xl font-extrabold tracking-tight text-gray-900 dark:text-white">My Clients</h1>
+            <p class="mt-2 text-gray-600 dark:text-gray-300">Add clients by the email they registered with, and assign them workouts.</p>
+        </div>
+    </section>
+
+    <section class="mx-auto max-w-7xl px-4 sm:px-6 lg:px-8 py-6">
+        @if(session('status'))
+            <div class="mb-4 rounded-xl bg-emerald-50 text-emerald-700 px-4 py-3">{{ session('status') }}</div>
+        @endif
+        @if ($errors->any())
+            <div class="mb-4 rounded-xl bg-red-50 text-red-700 px-4 py-3">
+                <ul class="list-disc ms-5 text-sm">
+                    @foreach ($errors->all() as $error)
+                        <li>{{ $error }}</li>
+                    @endforeach
+                </ul>
+            </div>
+        @endif
+
+        <form method="POST" action="{{ route('trainer.clients.add') }}" class="mb-6 flex items-end gap-3 bg-white dark:bg-gray-800 rounded-2xl p-4 ring-1 ring-gray-200 dark:ring-gray-700">
+            @csrf
+            <div class="w-full sm:w-80">
+                <label class="block text-sm font-medium text-gray-700 dark:text-gray-300">Client's email</label>
+                <input type="email" name="email" required placeholder="client@example.com" class="mt-1 w-full rounded-xl border-gray-300 dark:border-gray-700 bg-white/80 dark:bg-gray-900 text-gray-900 dark:text-gray-100 px-3 py-2">
+            </div>
+            <button type="submit" class="inline-flex items-center rounded-xl bg-gradient-to-r from-fuchsia-600 to-indigo-600 px-4 py-2 text-sm font-semibold text-white shadow hover:from-fuchsia-500 hover:to-indigo-500">Add Client</button>
+        </form>
+
+        @if($clients->isEmpty())
+            <div class="rounded-2xl border border-dashed border-gray-300 dark:border-gray-700 p-8 text-center text-gray-600 dark:text-gray-300">No clients yet. Add one by email above.</div>
+        @else
+            <div class="grid grid-cols-1 lg:grid-cols-2 gap-6">
+                @foreach($clients as $client)
+                    <div class="rounded-2xl ring-1 ring-gray-200 dark:ring-gray-700 bg-white dark:bg-gray-800 p-5">
+                        <div class="flex items-center justify-between">
+                            <div>
+                                <h3 class="text-lg font-semibold text-gray-900 dark:text-white">{{ $client->name }}</h3>
+                                <p class="text-sm text-gray-600 dark:text-gray-300">{{ $client->email }}</p>
+                            </div>
+                            <div class="flex items-center gap-3">
+                                <a href="{{ route('trainer.workouts.create', $client) }}" class="text-sm font-semibold text-indigo-600 hover:text-indigo-500">Assign workout</a>
+                                <form method="POST" action="{{ route('trainer.clients.remove', $client) }}" onsubmit="return confirm('Remove {{ $client->name }} from your clients?');">
+                                    @csrf
+                                    @method('DELETE')
+                                    <button type="submit" class="text-sm text-red-600 hover:text-red-500">Remove</button>
+                                </form>
+                            </div>
+                        </div>
+
+                        @if($client->workouts->isEmpty())
+                            <p class="mt-4 text-sm text-gray-500">No workouts assigned yet.</p>
+                        @else
+                            <ul class="mt-4 space-y-2">
+                                @foreach($client->workouts as $workout)
+                                    <li class="flex items-center justify-between rounded-xl ring-1 ring-gray-200 dark:ring-gray-700 bg-white dark:bg-gray-900 px-3 py-2 text-sm">
+                                        <span class="text-gray-900 dark:text-gray-100">{{ $workout->title }}</span>
+                                        <span class="text-gray-500">{{ $workout->created_at->format('M j, Y') }}</span>
+                                    </li>
+                                @endforeach
+                            </ul>
+                        @endif
+                    </div>
+                @endforeach
+            </div>
+        @endif
+    </section>
+</x-app-layout>

resources/views/workouts/index.blade.php

@@ -23,6 +23,9 @@
                     <div class="rounded-2xl ring-1 ring-gray-200 dark:ring-gray-700 bg-white dark:bg-gray-800 p-5 flex flex-col">
                         <div class="flex-1">
                             <h3 class="text-lg font-semibold text-gray-900 dark:text-white">{{ $workout->title }}</h3>
+                            @if($workout->assignedByTrainer)
+                                <span class="mt-1 inline-flex items-center rounded-full bg-indigo-100 dark:bg-indigo-900/40 text-indigo-700 dark:text-indigo-300 px-2.5 py-0.5 text-xs font-medium">Assigned by {{ $workout->assignedByTrainer->name }}</span>
+                            @endif
                             @if($workout->estimated_minutes)
                                 <p class="mt-1 text-sm text-gray-600 dark:text-gray-300">~ {{ $workout->estimated_minutes }} min</p>
                             @endif

resources/views/workouts/show.blade.php

@@ -23,6 +23,9 @@
                             </form>
                         @endauth
                     </div>
+                    @if($workout->assignedByTrainer)
+                        <span class="mt-2 inline-flex items-center rounded-full bg-indigo-100 dark:bg-indigo-900/40 text-indigo-700 dark:text-indigo-300 px-2.5 py-0.5 text-xs font-medium">Assigned by {{ $workout->assignedByTrainer->name }}</span>
+                    @endif
                     <p class="mt-1 text-gray-600 dark:text-gray-300">@if($workout->estimated_minutes) ~ {{ $workout->estimated_minutes }} min · @endif {{ $workout->items->count() }} exercises</p>
                 </div>
                 <div class="flex items-center gap-3">

routes/web.php

@@ -60,6 +60,15 @@ Route::middleware('auth')->prefix('/workouts')->group(function () {
     Route::post('/{workout}/sessions', [\App\Http\Controllers\WorkoutSessionController::class, 'store'])->name('sessions.store');
 });
 
+// Trainer: manage clients and assign workouts to them
+Route::middleware(['auth', 'trainer'])->prefix('/trainer')->group(function () {
+    Route::get('/clients', [\App\Http\Controllers\TrainerController::class, 'clients'])->name('trainer.clients');
+    Route::post('/clients', [\App\Http\Controllers\TrainerController::class, 'addClient'])->name('trainer.clients.add');
+    Route::delete('/clients/{client}', [\App\Http\Controllers\TrainerController::class, 'removeClient'])->name('trainer.clients.remove');
+    Route::get('/clients/{client}/workouts/create', [\App\Http\Controllers\TrainerController::class, 'createWorkout'])->name('trainer.workouts.create');
+    Route::post('/clients/{client}/workouts', [\App\Http\Controllers\TrainerController::class, 'storeWorkout'])->name('trainer.workouts.store');
+});
+
 Route::middleware('auth')->prefix('/programs')->group(function () {
     Route::get('/', [\App\Http\Controllers\ProgramController::class, 'index'])->name('programs.index');
     Route::get('/create', [\App\Http\Controllers\ProgramController::class, 'create'])->name('programs.create');

tests/Feature/TrainerTest.php

@@ -0,0 +1,199 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use App\Models\Workout;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class TrainerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function trainer(): User
+    {
+        $trainer = User::factory()->create();
+        $trainer->is_trainer = true;
+        $trainer->save();
+
+        return $trainer;
+    }
+
+    public function test_guest_is_redirected_to_login(): void
+    {
+        $response = $this->get(route('trainer.clients'));
+
+        $response->assertRedirect(route('login'));
+    }
+
+    public function test_non_trainer_is_forbidden(): void
+    {
+        $user = User::factory()->create();
+
+        $response = $this->actingAs($user)->get(route('trainer.clients'));
+
+        $response->assertForbidden();
+    }
+
+    public function test_trainer_can_add_a_client_by_email(): void
+    {
+        $trainer = $this->trainer();
+        $client = User::factory()->create(['email' => 'client@example.com']);
+
+        $response = $this->actingAs($trainer)->post(route('trainer.clients.add'), [
+            'email' => 'client@example.com',
+        ]);
+
+        $response->assertRedirect();
+        $this->assertTrue($trainer->clients()->where('client_id', $client->id)->exists());
+    }
+
+    public function test_trainer_cannot_add_themselves_as_a_client(): void
+    {
+        $trainer = $this->trainer();
+
+        $response = $this->actingAs($trainer)->post(route('trainer.clients.add'), [
+            'email' => $trainer->email,
+        ]);
+
+        $response->assertSessionHasErrors('email');
+        $this->assertFalse($trainer->clients()->where('client_id', $trainer->id)->exists());
+    }
+
+    public function test_trainer_cannot_add_the_same_client_twice(): void
+    {
+        $trainer = $this->trainer();
+        $client = User::factory()->create();
+        $trainer->clients()->attach($client->id);
+
+        $response = $this->actingAs($trainer)->post(route('trainer.clients.add'), [
+            'email' => $client->email,
+        ]);
+
+        $response->assertSessionHasErrors('email');
+        $this->assertEquals(1, $trainer->clients()->where('client_id', $client->id)->count());
+    }
+
+    public function test_trainer_cannot_add_a_client_with_an_unknown_email(): void
+    {
+        $trainer = $this->trainer();
+
+        $response = $this->actingAs($trainer)->post(route('trainer.clients.add'), [
+            'email' => 'nobody@example.com',
+        ]);
+
+        $response->assertSessionHasErrors('email');
+    }
+
+    public function test_trainer_can_remove_a_client(): void
+    {
+        $trainer = $this->trainer();
+        $client = User::factory()->create();
+        $trainer->clients()->attach($client->id);
+
+        $response = $this->actingAs($trainer)->delete(route('trainer.clients.remove', $client));
+
+        $response->assertRedirect();
+        $this->assertFalse($trainer->clients()->where('client_id', $client->id)->exists());
+    }
+
+    public function test_trainer_can_assign_a_workout_to_their_client(): void
+    {
+        $trainer = $this->trainer();
+        $client = User::factory()->create();
+        $trainer->clients()->attach($client->id);
+
+        $response = $this->actingAs($trainer)->post(route('trainer.workouts.store', $client), [
+            'title' => 'Week 1 Push Day',
+        ]);
+
+        $response->assertRedirect(route('trainer.clients'));
+        $this->assertDatabaseHas('workouts', [
+            'user_id' => $client->id,
+            'assigned_by_trainer_id' => $trainer->id,
+            'title' => 'Week 1 Push Day',
+        ]);
+    }
+
+    public function test_client_roster_lists_workouts_assigned_to_each_client(): void
+    {
+        $trainer = $this->trainer();
+        $client = User::factory()->create(['name' => 'Jamie Client']);
+        $trainer->clients()->attach($client->id);
+        Workout::factory()->create([
+            'user_id' => $client->id,
+            'assigned_by_trainer_id' => $trainer->id,
+            'title' => 'Week 1 Push Day',
+        ]);
+        // A workout the client made for themselves should not show up as "assigned".
+        Workout::factory()->create(['user_id' => $client->id, 'title' => 'My Own Workout']);
+
+        $response = $this->actingAs($trainer)->get(route('trainer.clients'));
+
+        $response->assertOk();
+        $response->assertSee('Week 1 Push Day');
+        $response->assertDontSee('My Own Workout');
+    }
+
+    public function test_trainer_cannot_assign_a_workout_to_a_non_client(): void
+    {
+        $trainer = $this->trainer();
+        $stranger = User::factory()->create();
+
+        $response = $this->actingAs($trainer)->post(route('trainer.workouts.store', $stranger), [
+            'title' => 'Week 1 Push Day',
+        ]);
+
+        $response->assertForbidden();
+    }
+
+    public function test_client_can_manage_their_assigned_workout(): void
+    {
+        $trainer = $this->trainer();
+        $client = User::factory()->create();
+        $trainer->clients()->attach($client->id);
+        $workout = Workout::factory()->create(['user_id' => $client->id, 'assigned_by_trainer_id' => $trainer->id]);
+
+        $response = $this->actingAs($client)->get(route('workouts.show', $workout));
+
+        $response->assertOk();
+    }
+
+    public function test_assigning_trainer_can_view_and_edit_the_assigned_workout(): void
+    {
+        $trainer = $this->trainer();
+        $client = User::factory()->create();
+        $trainer->clients()->attach($client->id);
+        $workout = Workout::factory()->create(['user_id' => $client->id, 'assigned_by_trainer_id' => $trainer->id]);
+
+        $response = $this->actingAs($trainer)->get(route('workouts.show', $workout));
+        $response->assertOk();
+    }
+
+    public function test_assigning_trainer_cannot_delete_the_assigned_workout(): void
+    {
+        $trainer = $this->trainer();
+        $client = User::factory()->create();
+        $trainer->clients()->attach($client->id);
+        $workout = Workout::factory()->create(['user_id' => $client->id, 'assigned_by_trainer_id' => $trainer->id]);
+
+        $response = $this->actingAs($trainer)->delete(route('workouts.destroy', $workout));
+
+        $response->assertForbidden();
+        $this->assertDatabaseHas('workouts', ['id' => $workout->id]);
+    }
+
+    public function test_unrelated_trainer_cannot_view_someone_elses_assigned_workout(): void
+    {
+        $trainer = $this->trainer();
+        $otherTrainer = $this->trainer();
+        $client = User::factory()->create();
+        $trainer->clients()->attach($client->id);
+        $workout = Workout::factory()->create(['user_id' => $client->id, 'assigned_by_trainer_id' => $trainer->id]);
+
+        $response = $this->actingAs($otherTrainer)->get(route('workouts.show', $workout));
+
+        $response->assertForbidden();
+    }
+}