root/fitness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Build out the trainer role

Browse Source 
is_trainer was captured at signup and stored, but nothing in the app
used it - no client roster, no way to assign anything, a dead flag that
misled users who checked it during registration.

Adds a trainer/client link (a trainer adds a client by the email they
registered with) and lets a trainer create workouts directly on a
client's account (assigned_by_trainer_id on workouts). Deliberately
scoped for privacy: a trainer only ever sees/manages the workouts they
authored and assigned - not a client's other private data (their own
workouts, weight log, health notes, session/completion history). That
boundary needs a consent or notification system to relax safely, which
doesn't exist yet, so it's left for a follow-up rather than building it
half-safe.

WorkoutController's authorization now distinguishes "manage" (owner or
assigning trainer - view, add/edit exercises) from "own" (owner only -
delete), so a trainer can build out an assigned workout's exercises
after creating it, but can't delete a client's workout out from under
them.

Found a real bug via live testing before committing: the client roster
page eager-loaded `assignedWorkouts` (keyed by assigned_by_trainer_id)
on each client record, which is the trainer's own perspective, not the
client's - so it silently showed "no workouts assigned" even after
assigning one. Fixed to eager-load `workouts` filtered by
assigned_by_trainer_id instead, with a regression test.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
root
2026-08-10 12:28:23 +03:00
co-authored by Claude Sonnet 5
parent ebd0578dc9
commit e8173ff90a
17 changed files with 543 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Controllers/TrainerController.php
+92
View File
@@ -0,0 +1,92 @@
<?php
namespace App\Http\Controllers;
use App\Models\User;
use App\Models\Workout;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\View\View;
class TrainerController extends Controller
{
public function clients(): View
{
$trainer = Auth::user();
// Note: `workouts` (user_id) is what a client was assigned, not `assignedWorkouts`
// (assigned_by_trainer_id), which belongs to the trainer's own perspective.
$clients = $trainer->clients()
->with(['workouts' => function ($q) use ($trainer) {
$q->where('assigned_by_trainer_id', $trainer->id)->latest();
}])
->orderBy('name')
->get();
return view('trainer.clients', compact('clients'));
}
public function addClient(Request $request): RedirectResponse
{
$trainer = Auth::user();
$data = $request->validate([
'email' => ['required', 'email', 'exists:users,email'],
]);
$client = User::where('email', $data['email'])->firstOrFail();
if ($client->id === $trainer->id) {
return back()->withErrors(['email' => 'You cannot add yourself as a client.']);
}
if ($trainer->clients()->where('client_id', $client->id)->exists()) {
return back()->withErrors(['email' => 'This person is already one of your clients.']);
}
$trainer->clients()->attach($client->id);
return back()->with('status', 'Client added');
}
public function removeClient(User $client): RedirectResponse
{
Auth::user()->clients()->detach($client->id);
return back()->with('status', 'Client removed');
}
public function createWorkout(User $client): View
{
$this->authorizeClient($client);
return view('trainer.assign-workout', compact('client'));
}
public function storeWorkout(Request $request, User $client): RedirectResponse
{
$this->authorizeClient($client);
$data = $request->validate([
'title' => ['required', 'string', 'max:255'],
'notes' => ['nullable', 'string'],
'estimated_minutes' => ['nullable', 'integer', 'min:1', 'max:600'],
]);
$workout = Workout::create([
'user_id' => $client->id,
'assigned_by_trainer_id' => Auth::id(),
'title' => $data['title'],
'notes' => $data['notes'] ?? null,
'estimated_minutes' => $data['estimated_minutes'] ?? null,
]);
return redirect()->route('trainer.clients')->with('status', "Workout assigned to {$client->name}");
}
protected function authorizeClient(User $client): void
{
if (!Auth::user()->clients()->where('client_id', $client->id)->exists()) {
abort(403);
}
}
}
app/Http/Controllers/WorkoutController.php
+15 -5
View File
@@ -17,7 +17,7 @@ class WorkoutController extends Controller
public function index()
{
$workouts = Auth::user()->workouts()->latest()->paginate(10);
$workouts = Auth::user()->workouts()->with('assignedByTrainer')->latest()->paginate(10);
return view('workouts.index', compact('workouts'));
}
@@ -41,7 +41,7 @@ class WorkoutController extends Controller
public function show(Workout $workout)
{
$this->authorizeWorkout($workout);
$workout->load(['items.exercise']);
$workout->load(['items.exercise', 'assignedByTrainer']);
$exercises = Exercise::orderBy('name')->limit(20)->get(['id','name','slug']);
return view('workouts.show', compact('workout', 'exercises'));
}
@@ -112,15 +112,25 @@ class WorkoutController extends Controller
public function destroy(Workout $workout)
{
$this->authorizeWorkout($workout);
// Deletion stays strictly owner-only, even for a trainer-assigned workout.
if ($workout->user_id !== Auth::id()) {
abort(403);
}
$workout->delete();
return redirect()->route('workouts.index')->with('status', 'Workout deleted');
}
// Allows the owner, or the trainer who assigned this workout, to view and edit it.
// Session/completion data is intentionally not exposed to the trainer here - only
// the workout structure they authored.
protected function authorizeWorkout(Workout $workout): void
{
if ($workout->user_id !== Auth::id()) {
abort(403);
if ($workout->user_id === Auth::id()) {
return;
}
if ($workout->assigned_by_trainer_id && $workout->assigned_by_trainer_id === Auth::id()) {
return;
}
abort(403);
}
}
app/Http/Middleware/Trainer.php
+25
View File
@@ -0,0 +1,25 @@
<?php
namespace App\Http\Middleware;
use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Symfony\Component\HttpFoundation\Response;
class Trainer
{
/**
* Handle an incoming request.
*
* @param \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response) $next
*/
public function handle(Request $request, Closure $next): Response
{
$user = Auth::user();
if (!$user || !$user->is_trainer) {
abort(403);
}
return $next($request);
}
}
app/Models/User.php
+16
View File
@@ -74,6 +74,22 @@ class User extends Authenticatable
return $this->hasMany(Program::class);
}
// Trainer/client relationships
public function clients()
{
return $this->belongsToMany(User::class, 'trainer_clients', 'trainer_id', 'client_id')->withTimestamps();
}
public function trainers()
{
return $this->belongsToMany(User::class, 'trainer_clients', 'client_id', 'trainer_id')->withTimestamps();
}
public function assignedWorkouts()
{
return $this->hasMany(Workout::class, 'assigned_by_trainer_id');
}
public function favoriteExercises()
{
return $this->belongsToMany(Exercise::class, 'exercise_favorites')->withTimestamps();
app/Models/Workout.php
+6
View File
@@ -20,6 +20,7 @@ class Workout extends Model
'program_id',
'week_number',
'day_number',
'assigned_by_trainer_id',
];
protected $casts = [
@@ -38,6 +39,11 @@ class Workout extends Model
return $this->belongsTo(Program::class);
}
public function assignedByTrainer(): BelongsTo
{
return $this->belongsTo(User::class, 'assigned_by_trainer_id');
}
public function items(): HasMany
{
return $this->hasMany(WorkoutExercise::class)->orderBy('position');
bootstrap/app.php
+1
View File
@@ -17,6 +17,7 @@ return Application::configure(basePath: dirname(__DIR__))
]);
$middleware->alias([
'admin' => \App\Http\Middleware\Admin::class,
'trainer' => \App\Http\Middleware\Trainer::class,
]);
})
->withExceptions(function (Exceptions $exceptions): void {
database/migrations/2026_08_10_092220_add_assigned_by_trainer_to_workouts_table.php
+28
View File
@@ -0,0 +1,28 @@
<?php
use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;
return new class extends Migration
{
/**
* Run the migrations.
*/
public function up(): void
{
Schema::table('workouts', function (Blueprint $table) {
$table->foreignId('assigned_by_trainer_id')->nullable()->after('day_number')->constrained('users')->nullOnDelete();
});
}
/**
* Reverse the migrations.
*/
public function down(): void
{
Schema::table('workouts', function (Blueprint $table) {
$table->dropConstrainedForeignId('assigned_by_trainer_id');
});
}
};
database/migrations/2026_08_10_092220_create_trainer_clients_table.php
+31
View File
@@ -0,0 +1,31 @@
<?php
use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;
return new class extends Migration
{
/**
* Run the migrations.
*/
public function up(): void
{
Schema::create('trainer_clients', function (Blueprint $table) {
$table->id();
$table->foreignId('trainer_id')->constrained('users')->cascadeOnDelete();
$table->foreignId('client_id')->constrained('users')->cascadeOnDelete();
$table->timestamps();
$table->unique(['trainer_id', 'client_id']);
});
}
/**
* Reverse the migrations.
*/
public function down(): void
{
Schema::dropIfExists('trainer_clients');
}
};
lang/en/app.php
+1
View File
@@ -9,6 +9,7 @@ return [
'build_workout' => 'Build a Workout',
'dashboard' => 'Dashboard',
'programs' => 'Programs',
'clients' => 'Clients',
'admin' => 'Admin',
'profile' => 'Profile',
'logout' => 'Log Out',
lang/ro/app.php
+1
View File
@@ -9,6 +9,7 @@ return [
'build_workout' => 'Creează un antrenament',
'dashboard' => 'Tabloul de bord',
'programs' => 'Programe',
'clients' => 'Clienți',
'admin' => 'Admin',
'profile' => 'Profil',
'logout' => 'Deconectare',
resources/views/layouts/navigation.blade.php
+6
View File
@@ -20,6 +20,9 @@
@auth
<a href="{{ route('dashboard') }}" class="text-sm font-medium text-gray-700 dark:text-gray-300 hover:text-gray-900 dark:hover:text-white">{{ __('app.nav.dashboard') }}</a>
<a href="{{ route('programs.index') }}" class="text-sm font-medium text-gray-700 dark:text-gray-300 hover:text-gray-900 dark:hover:text-white">{{ __('app.nav.programs') }}</a>
@if(Auth::user()->is_trainer)
<a href="{{ route('trainer.clients') }}" class="text-sm font-medium text-gray-700 dark:text-gray-300 hover:text-gray-900 dark:hover:text-white">{{ __('app.nav.clients') }}</a>
@endif
@if(Auth::user()->is_admin)
<a href="{{ route('admin.dashboard') }}" class="text-sm font-medium text-indigo-700 dark:text-indigo-300 hover:text-indigo-900 dark:hover:text-indigo-200">{{ __('app.nav.admin') }}</a>
@endif
@@ -100,6 +103,9 @@
@auth
<x-responsive-nav-link :href="route('dashboard')">{{ __('app.nav.dashboard') }}</x-responsive-nav-link>
<x-responsive-nav-link :href="route('programs.index')">{{ __('app.nav.programs') }}</x-responsive-nav-link>
@if(Auth::user()->is_trainer)
<x-responsive-nav-link :href="route('trainer.clients')">{{ __('app.nav.clients') }}</x-responsive-nav-link>
@endif
@if(Auth::user()->is_admin)
<x-responsive-nav-link :href="route('admin.dashboard')">{{ __('app.nav.admin') }}</x-responsive-nav-link>
@endif
resources/views/trainer/assign-workout.blade.php
+37
View File
@@ -0,0 +1,37 @@
<x-app-layout>
<section class="bg-white dark:bg-gray-900 border-b border-gray-100 dark:border-gray-800">
<div class="mx-auto max-w-7xl px-4 sm:px-6 lg:px-8 py-8">
<a href="{{ route('trainer.clients') }}" class="text-sm text-gray-600 dark:text-gray-300 hover:text-gray-900 dark:hover:text-white">&larr; My Clients</a>
<h1 class="mt-2 text-2xl sm:text-3xl font-extrabold tracking-tight text-gray-900 dark:text-white">Assign a Workout to {{ $client->name }}</h1>
<p class="mt-2 text-gray-600 dark:text-gray-300">You'll be able to add exercises to it right after creating it.</p>
</div>
</section>
<section class="mx-auto max-w-2xl px-4 sm:px-6 lg:px-8 py-8">
@if ($errors->any())
<div class="mb-4 rounded-xl bg-red-50 text-red-700 px-4 py-3">
<ul class="list-disc ms-5 text-sm">
@foreach ($errors->all() as $error)
<li>{{ $error }}</li>
@endforeach
</ul>
</div>
@endif
<form method="POST" action="{{ route('trainer.workouts.store', $client) }}" class="space-y-5 bg-white dark:bg-gray-800 rounded-2xl p-6 ring-1 ring-gray-200 dark:ring-gray-700">
@csrf
<div>
<label class="block text-sm font-medium text-gray-700 dark:text-gray-300">Title</label>
<input type="text" name="title" required placeholder="e.g. Week 1 - Push Day" class="mt-1 w-full rounded-xl border-gray-300 dark:border-gray-700 bg-white/80 dark:bg-gray-900 text-gray-900 dark:text-gray-100 px-3 py-2">
</div>
<div>
<label class="block text-sm font-medium text-gray-700 dark:text-gray-300">Estimated minutes</label>
<input type="number" name="estimated_minutes" min="1" max="600" class="mt-1 w-32 rounded-xl border-gray-300 dark:border-gray-700 bg-white/80 dark:bg-gray-900 text-gray-900 dark:text-gray-100 px-3 py-2">
</div>
<div>
<label class="block text-sm font-medium text-gray-700 dark:text-gray-300">Notes</label>
<textarea name="notes" rows="3" class="mt-1 w-full rounded-xl border-gray-300 dark:border-gray-700 bg-white/80 dark:bg-gray-900 text-gray-900 dark:text-gray-100 px-3 py-2"></textarea>
</div>
<button type="submit" class="inline-flex items-center rounded-xl bg-gradient-to-r from-fuchsia-600 to-indigo-600 px-4 py-2 text-sm font-semibold text-white shadow hover:from-fuchsia-500 hover:to-indigo-500">Assign Workout</button>
</form>
</section>
</x-app-layout>
resources/views/trainer/clients.blade.php
+70
View File
@@ -0,0 +1,70 @@
<x-app-layout>
<section class="bg-white dark:bg-gray-900 border-b border-gray-100 dark:border-gray-800">
<div class="mx-auto max-w-7xl px-4 sm:px-6 lg:px-8 py-8">
<h1 class="text-2xl sm:text-3xl font-extrabold tracking-tight text-gray-900 dark:text-white">My Clients</h1>
<p class="mt-2 text-gray-600 dark:text-gray-300">Add clients by the email they registered with, and assign them workouts.</p>
</div>
</section>
<section class="mx-auto max-w-7xl px-4 sm:px-6 lg:px-8 py-6">
@if(session('status'))
<div class="mb-4 rounded-xl bg-emerald-50 text-emerald-700 px-4 py-3">{{ session('status') }}</div>
@endif
@if ($errors->any())
<div class="mb-4 rounded-xl bg-red-50 text-red-700 px-4 py-3">
<ul class="list-disc ms-5 text-sm">
@foreach ($errors->all() as $error)
<li>{{ $error }}</li>
@endforeach
</ul>
</div>
@endif
<form method="POST" action="{{ route('trainer.clients.add') }}" class="mb-6 flex items-end gap-3 bg-white dark:bg-gray-800 rounded-2xl p-4 ring-1 ring-gray-200 dark:ring-gray-700">
@csrf
<div class="w-full sm:w-80">
<label class="block text-sm font-medium text-gray-700 dark:text-gray-300">Client's email</label>
<input type="email" name="email" required placeholder="client@example.com" class="mt-1 w-full rounded-xl border-gray-300 dark:border-gray-700 bg-white/80 dark:bg-gray-900 text-gray-900 dark:text-gray-100 px-3 py-2">
</div>
<button type="submit" class="inline-flex items-center rounded-xl bg-gradient-to-r from-fuchsia-600 to-indigo-600 px-4 py-2 text-sm font-semibold text-white shadow hover:from-fuchsia-500 hover:to-indigo-500">Add Client</button>
</form>
@if($clients->isEmpty())
<div class="rounded-2xl border border-dashed border-gray-300 dark:border-gray-700 p-8 text-center text-gray-600 dark:text-gray-300">No clients yet. Add one by email above.</div>
@else
<div class="grid grid-cols-1 lg:grid-cols-2 gap-6">
@foreach($clients as $client)
<div class="rounded-2xl ring-1 ring-gray-200 dark:ring-gray-700 bg-white dark:bg-gray-800 p-5">
<div class="flex items-center justify-between">
<div>
<h3 class="text-lg font-semibold text-gray-900 dark:text-white">{{ $client->name }}</h3>
<p class="text-sm text-gray-600 dark:text-gray-300">{{ $client->email }}</p>
</div>
<div class="flex items-center gap-3">
<a href="{{ route('trainer.workouts.create', $client) }}" class="text-sm font-semibold text-indigo-600 hover:text-indigo-500">Assign workout</a>
<form method="POST" action="{{ route('trainer.clients.remove', $client) }}" onsubmit="return confirm('Remove {{ $client->name }} from your clients?');">
@csrf
@method('DELETE')
<button type="submit" class="text-sm text-red-600 hover:text-red-500">Remove</button>
</form>
</div>
</div>
@if($client->workouts->isEmpty())
<p class="mt-4 text-sm text-gray-500">No workouts assigned yet.</p>
@else
<ul class="mt-4 space-y-2">
@foreach($client->workouts as $workout)
<li class="flex items-center justify-between rounded-xl ring-1 ring-gray-200 dark:ring-gray-700 bg-white dark:bg-gray-900 px-3 py-2 text-sm">
<span class="text-gray-900 dark:text-gray-100">{{ $workout->title }}</span>
<span class="text-gray-500">{{ $workout->created_at->format('M j, Y') }}</span>
</li>
@endforeach
</ul>
@endif
</div>
@endforeach
</div>
@endif
</section>
</x-app-layout>
resources/views/workouts/index.blade.php
+3
View File
@@ -23,6 +23,9 @@
<div class="rounded-2xl ring-1 ring-gray-200 dark:ring-gray-700 bg-white dark:bg-gray-800 p-5 flex flex-col">
<div class="flex-1">
<h3 class="text-lg font-semibold text-gray-900 dark:text-white">{{ $workout->title }}</h3>
@if($workout->assignedByTrainer)
<span class="mt-1 inline-flex items-center rounded-full bg-indigo-100 dark:bg-indigo-900/40 text-indigo-700 dark:text-indigo-300 px-2.5 py-0.5 text-xs font-medium">Assigned by {{ $workout->assignedByTrainer->name }}</span>
@endif
@if($workout->estimated_minutes)
<p class="mt-1 text-sm text-gray-600 dark:text-gray-300">~ {{ $workout->estimated_minutes }} min</p>
@endif
resources/views/workouts/show.blade.php
+3
View File
@@ -23,6 +23,9 @@
</form>
@endauth
</div>
@if($workout->assignedByTrainer)
<span class="mt-2 inline-flex items-center rounded-full bg-indigo-100 dark:bg-indigo-900/40 text-indigo-700 dark:text-indigo-300 px-2.5 py-0.5 text-xs font-medium">Assigned by {{ $workout->assignedByTrainer->name }}</span>
@endif
<p class="mt-1 text-gray-600 dark:text-gray-300">@if($workout->estimated_minutes) ~ {{ $workout->estimated_minutes }} min · @endif {{ $workout->items->count() }} exercises</p>
</div>
<div class="flex items-center gap-3">
routes/web.php
+9
View File
@@ -60,6 +60,15 @@ Route::middleware('auth')->prefix('/workouts')->group(function () {
Route::post('/{workout}/sessions', [\App\Http\Controllers\WorkoutSessionController::class, 'store'])->name('sessions.store');
});
// Trainer: manage clients and assign workouts to them
Route::middleware(['auth', 'trainer'])->prefix('/trainer')->group(function () {
Route::get('/clients', [\App\Http\Controllers\TrainerController::class, 'clients'])->name('trainer.clients');
Route::post('/clients', [\App\Http\Controllers\TrainerController::class, 'addClient'])->name('trainer.clients.add');
Route::delete('/clients/{client}', [\App\Http\Controllers\TrainerController::class, 'removeClient'])->name('trainer.clients.remove');
Route::get('/clients/{client}/workouts/create', [\App\Http\Controllers\TrainerController::class, 'createWorkout'])->name('trainer.workouts.create');
Route::post('/clients/{client}/workouts', [\App\Http\Controllers\TrainerController::class, 'storeWorkout'])->name('trainer.workouts.store');
});
Route::middleware('auth')->prefix('/programs')->group(function () {
Route::get('/', [\App\Http\Controllers\ProgramController::class, 'index'])->name('programs.index');
Route::get('/create', [\App\Http\Controllers\ProgramController::class, 'create'])->name('programs.create');
tests/Feature/TrainerTest.php
+199
View File
@@ -0,0 +1,199 @@
<?php
namespace Tests\Feature;
use App\Models\User;
use App\Models\Workout;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
class TrainerTest extends TestCase
{
use RefreshDatabase;
protected function trainer(): User
{
$trainer = User::factory()->create();
$trainer->is_trainer = true;
$trainer->save();
return $trainer;
}
public function test_guest_is_redirected_to_login(): void
{
$response = $this->get(route('trainer.clients'));
$response->assertRedirect(route('login'));
}
public function test_non_trainer_is_forbidden(): void
{
$user = User::factory()->create();
$response = $this->actingAs($user)->get(route('trainer.clients'));
$response->assertForbidden();
}
public function test_trainer_can_add_a_client_by_email(): void
{
$trainer = $this->trainer();
$client = User::factory()->create(['email' => 'client@example.com']);
$response = $this->actingAs($trainer)->post(route('trainer.clients.add'), [
'email' => 'client@example.com',
]);
$response->assertRedirect();
$this->assertTrue($trainer->clients()->where('client_id', $client->id)->exists());
}
public function test_trainer_cannot_add_themselves_as_a_client(): void
{
$trainer = $this->trainer();
$response = $this->actingAs($trainer)->post(route('trainer.clients.add'), [
'email' => $trainer->email,
]);
$response->assertSessionHasErrors('email');
$this->assertFalse($trainer->clients()->where('client_id', $trainer->id)->exists());
}
public function test_trainer_cannot_add_the_same_client_twice(): void
{
$trainer = $this->trainer();
$client = User::factory()->create();
$trainer->clients()->attach($client->id);
$response = $this->actingAs($trainer)->post(route('trainer.clients.add'), [
'email' => $client->email,
]);
$response->assertSessionHasErrors('email');
$this->assertEquals(1, $trainer->clients()->where('client_id', $client->id)->count());
}
public function test_trainer_cannot_add_a_client_with_an_unknown_email(): void
{
$trainer = $this->trainer();
$response = $this->actingAs($trainer)->post(route('trainer.clients.add'), [
'email' => 'nobody@example.com',
]);
$response->assertSessionHasErrors('email');
}
public function test_trainer_can_remove_a_client(): void
{
$trainer = $this->trainer();
$client = User::factory()->create();
$trainer->clients()->attach($client->id);
$response = $this->actingAs($trainer)->delete(route('trainer.clients.remove', $client));
$response->assertRedirect();
$this->assertFalse($trainer->clients()->where('client_id', $client->id)->exists());
}
public function test_trainer_can_assign_a_workout_to_their_client(): void
{
$trainer = $this->trainer();
$client = User::factory()->create();
$trainer->clients()->attach($client->id);
$response = $this->actingAs($trainer)->post(route('trainer.workouts.store', $client), [
'title' => 'Week 1 Push Day',
]);
$response->assertRedirect(route('trainer.clients'));
$this->assertDatabaseHas('workouts', [
'user_id' => $client->id,
'assigned_by_trainer_id' => $trainer->id,
'title' => 'Week 1 Push Day',
]);
}
public function test_client_roster_lists_workouts_assigned_to_each_client(): void
{
$trainer = $this->trainer();
$client = User::factory()->create(['name' => 'Jamie Client']);
$trainer->clients()->attach($client->id);
Workout::factory()->create([
'user_id' => $client->id,
'assigned_by_trainer_id' => $trainer->id,
'title' => 'Week 1 Push Day',
]);
// A workout the client made for themselves should not show up as "assigned".
Workout::factory()->create(['user_id' => $client->id, 'title' => 'My Own Workout']);
$response = $this->actingAs($trainer)->get(route('trainer.clients'));
$response->assertOk();
$response->assertSee('Week 1 Push Day');
$response->assertDontSee('My Own Workout');
}
public function test_trainer_cannot_assign_a_workout_to_a_non_client(): void
{
$trainer = $this->trainer();
$stranger = User::factory()->create();
$response = $this->actingAs($trainer)->post(route('trainer.workouts.store', $stranger), [
'title' => 'Week 1 Push Day',
]);
$response->assertForbidden();
}
public function test_client_can_manage_their_assigned_workout(): void
{
$trainer = $this->trainer();
$client = User::factory()->create();
$trainer->clients()->attach($client->id);
$workout = Workout::factory()->create(['user_id' => $client->id, 'assigned_by_trainer_id' => $trainer->id]);
$response = $this->actingAs($client)->get(route('workouts.show', $workout));
$response->assertOk();
}
public function test_assigning_trainer_can_view_and_edit_the_assigned_workout(): void
{
$trainer = $this->trainer();
$client = User::factory()->create();
$trainer->clients()->attach($client->id);
$workout = Workout::factory()->create(['user_id' => $client->id, 'assigned_by_trainer_id' => $trainer->id]);
$response = $this->actingAs($trainer)->get(route('workouts.show', $workout));
$response->assertOk();
}
public function test_assigning_trainer_cannot_delete_the_assigned_workout(): void
{
$trainer = $this->trainer();
$client = User::factory()->create();
$trainer->clients()->attach($client->id);
$workout = Workout::factory()->create(['user_id' => $client->id, 'assigned_by_trainer_id' => $trainer->id]);
$response = $this->actingAs($trainer)->delete(route('workouts.destroy', $workout));
$response->assertForbidden();
$this->assertDatabaseHas('workouts', ['id' => $workout->id]);
}
public function test_unrelated_trainer_cannot_view_someone_elses_assigned_workout(): void
{
$trainer = $this->trainer();
$otherTrainer = $this->trainer();
$client = User::factory()->create();
$trainer->clients()->attach($client->id);
$workout = Workout::factory()->create(['user_id' => $client->id, 'assigned_by_trainer_id' => $trainer->id]);
$response = $this->actingAs($otherTrainer)->get(route('workouts.show', $workout));
$response->assertForbidden();
}
}