rootandClaude Sonnet 5
e8173ff90a
is_trainer was captured at signup and stored, but nothing in the app used it - no client roster, no way to assign anything, a dead flag that misled users who checked it during registration. Adds a trainer/client link (a trainer adds a client by the email they registered with) and lets a trainer create workouts directly on a client's account (assigned_by_trainer_id on workouts). Deliberately scoped for privacy: a trainer only ever sees/manages the workouts they authored and assigned - not a client's other private data (their own workouts, weight log, health notes, session/completion history). That boundary needs a consent or notification system to relax safely, which doesn't exist yet, so it's left for a follow-up rather than building it half-safe. WorkoutController's authorization now distinguishes "manage" (owner or assigning trainer - view, add/edit exercises) from "own" (owner only - delete), so a trainer can build out an assigned workout's exercises after creating it, but can't delete a client's workout out from under them. Found a real bug via live testing before committing: the client roster page eager-loaded `assignedWorkouts` (keyed by assigned_by_trainer_id) on each client record, which is the trainer's own perspective, not the client's - so it silently showed "no workouts assigned" even after assigning one. Fixed to eager-load `workouts` filtered by assigned_by_trainer_id instead, with a regression test. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
93 lines
2.8 KiB
PHP
93 lines
2.8 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers;
|
|
|
|
use App\Models\User;
|
|
use App\Models\Workout;
|
|
use Illuminate\Http\RedirectResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Illuminate\View\View;
|
|
|
|
class TrainerController extends Controller
|
|
{
|
|
public function clients(): View
|
|
{
|
|
$trainer = Auth::user();
|
|
// Note: `workouts` (user_id) is what a client was assigned, not `assignedWorkouts`
|
|
// (assigned_by_trainer_id), which belongs to the trainer's own perspective.
|
|
$clients = $trainer->clients()
|
|
->with(['workouts' => function ($q) use ($trainer) {
|
|
$q->where('assigned_by_trainer_id', $trainer->id)->latest();
|
|
}])
|
|
->orderBy('name')
|
|
->get();
|
|
|
|
return view('trainer.clients', compact('clients'));
|
|
}
|
|
|
|
public function addClient(Request $request): RedirectResponse
|
|
{
|
|
$trainer = Auth::user();
|
|
$data = $request->validate([
|
|
'email' => ['required', 'email', 'exists:users,email'],
|
|
]);
|
|
|
|
$client = User::where('email', $data['email'])->firstOrFail();
|
|
|
|
if ($client->id === $trainer->id) {
|
|
return back()->withErrors(['email' => 'You cannot add yourself as a client.']);
|
|
}
|
|
|
|
if ($trainer->clients()->where('client_id', $client->id)->exists()) {
|
|
return back()->withErrors(['email' => 'This person is already one of your clients.']);
|
|
}
|
|
|
|
$trainer->clients()->attach($client->id);
|
|
|
|
return back()->with('status', 'Client added');
|
|
}
|
|
|
|
public function removeClient(User $client): RedirectResponse
|
|
{
|
|
Auth::user()->clients()->detach($client->id);
|
|
|
|
return back()->with('status', 'Client removed');
|
|
}
|
|
|
|
public function createWorkout(User $client): View
|
|
{
|
|
$this->authorizeClient($client);
|
|
|
|
return view('trainer.assign-workout', compact('client'));
|
|
}
|
|
|
|
public function storeWorkout(Request $request, User $client): RedirectResponse
|
|
{
|
|
$this->authorizeClient($client);
|
|
|
|
$data = $request->validate([
|
|
'title' => ['required', 'string', 'max:255'],
|
|
'notes' => ['nullable', 'string'],
|
|
'estimated_minutes' => ['nullable', 'integer', 'min:1', 'max:600'],
|
|
]);
|
|
|
|
$workout = Workout::create([
|
|
'user_id' => $client->id,
|
|
'assigned_by_trainer_id' => Auth::id(),
|
|
'title' => $data['title'],
|
|
'notes' => $data['notes'] ?? null,
|
|
'estimated_minutes' => $data['estimated_minutes'] ?? null,
|
|
]);
|
|
|
|
return redirect()->route('trainer.clients')->with('status', "Workout assigned to {$client->name}");
|
|
}
|
|
|
|
protected function authorizeClient(User $client): void
|
|
{
|
|
if (!Auth::user()->clients()->where('client_id', $client->id)->exists()) {
|
|
abort(403);
|
|
}
|
|
}
|
|
}
|