rootandClaude Sonnet 5
e8173ff90a
is_trainer was captured at signup and stored, but nothing in the app used it - no client roster, no way to assign anything, a dead flag that misled users who checked it during registration. Adds a trainer/client link (a trainer adds a client by the email they registered with) and lets a trainer create workouts directly on a client's account (assigned_by_trainer_id on workouts). Deliberately scoped for privacy: a trainer only ever sees/manages the workouts they authored and assigned - not a client's other private data (their own workouts, weight log, health notes, session/completion history). That boundary needs a consent or notification system to relax safely, which doesn't exist yet, so it's left for a follow-up rather than building it half-safe. WorkoutController's authorization now distinguishes "manage" (owner or assigning trainer - view, add/edit exercises) from "own" (owner only - delete), so a trainer can build out an assigned workout's exercises after creating it, but can't delete a client's workout out from under them. Found a real bug via live testing before committing: the client roster page eager-loaded `assignedWorkouts` (keyed by assigned_by_trainer_id) on each client record, which is the trainer's own perspective, not the client's - so it silently showed "no workouts assigned" even after assigning one. Fixed to eager-load `workouts` filtered by assigned_by_trainer_id instead, with a regression test. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
103 lines
6.6 KiB
PHP
103 lines
6.6 KiB
PHP
<?php
|
|
|
|
use App\Http\Controllers\ProfileController;
|
|
use App\Http\Controllers\HomeController;
|
|
use Illuminate\Support\Facades\Route;
|
|
|
|
Route::get('/', [HomeController::class, 'index'])->name('home');
|
|
|
|
Route::get('/dashboard', [\App\Http\Controllers\DashboardController::class, 'index'])
|
|
->middleware(['auth', 'verified'])->name('dashboard');
|
|
|
|
// Admin routes
|
|
Route::prefix('admin')->middleware(['auth','admin'])->group(function(){
|
|
Route::get('/', [\App\Http\Controllers\AdminDashboardController::class, 'index'])->name('admin.dashboard');
|
|
// Admin Exercises CRUD
|
|
Route::resource('exercises', \App\Http\Controllers\Admin\ExerciseController::class)->except(['show'])->names('admin.exercises');
|
|
// Admin Posts CRUD
|
|
Route::resource('posts', \App\Http\Controllers\Admin\PostController::class)->except(['show'])->names('admin.posts');
|
|
});
|
|
|
|
Route::middleware('auth')->group(function () {
|
|
Route::get('/profile', [ProfileController::class, 'edit'])->name('profile.edit');
|
|
Route::patch('/profile', [ProfileController::class, 'update'])->name('profile.update');
|
|
Route::delete('/profile', [ProfileController::class, 'destroy'])->name('profile.destroy');
|
|
|
|
// Favorites
|
|
Route::post('/exercises/{exercise}/favorite', [\App\Http\Controllers\FavoriteController::class, 'toggleExercise'])->name('exercises.favorite');
|
|
Route::post('/workouts/{workout}/favorite', [\App\Http\Controllers\FavoriteController::class, 'toggleWorkout'])->name('workouts.favorite');
|
|
Route::post('/yoga/{pose}/favorite', [\App\Http\Controllers\FavoriteController::class, 'toggleYogaPose'])->name('yoga.favorite');
|
|
|
|
// Exercise alias (per-user rename)
|
|
Route::post('/exercises/{exercise}/alias', [\App\Http\Controllers\ExerciseAliasController::class, 'store'])->name('exercises.alias');
|
|
|
|
// Body weight log
|
|
Route::post('/weight-logs', [\App\Http\Controllers\WeightLogController::class, 'store'])->name('weight-logs.store');
|
|
Route::delete('/weight-logs/{weightLog}', [\App\Http\Controllers\WeightLogController::class, 'destroy'])->name('weight-logs.destroy');
|
|
});
|
|
|
|
Route::prefix('/exercises')->group(function () {
|
|
Route::get('/', [\App\Http\Controllers\ExerciseController::class, 'index'])->name('exercises.index');
|
|
Route::get('/{exercise:slug}', [\App\Http\Controllers\ExerciseController::class, 'show'])->name('exercises.show');
|
|
});
|
|
|
|
Route::middleware('auth')->prefix('/workouts')->group(function () {
|
|
Route::get('/', [\App\Http\Controllers\WorkoutController::class, 'index'])->name('workouts.index');
|
|
Route::get('/builder', [\App\Http\Controllers\WorkoutController::class, 'builder'])->name('workouts.builder');
|
|
|
|
Route::get('/create', [\App\Http\Controllers\WorkoutController::class, 'create'])->name('workouts.create');
|
|
Route::post('/', [\App\Http\Controllers\WorkoutController::class, 'store'])->name('workouts.store');
|
|
Route::get('/{workout}', [\App\Http\Controllers\WorkoutController::class, 'show'])->name('workouts.show');
|
|
Route::delete('/{workout}', [\App\Http\Controllers\WorkoutController::class, 'destroy'])->name('workouts.destroy');
|
|
|
|
// Manage exercises within a workout
|
|
Route::get('/{workout}/exercises/search', [\App\Http\Controllers\WorkoutController::class, 'searchExercises'])->name('workouts.exercises.search');
|
|
Route::post('/{workout}/exercises', [\App\Http\Controllers\WorkoutController::class, 'addExercise'])->name('workouts.exercises.add');
|
|
Route::patch('/{workout}/exercises/{item}', [\App\Http\Controllers\WorkoutController::class, 'updateExercise'])->name('workouts.exercises.update');
|
|
Route::delete('/{workout}/exercises/{item}', [\App\Http\Controllers\WorkoutController::class, 'removeExercise'])->name('workouts.exercises.remove');
|
|
|
|
// Sessions
|
|
Route::post('/{workout}/sessions', [\App\Http\Controllers\WorkoutSessionController::class, 'store'])->name('sessions.store');
|
|
});
|
|
|
|
// Trainer: manage clients and assign workouts to them
|
|
Route::middleware(['auth', 'trainer'])->prefix('/trainer')->group(function () {
|
|
Route::get('/clients', [\App\Http\Controllers\TrainerController::class, 'clients'])->name('trainer.clients');
|
|
Route::post('/clients', [\App\Http\Controllers\TrainerController::class, 'addClient'])->name('trainer.clients.add');
|
|
Route::delete('/clients/{client}', [\App\Http\Controllers\TrainerController::class, 'removeClient'])->name('trainer.clients.remove');
|
|
Route::get('/clients/{client}/workouts/create', [\App\Http\Controllers\TrainerController::class, 'createWorkout'])->name('trainer.workouts.create');
|
|
Route::post('/clients/{client}/workouts', [\App\Http\Controllers\TrainerController::class, 'storeWorkout'])->name('trainer.workouts.store');
|
|
});
|
|
|
|
Route::middleware('auth')->prefix('/programs')->group(function () {
|
|
Route::get('/', [\App\Http\Controllers\ProgramController::class, 'index'])->name('programs.index');
|
|
Route::get('/create', [\App\Http\Controllers\ProgramController::class, 'create'])->name('programs.create');
|
|
Route::post('/', [\App\Http\Controllers\ProgramController::class, 'store'])->name('programs.store');
|
|
Route::get('/{program}', [\App\Http\Controllers\ProgramController::class, 'show'])->name('programs.show');
|
|
Route::delete('/{program}', [\App\Http\Controllers\ProgramController::class, 'destroy'])->name('programs.destroy');
|
|
Route::post('/{program}/workouts', [\App\Http\Controllers\ProgramController::class, 'addWorkout'])->name('programs.workouts.add');
|
|
});
|
|
|
|
Route::middleware('auth')->group(function () {
|
|
Route::get('/sessions/{session}', [\App\Http\Controllers\WorkoutSessionController::class, 'show'])->name('sessions.show');
|
|
Route::patch('/sessions/{session}/items/{item}', [\App\Http\Controllers\WorkoutSessionController::class, 'toggleItem'])->name('sessions.items.toggle');
|
|
Route::post('/sessions/{session}/complete', [\App\Http\Controllers\WorkoutSessionController::class, 'complete'])->name('sessions.complete');
|
|
});
|
|
|
|
Route::prefix('/blog')->group(function () {
|
|
Route::get('/', [\App\Http\Controllers\BlogController::class, 'index'])->name('blog.index');
|
|
Route::get('/{post:slug}', [\App\Http\Controllers\BlogController::class, 'show'])->name('blog.show');
|
|
});
|
|
|
|
// Yoga poses
|
|
Route::prefix('/yoga')->group(function () {
|
|
Route::get('/', [\App\Http\Controllers\YogaPoseController::class, 'index'])->name('yoga.index');
|
|
Route::get('/{pose:slug}', [\App\Http\Controllers\YogaPoseController::class, 'show'])->name('yoga.show');
|
|
});
|
|
|
|
// Legal
|
|
Route::get('/privacy', [\App\Http\Controllers\LegalController::class, 'privacy'])->name('legal.privacy');
|
|
Route::get('/terms', [\App\Http\Controllers\LegalController::class, 'terms'])->name('legal.terms');
|
|
|
|
require __DIR__.'/auth.php';
|