Merge branch 'fix/log-form-exercise-undefined'

- Fix exercise_id undefined error in log_form.html by using scalar
  exercise_id instead of exercise.id object reference
- Clean up orphaned WorkoutSession records when all logs are deleted
- Filter empty sessions from dashboard stats (sessions, volume, streak)
- Replace broken HTTPException auth redirect with custom exception
  handler that properly returns 302 to /login

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/main.py

@@ -4,6 +4,8 @@ Creates and configures the FastAPI app with routes, templates,
 static files, and structured logging.
 """
 
+import os
+import secrets
 from pathlib import Path
 
 import structlog
@@ -12,12 +14,29 @@ from fastapi.staticfiles import StaticFiles
 from fastapi.templating import Jinja2Templates
 from sqlmodel import SQLModel, Session
 
+from starlette.middleware.base import BaseHTTPMiddleware, RequestResponseEndpoint
+from starlette.requests import Request as StarletteRequest
+from starlette.responses import Response
+from fastapi.responses import RedirectResponse
+
+from app.models.user import User
 from app.config import get_settings
 from app.database import get_engine, get_db_session
 from app.logging_config import setup_logging
+from app.routes.auth import router as auth_router
+from app.routes.exercises import router as exercises_router
+from app.routes.history import router as history_router
 from app.routes.health import router as health_router
 from app.routes.pages import router as pages_router
+from app.routes.profiles import router as profiles_router
+from app.routes.logging import router as logging_router
+from app.routes.workouts import router as workouts_router
+from app.routes.dashboard import router as dashboard_router
+from app.routes.schedule import router as schedule_router
 from app.services.seed_service import SeedService
+from app.services.auth_service import AuthService
+from app.services.user_service import UserService
+from app.utils.auth import SESSION_COOKIE_NAME, NotAuthenticatedError
 
 logger = structlog.get_logger(__name__)
 
@@ -27,6 +46,37 @@ TEMPLATES_DIR = _BASE_DIR / "templates"
 STATIC_DIR = _BASE_DIR / "static"
 
 
+class NavContextMiddleware(BaseHTTPMiddleware):
+    """Injects admin, profiles, and active_profile into request.state for templates."""
+
+    async def dispatch(self, request: StarletteRequest, call_next: RequestResponseEndpoint) -> Response:
+        request.state.admin = None
+        request.state.profiles = []
+        request.state.active_profile = None
+
+        token = request.cookies.get(SESSION_COOKIE_NAME)
+        if token and hasattr(request.app.state, "engine"):
+            try:
+                with Session(request.app.state.engine) as session:
+                    secret_key = getattr(request.app.state, "secret_key", "")
+                    auth_service = AuthService(session, secret_key=secret_key)
+                    user_id = auth_service.validate_session_token(token)
+                    if user_id:
+                        admin = session.get(User, user_id)
+                        if admin and admin.is_admin:
+                            request.state.admin = admin
+                            user_service = UserService(session)
+                            request.state.profiles = user_service.list_users(exclude_admin=True)
+
+                            profile_id = request.cookies.get("active_profile_id")
+                            if profile_id and profile_id.isdigit():
+                                request.state.active_profile = user_service.get_user_by_id(int(profile_id))
+            except Exception:
+                pass
+
+        return await call_next(request)
+
+
 def create_app() -> FastAPI:
     """Create and configure the FastAPI application.
 
@@ -42,6 +92,11 @@ def create_app() -> FastAPI:
         version="0.1.0",
     )
 
+    # Redirect unauthenticated requests to login
+    @app.exception_handler(NotAuthenticatedError)
+    async def _not_authenticated_handler(request, exc):
+        return RedirectResponse(url="/login", status_code=302)
+
     # Mount static files
     app.mount("/static", StaticFiles(directory=str(STATIC_DIR)), name="static")
 
@@ -49,9 +104,23 @@ def create_app() -> FastAPI:
     templates = Jinja2Templates(directory=str(TEMPLATES_DIR))
     app.state.templates = templates
 
+    # Secret key for session signing
+    app.state.secret_key = os.environ.get("SECRET_KEY", secrets.token_hex(32))
+
+    # Nav context middleware — injects admin/profiles/active_profile into request.state
+    app.add_middleware(NavContextMiddleware)
+
     # Register route modules
+    app.include_router(auth_router)
+    app.include_router(exercises_router)
     app.include_router(health_router)
+    app.include_router(history_router)
+    app.include_router(logging_router)
     app.include_router(pages_router)
+    app.include_router(profiles_router)
+    app.include_router(workouts_router)
+    app.include_router(dashboard_router)
+    app.include_router(schedule_router)
 
     # Database setup
     engine = get_engine(settings.database_url)

app/routes/auth.py

@@ -0,0 +1,99 @@
+"""Authentication routes for admin login and logout.
+
+Handles the login form, credential verification, session cookie
+management, and logout.
+"""
+
+import structlog
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import HTMLResponse, RedirectResponse
+from sqlmodel import Session
+
+from app.database import get_db_session
+from app.services.auth_service import AuthService
+from app.utils.auth import SESSION_COOKIE_NAME
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(tags=["auth"])
+
+
+@router.get("/login", response_class=HTMLResponse)
+async def login_page(request: Request):
+    """Render the login form.
+
+    Args:
+        request: The incoming HTTP request.
+
+    Returns:
+        Rendered login page HTML.
+    """
+    templates = request.app.state.templates
+    return templates.TemplateResponse("pages/login.html", {
+        "request": request,
+        "error": None,
+    })
+
+
+@router.post("/login")
+async def login_submit(
+    request: Request,
+    session: Session = Depends(get_db_session),
+):
+    """Process login form submission.
+
+    Verifies credentials and sets a session cookie on success.
+    Re-renders the login page with an error on failure.
+
+    Args:
+        request: The incoming HTTP request.
+        session: Database session.
+
+    Returns:
+        Redirect to home on success, or login page with error.
+    """
+    form = await request.form()
+    username = form.get("username", "")
+    password = form.get("password", "")
+
+    secret_key = request.app.state.secret_key
+    auth_service = AuthService(session, secret_key=secret_key)
+    user = auth_service.authenticate(username, password)
+
+    if user is None:
+        templates = request.app.state.templates
+        return templates.TemplateResponse("pages/login.html", {
+            "request": request,
+            "error": "Invalid username or password.",
+        }, status_code=200)
+
+    # Create session token and set cookie — httponly and samesite for security
+    token = auth_service.create_session_token(user_id=user.id)
+    response = RedirectResponse(url="/", status_code=303)
+    response.set_cookie(
+        key=SESSION_COOKIE_NAME,
+        value=token,
+        httponly=True,
+        samesite="lax",
+        max_age=86400,  # 24 hours
+    )
+
+    logger.info("login_success", username=username)
+    return response
+
+
+@router.get("/logout")
+async def logout(request: Request):
+    """Clear the session cookie and redirect to login.
+
+    Args:
+        request: The incoming HTTP request.
+
+    Returns:
+        Redirect to login page.
+    """
+    response = RedirectResponse(url="/login", status_code=303)
+    response.delete_cookie(key=SESSION_COOKIE_NAME)
+    response.delete_cookie(key="active_profile_id")
+    logger.info("logout")
+    return response

app/routes/dashboard.py

@@ -0,0 +1,102 @@
+"""Progress dashboard routes.
+
+Displays summary statistics, volume charts, and per-exercise progress.
+"""
+
+import json
+
+import structlog
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import HTMLResponse
+from sqlmodel import Session
+
+from app.database import get_db_session
+from app.models.user import User
+from app.services.analytics_service import AnalyticsService
+from app.services.exercise_service import ExerciseService
+from app.services.progression_service import ProgressionService
+from app.utils.auth import get_current_admin_user, get_active_profile_id
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(prefix="/dashboard", tags=["dashboard"])
+
+
+@router.get("", response_class=HTMLResponse)
+async def dashboard(
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """Render the progress dashboard for the active profile.
+
+    Shows: summary stats, volume by day chart, exercise progress links.
+    """
+    active_profile_id = get_active_profile_id(request)
+    active_profile = (
+        session.get(User, active_profile_id)
+        if active_profile_id
+        else None
+    )
+
+    stats = {}
+    volume_data = {}
+    if active_profile_id:
+        analytics = AnalyticsService(session)
+        stats = analytics.get_user_stats(active_profile_id)
+        volume_data = analytics.get_volume_by_day(active_profile_id)
+
+    exercise_service = ExerciseService(session)
+    exercises = exercise_service.list_exercises()
+
+    templates = request.app.state.templates
+    return templates.TemplateResponse("pages/dashboard.html", {
+        "request": request,
+        "stats": stats,
+        "volume_data_json": json.dumps(volume_data),
+        "exercises": exercises,
+        "active_profile": active_profile,
+        "admin": admin,
+    })
+
+
+@router.get("/exercise/{exercise_id}", response_class=HTMLResponse)
+async def exercise_progress(
+    exercise_id: int,
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """Render per-exercise progress page with charts and suggestions."""
+    active_profile_id = get_active_profile_id(request)
+    active_profile = (
+        session.get(User, active_profile_id)
+        if active_profile_id
+        else None
+    )
+
+    exercise_service = ExerciseService(session)
+    exercise = exercise_service.get_exercise_by_id(exercise_id)
+
+    progress_data = {}
+    suggestion = {}
+    if active_profile_id:
+        analytics = AnalyticsService(session)
+        progress_data = analytics.get_exercise_progress(
+            active_profile_id, exercise_id,
+        )
+
+        progression = ProgressionService(session)
+        suggestion = progression.get_suggestion(
+            active_profile_id, exercise_id,
+        )
+
+    templates = request.app.state.templates
+    return templates.TemplateResponse("pages/exercise_progress.html", {
+        "request": request,
+        "exercise": exercise,
+        "progress_data_json": json.dumps(progress_data),
+        "suggestion": suggestion,
+        "active_profile": active_profile,
+        "admin": admin,
+    })

app/routes/exercises.py

@@ -0,0 +1,86 @@
+"""Exercise browser routes with HTMX search/filter support.
+
+All filtering is done via HTMX partial responses — no JSON APIs.
+"""
+
+import structlog
+from fastapi import APIRouter, Depends, Query, Request
+from fastapi.responses import HTMLResponse
+from sqlmodel import Session
+
+from app.database import get_db_session
+from app.models.user import User
+from app.services.exercise_service import ExerciseService
+from app.utils.auth import get_current_admin_user
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(prefix="/exercises", tags=["exercises"])
+
+
+@router.get("", response_class=HTMLResponse)
+async def exercise_browser(
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """Render the exercise browser page with all exercises.
+
+    Args:
+        request: The incoming HTTP request.
+        session: Database session.
+        admin: The authenticated admin user.
+
+    Returns:
+        Rendered exercise browser page.
+    """
+    exercise_service = ExerciseService(session)
+    exercises = exercise_service.list_exercises()
+    workout_days = exercise_service.list_workout_days()
+
+    # Collect unique muscle groups for the filter dropdown
+    muscle_groups = sorted(set(ex.muscle_group for ex in exercises))
+
+    templates = request.app.state.templates
+    return templates.TemplateResponse("pages/exercise_browser.html", {
+        "request": request,
+        "exercises": exercises,
+        "workout_days": workout_days,
+        "muscle_groups": muscle_groups,
+        "admin": admin,
+    })
+
+
+@router.get("/search", response_class=HTMLResponse)
+async def exercise_search(
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+    workout_day: str = Query(default="", alias="workout_day"),
+    muscle_group: str = Query(default="", alias="muscle_group"),
+):
+    """Return filtered exercise list as an HTMX partial.
+
+    Called via hx-get from the exercise browser filter dropdowns.
+
+    Args:
+        request: The incoming HTTP request.
+        session: Database session.
+        admin: The authenticated admin user.
+        workout_day: Filter by workout day name.
+        muscle_group: Filter by muscle group.
+
+    Returns:
+        Rendered exercise list partial HTML.
+    """
+    exercise_service = ExerciseService(session)
+    exercises = exercise_service.list_exercises(
+        workout_day=workout_day or None,
+        muscle_group=muscle_group or None,
+    )
+
+    templates = request.app.state.templates
+    return templates.TemplateResponse("partials/exercise_list.html", {
+        "request": request,
+        "exercises": exercises,
+    })

app/routes/history.py

@@ -0,0 +1,113 @@
+"""Log history routes for viewing past workout sessions.
+
+Displays a list of past sessions and detailed logs per session.
+"""
+
+import structlog
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import HTMLResponse
+from sqlmodel import Session
+
+from app.database import get_db_session
+from app.models.user import User
+from app.services.exercise_service import ExerciseService
+from app.services.log_service import LogService
+from app.services.workout_session_service import WorkoutSessionService
+from app.utils.auth import get_current_admin_user, get_active_profile_id
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(prefix="/history", tags=["history"])
+
+
+@router.get("", response_class=HTMLResponse)
+async def log_history(
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """Display log history for the active profile.
+
+    Shows a list of past workout sessions, most recent first.
+
+    Args:
+        request: The incoming HTTP request.
+        session: Database session.
+        admin: The authenticated admin user.
+
+    Returns:
+        Rendered log history page.
+    """
+    active_profile_id = get_active_profile_id(request)
+    active_profile = (
+        session.get(User, active_profile_id)
+        if active_profile_id
+        else None
+    )
+
+    sessions_list = []
+    if active_profile_id:
+        ws_service = WorkoutSessionService(session)
+        sessions_list = ws_service.list_sessions(user_id=active_profile_id)
+
+    # Resolve workout day names for display
+    exercise_service = ExerciseService(session)
+    days_by_id = {d.id: d for d in exercise_service.list_workout_days()}
+
+    templates = request.app.state.templates
+    return templates.TemplateResponse("pages/log_history.html", {
+        "request": request,
+        "sessions": sessions_list,
+        "days_by_id": days_by_id,
+        "active_profile": active_profile,
+        "admin": admin,
+    })
+
+
+@router.get("/{session_id}", response_class=HTMLResponse)
+async def session_detail(
+    session_id: int,
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """Display detailed logs for a specific workout session.
+
+    Args:
+        session_id: The workout session ID.
+        request: The incoming HTTP request.
+        session: Database session.
+        admin: The authenticated admin user.
+
+    Returns:
+        Rendered session detail page.
+    """
+    ws_service = WorkoutSessionService(session)
+    ws = ws_service.get_session_by_id(session_id)
+
+    log_service = LogService(session)
+    logs = log_service.list_logs_for_session(session_id)
+
+    # Group logs by exercise
+    exercise_service = ExerciseService(session)
+    exercises_by_id = {}
+    logs_by_exercise = {}
+    for log in logs:
+        if log.exercise_id not in exercises_by_id:
+            exercises_by_id[log.exercise_id] = (
+                exercise_service.get_exercise_by_id(log.exercise_id)
+            )
+        logs_by_exercise.setdefault(log.exercise_id, []).append(log)
+
+    # Resolve workout day name
+    days_by_id = {d.id: d for d in exercise_service.list_workout_days()}
+
+    templates = request.app.state.templates
+    return templates.TemplateResponse("pages/session_detail.html", {
+        "request": request,
+        "workout_session": ws,
+        "logs_by_exercise": logs_by_exercise,
+        "exercises_by_id": exercises_by_id,
+        "days_by_id": days_by_id,
+        "admin": admin,
+    })

app/routes/logging.py

@@ -0,0 +1,177 @@
+"""Workout logging routes for inline set tracking.
+
+Handles creating, editing, and deleting individual set logs.
+All responses are HTMX partials that update in place.
+"""
+
+from datetime import date
+
+import structlog
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import HTMLResponse
+from sqlmodel import Session
+
+from app.database import get_db_session
+from app.models.user import User
+from app.services.log_service import LogService
+from app.services.workout_session_service import WorkoutSessionService
+from app.utils.auth import get_current_admin_user, get_active_profile_id
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(prefix="/log", tags=["logging"])
+
+
+@router.post("", response_class=HTMLResponse)
+async def log_set(
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """Log a single set for an exercise.
+
+    Creates the workout session if it doesn't exist yet (auto-create).
+    Returns the updated log entries partial for this exercise.
+
+    Args:
+        request: The incoming HTTP request.
+        session: Database session.
+        admin: The authenticated admin user.
+
+    Returns:
+        Rendered log entries partial for this exercise.
+    """
+    form = await request.form()
+    exercise_id = int(form.get("exercise_id", 0))
+    workout_day_id = int(form.get("workout_day_id", 0))
+    set_number = int(form.get("set_number", 1))
+    reps = int(form.get("reps", 0))
+    weight = form.get("weight", "")
+    felt_easy = form.get("felt_easy") == "on"
+
+    active_profile_id = get_active_profile_id(request)
+    if not active_profile_id:
+        templates = request.app.state.templates
+        return templates.TemplateResponse("partials/flash_message.html", {
+            "request": request,
+            "flash_error": "No profile selected. Switch profiles first.",
+        })
+
+    # Get or create today's session
+    ws_service = WorkoutSessionService(session)
+    ws = ws_service.get_or_create_session(
+        user_id=active_profile_id,
+        workout_day_id=workout_day_id,
+        session_date=date.today(),
+    )
+
+    # Create the log entry
+    log_service = LogService(session)
+    log_service.create_log(
+        session_id=ws.id,
+        exercise_id=exercise_id,
+        set_number=set_number,
+        reps_completed=reps,
+        weight_used=weight,
+        felt_easy=felt_easy,
+    )
+
+    # Return updated logs for this exercise
+    logs = log_service.list_logs_for_exercise(ws.id, exercise_id)
+    next_set = len(logs) + 1
+
+    templates = request.app.state.templates
+    return templates.TemplateResponse("partials/log_entry.html", {
+        "request": request,
+        "logs": logs,
+        "exercise_id": exercise_id,
+        "workout_day_id": workout_day_id,
+        "next_set": next_set,
+        "session_id": ws.id,
+    })
+
+
+@router.post("/{log_id}/edit", response_class=HTMLResponse)
+async def edit_log(
+    log_id: int,
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """Edit an existing log entry.
+
+    Args:
+        log_id: The log entry ID.
+        request: The incoming HTTP request.
+        session: Database session.
+        admin: The authenticated admin user.
+
+    Returns:
+        Rendered updated log entry partial.
+    """
+    form = await request.form()
+    log_service = LogService(session)
+
+    log_service.update_log(
+        log_id,
+        reps_completed=int(form.get("reps", 0)),
+        weight_used=form.get("weight", ""),
+        felt_easy=form.get("felt_easy") == "on",
+        notes=form.get("notes"),
+    )
+
+    log = log_service.get_log_by_id(log_id)
+    logs = log_service.list_logs_for_exercise(log.session_id, log.exercise_id)
+    next_set = len(logs) + 1
+
+    templates = request.app.state.templates
+    return templates.TemplateResponse("partials/log_entry.html", {
+        "request": request,
+        "logs": logs,
+        "exercise_id": log.exercise_id,
+        "workout_day_id": 0,
+        "next_set": next_set,
+        "session_id": log.session_id,
+    })
+
+
+@router.post("/{log_id}/delete", response_class=HTMLResponse)
+async def delete_log(
+    log_id: int,
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """Delete a log entry.
+
+    Args:
+        log_id: The log entry ID.
+        request: The incoming HTTP request.
+        session: Database session.
+        admin: The authenticated admin user.
+
+    Returns:
+        Rendered updated log entries partial.
+    """
+    log_service = LogService(session)
+    log = log_service.get_log_by_id(log_id)
+
+    if log:
+        exercise_id = log.exercise_id
+        session_id = log.session_id
+        log_service.delete_log(log_id)
+
+        logs = log_service.list_logs_for_exercise(session_id, exercise_id)
+        next_set = len(logs) + 1
+
+        templates = request.app.state.templates
+        return templates.TemplateResponse("partials/log_entry.html", {
+            "request": request,
+            "logs": logs,
+            "exercise_id": exercise_id,
+            "workout_day_id": 0,
+            "next_set": next_set,
+            "session_id": session_id,
+        })
+
+    return HTMLResponse("")

app/routes/profiles.py

@@ -0,0 +1,151 @@
+"""Profile management routes.
+
+Admin can view, create, edit user profiles and switch the active profile.
+"""
+
+import structlog
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import HTMLResponse, RedirectResponse
+from sqlmodel import Session
+
+from app.database import get_db_session
+from app.models.user import User
+from app.services.user_service import UserService
+from app.utils.auth import get_current_admin_user, get_active_profile_id
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(prefix="/profiles", tags=["profiles"])
+
+
+@router.get("", response_class=HTMLResponse)
+async def list_profiles(
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """List all user profiles for the admin.
+
+    Args:
+        request: The incoming HTTP request.
+        session: Database session.
+        admin: The authenticated admin user.
+
+    Returns:
+        Rendered profile list page.
+    """
+    user_service = UserService(session)
+    profiles = user_service.list_users(exclude_admin=True)
+    active_profile_id = get_active_profile_id(request)
+
+    templates = request.app.state.templates
+    return templates.TemplateResponse("pages/profiles.html", {
+        "request": request,
+        "profiles": profiles,
+        "active_profile_id": active_profile_id,
+        "admin": admin,
+    })
+
+
+@router.post("/switch")
+async def switch_profile(
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """Switch the active user profile.
+
+    Sets a cookie with the selected profile ID.
+
+    Args:
+        request: The incoming HTTP request.
+        session: Database session.
+        admin: The authenticated admin user.
+
+    Returns:
+        Redirect to the referring page with profile cookie set.
+    """
+    form = await request.form()
+    profile_id = form.get("profile_id", "")
+
+    # Validate profile exists and is not an admin
+    user_service = UserService(session)
+    profile = user_service.get_user_by_id(int(profile_id)) if profile_id.isdigit() else None
+
+    referer = request.headers.get("referer", "/")
+    response = RedirectResponse(url=referer, status_code=303)
+
+    if profile and not profile.is_admin:
+        response.set_cookie(
+            key="active_profile_id",
+            value=str(profile.id),
+            httponly=True,
+            samesite="lax",
+            max_age=86400,
+        )
+        logger.info("profile_switched", profile_id=profile.id, name=profile.display_name)
+    else:
+        logger.warning("profile_switch_failed", profile_id=profile_id)
+
+    return response
+
+
+@router.get("/{profile_id}/edit", response_class=HTMLResponse)
+async def edit_profile_page(
+    profile_id: int,
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """Render the profile edit form.
+
+    Args:
+        profile_id: The profile ID to edit.
+        request: The incoming HTTP request.
+        session: Database session.
+        admin: The authenticated admin user.
+
+    Returns:
+        Rendered profile edit page.
+    """
+    user_service = UserService(session)
+    profile = user_service.get_user_by_id(profile_id)
+
+    templates = request.app.state.templates
+    return templates.TemplateResponse("pages/profile_edit.html", {
+        "request": request,
+        "profile": profile,
+        "admin": admin,
+    })
+
+
+@router.post("/{profile_id}/edit")
+async def update_profile(
+    profile_id: int,
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """Process profile edit form submission.
+
+    Args:
+        profile_id: The profile ID to update.
+        request: The incoming HTTP request.
+        session: Database session.
+        admin: The authenticated admin user.
+
+    Returns:
+        Redirect to profiles page.
+    """
+    form = await request.form()
+    user_service = UserService(session)
+
+    user_service.update_user(
+        profile_id,
+        display_name=form.get("display_name", ""),
+        height=form.get("height", ""),
+        weight=form.get("weight", ""),
+        goals=form.get("goals", ""),
+    )
+
+    return RedirectResponse(url="/profiles", status_code=303)

app/routes/schedule.py

@@ -0,0 +1,86 @@
+"""4-week schedule calendar routes.
+
+Displays a calendar view showing which workout day maps to which date.
+"""
+
+from datetime import date, timedelta
+
+import structlog
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import HTMLResponse
+from sqlmodel import Session
+
+from app.database import get_db_session
+from app.models.user import User
+from app.services.exercise_service import ExerciseService
+from app.services.workout_session_service import WorkoutSessionService
+from app.utils.auth import get_current_admin_user, get_active_profile_id
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(prefix="/schedule", tags=["schedule"])
+
+
+@router.get("", response_class=HTMLResponse)
+async def schedule_view(
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """Render the 4-week schedule calendar.
+
+    Shows a 4-week grid where each training day is mapped to a
+    calendar date. Days with completed sessions are highlighted.
+    """
+    active_profile_id = get_active_profile_id(request)
+    active_profile = (
+        session.get(User, active_profile_id)
+        if active_profile_id
+        else None
+    )
+
+    exercise_service = ExerciseService(session)
+    workout_days = exercise_service.list_workout_days()
+
+    # Build 4-week calendar starting from Monday of current week
+    today = date.today()
+    monday = today - timedelta(days=today.weekday())
+
+    weeks = []
+    completed_dates = set()
+
+    # Get completed sessions for highlighting
+    if active_profile_id:
+        ws_service = WorkoutSessionService(session)
+        sessions_list = ws_service.list_sessions(
+            user_id=active_profile_id, limit=100,
+        )
+        completed_dates = {ws.date for ws in sessions_list}
+
+    # 4 workout days per week, 4 weeks
+    for week_num in range(4):
+        week_start = monday + timedelta(weeks=week_num)
+        week_data = {
+            "week_number": week_num + 1,
+            "days": [],
+        }
+        for day_offset, workout_day in enumerate(workout_days):
+            training_date = week_start + timedelta(days=day_offset)
+            is_today = training_date == today
+            is_completed = training_date in completed_dates
+
+            week_data["days"].append({
+                "workout_day": workout_day,
+                "date": training_date,
+                "is_today": is_today,
+                "is_completed": is_completed,
+            })
+        weeks.append(week_data)
+
+    templates = request.app.state.templates
+    return templates.TemplateResponse("pages/schedule.html", {
+        "request": request,
+        "weeks": weeks,
+        "active_profile": active_profile,
+        "admin": admin,
+    })

app/routes/workouts.py

@@ -0,0 +1,137 @@
+"""Workout day viewer routes.
+
+Displays the warmup routine and main exercises for each workout day,
+with the active profile's programming targets.
+"""
+
+from datetime import date
+
+import structlog
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import HTMLResponse
+from sqlmodel import Session, select
+
+from app.database import get_db_session
+from app.models.user import User
+from app.models.user_exercise_program import UserExerciseProgram
+from app.services.exercise_service import ExerciseService
+from app.services.log_service import LogService
+from app.services.progression_service import ProgressionService
+from app.services.workout_session_service import WorkoutSessionService
+from app.utils.auth import get_current_admin_user, get_active_profile_id
+
+logger = structlog.get_logger(__name__)
+
+router = APIRouter(prefix="/workouts", tags=["workouts"])
+
+
+@router.get("", response_class=HTMLResponse)
+async def workout_days_list(
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """List all workout days as clickable cards.
+
+    Args:
+        request: The incoming HTTP request.
+        session: Database session.
+        admin: The authenticated admin user.
+
+    Returns:
+        Rendered workout days list page.
+    """
+    exercise_service = ExerciseService(session)
+    days = exercise_service.list_workout_days()
+
+    templates = request.app.state.templates
+    return templates.TemplateResponse("pages/workout_days.html", {
+        "request": request,
+        "days": days,
+        "admin": admin,
+    })
+
+
+@router.get("/{day_name}", response_class=HTMLResponse)
+async def workout_day_detail(
+    day_name: str,
+    request: Request,
+    session: Session = Depends(get_db_session),
+    admin: User = Depends(get_current_admin_user),
+):
+    """Display a full workout day -- warmups + exercises with form cues.
+
+    Args:
+        day_name: The workout day name (e.g., "push", "pull").
+        request: The incoming HTTP request.
+        session: Database session.
+        admin: The authenticated admin user.
+
+    Returns:
+        Rendered workout day detail page.
+    """
+    exercise_service = ExerciseService(session)
+
+    # Normalize day name for DB lookup (e.g., "push" -> "Push", "full-body" -> "Full Body")
+    day_display = day_name.replace("-", " ").title()
+
+    warmups = exercise_service.list_warmups()
+    exercises = exercise_service.list_exercises(workout_day=day_display)
+
+    # Get active profile's programming if set
+    active_profile_id = get_active_profile_id(request)
+    programs = {}
+    active_profile = None
+    existing_logs = {}
+    if active_profile_id:
+        active_profile = session.get(User, active_profile_id)
+        if active_profile:
+            statement = select(UserExerciseProgram).where(
+                UserExerciseProgram.user_id == active_profile_id
+            )
+            for prog in session.exec(statement).all():
+                programs[prog.exercise_id] = prog
+
+    # Look up the workout day ID for logging forms
+    days = exercise_service.list_workout_days()
+    workout_day_id = 0
+    for d in days:
+        if d.name == day_display:
+            workout_day_id = d.id
+            break
+
+    # Get progression suggestions for each exercise
+    suggestions = {}
+    if active_profile_id:
+        progression = ProgressionService(session)
+        for exercise in exercises:
+            suggestions[exercise.id] = progression.get_suggestion(
+                active_profile_id, exercise.id,
+            )
+
+    # Load existing logs for today's session (if any)
+    if active_profile_id and workout_day_id:
+        ws_service = WorkoutSessionService(session)
+        ws = ws_service.get_or_create_session(
+            user_id=active_profile_id,
+            workout_day_id=workout_day_id,
+            session_date=date.today(),
+        )
+        log_service = LogService(session)
+        all_logs = log_service.list_logs_for_session(ws.id)
+        for log in all_logs:
+            existing_logs.setdefault(log.exercise_id, []).append(log)
+
+    templates = request.app.state.templates
+    return templates.TemplateResponse("pages/workout_day.html", {
+        "request": request,
+        "day_name": day_display,
+        "warmups": warmups,
+        "exercises": exercises,
+        "programs": programs,
+        "active_profile": active_profile,
+        "existing_logs": existing_logs,
+        "suggestions": suggestions,
+        "workout_day_id": workout_day_id,
+        "admin": admin,
+    })

app/services/analytics_service.py

@@ -0,0 +1,181 @@
+"""Analytics service for progress dashboard and chart data.
+
+Aggregates workout log data into stats, trends, and chart-ready formats.
+"""
+
+import re
+from datetime import date, timedelta
+
+import structlog
+from sqlmodel import Session, select
+
+from app.models.workout_day import WorkoutDay
+from app.models.workout_log import WorkoutLog
+from app.models.workout_session import WorkoutSession
+
+logger = structlog.get_logger(__name__)
+
+
+def _weight_to_float(weight_str: str) -> float:
+    """Convert weight string to float for volume calculations.
+
+    Args:
+        weight_str: Weight like '30 lbs' or 'BW'.
+
+    Returns:
+        Numeric weight, or 0.0 for bodyweight.
+    """
+    if not weight_str or weight_str.upper() == "BW":
+        return 0.0
+    match = re.search(r"(\d+(?:\.\d+)?)", weight_str)
+    return float(match.group(1)) if match else 0.0
+
+
+class AnalyticsService:
+    """Aggregates workout data for dashboards and charts.
+
+    Args:
+        session: An active SQLModel Session.
+    """
+
+    def __init__(self, session: Session) -> None:
+        self._session = session
+
+    def get_user_stats(self, user_id: int) -> dict:
+        """Get summary statistics for a user.
+
+        Returns:
+            Dict with keys: total_sessions, total_volume, total_sets,
+            current_streak, last_workout_date.
+        """
+        all_sessions = self._session.exec(
+            select(WorkoutSession)
+            .where(WorkoutSession.user_id == user_id)
+            .order_by(WorkoutSession.date.desc())
+        ).all()
+
+        # Only count sessions that still have log entries
+        sessions = []
+        total_volume = 0.0
+        total_sets = 0
+        for ws in all_sessions:
+            logs = self._session.exec(
+                select(WorkoutLog).where(WorkoutLog.session_id == ws.id)
+            ).all()
+            if not logs:
+                continue
+            sessions.append(ws)
+            for log_entry in logs:
+                total_sets += 1
+                weight = _weight_to_float(log_entry.weight_used)
+                total_volume += log_entry.reps_completed * weight
+        total_sessions = len(sessions)
+
+        current_streak = 0
+        if sessions:
+            week_start = date.today() - timedelta(days=date.today().weekday())
+            for week_offset in range(52):
+                week_check = week_start - timedelta(weeks=week_offset)
+                week_end = week_check + timedelta(days=6)
+                has_session = any(
+                    week_check <= ws.date <= week_end for ws in sessions
+                )
+                if has_session:
+                    current_streak += 1
+                else:
+                    break
+
+        last_workout = sessions[0].date if sessions else None
+
+        return {
+            "total_sessions": total_sessions,
+            "total_volume": round(total_volume),
+            "total_sets": total_sets,
+            "current_streak": current_streak,
+            "last_workout_date": last_workout,
+        }
+
+    def get_exercise_progress(
+        self, user_id: int, exercise_id: int,
+    ) -> dict:
+        """Get chart-ready progress data for a specific exercise.
+
+        Returns:
+            Dict with keys: dates, reps, weights, volumes.
+        """
+        sessions = self._session.exec(
+            select(WorkoutSession)
+            .where(WorkoutSession.user_id == user_id)
+            .order_by(WorkoutSession.date.asc())
+        ).all()
+
+        dates = []
+        reps = []
+        weights = []
+        volumes = []
+
+        for ws in sessions:
+            logs = self._session.exec(
+                select(WorkoutLog).where(
+                    WorkoutLog.session_id == ws.id,
+                    WorkoutLog.exercise_id == exercise_id,
+                )
+            ).all()
+
+            if not logs:
+                continue
+
+            avg_reps = sum(
+                log_entry.reps_completed for log_entry in logs
+            ) / len(logs)
+            weight = _weight_to_float(logs[0].weight_used)
+            session_volume = sum(
+                log_entry.reps_completed * _weight_to_float(log_entry.weight_used)
+                for log_entry in logs
+            )
+
+            dates.append(ws.date.isoformat())
+            reps.append(round(avg_reps, 1))
+            weights.append(weight)
+            volumes.append(round(session_volume))
+
+        return {
+            "dates": dates,
+            "reps": reps,
+            "weights": weights,
+            "volumes": volumes,
+        }
+
+    def get_volume_by_day(self, user_id: int) -> dict:
+        """Get total volume broken down by workout day.
+
+        Returns:
+            Dict mapping workout day name to total volume.
+        """
+        days = self._session.exec(select(WorkoutDay)).all()
+        day_map = {d.id: d.name for d in days}
+
+        sessions = self._session.exec(
+            select(WorkoutSession)
+            .where(WorkoutSession.user_id == user_id)
+        ).all()
+
+        volume_by_day = {}
+        for ws in sessions:
+            day_name = day_map.get(ws.workout_day_id, "Unknown")
+            logs = self._session.exec(
+                select(WorkoutLog).where(WorkoutLog.session_id == ws.id)
+            ).all()
+
+            if not logs:
+                continue
+
+            day_volume = sum(
+                log_entry.reps_completed * _weight_to_float(log_entry.weight_used)
+                for log_entry in logs
+            )
+            volume_by_day[day_name] = (
+                volume_by_day.get(day_name, 0) + round(day_volume)
+            )
+
+        return volume_by_day

app/services/auth_service.py

@@ -0,0 +1,100 @@
+"""Service layer for admin authentication and session management.
+
+Handles password verification, session token creation/validation.
+Uses bcrypt for password hashing and itsdangerous for session signing.
+"""
+
+from typing import Optional
+
+import bcrypt
+import structlog
+from itsdangerous import BadSignature, URLSafeTimedSerializer
+from sqlmodel import Session, select
+
+from app.models.user import User
+
+logger = structlog.get_logger(__name__)
+
+# Session token max age: 24 hours
+SESSION_MAX_AGE_SECONDS = 86400
+
+
+class AuthService:
+    """Handles admin authentication and session token management.
+
+    Args:
+        session: An active SQLModel Session.
+        secret_key: Secret key for signing session tokens.
+    """
+
+    def __init__(self, session: Session, secret_key: str) -> None:
+        self._session = session
+        self._serializer = URLSafeTimedSerializer(secret_key)
+
+    def authenticate(self, username: str, password: str) -> Optional[User]:
+        """Verify admin credentials and return the User if valid.
+
+        Only admin users can authenticate. Non-admin users are rejected.
+
+        Args:
+            username: The username to check.
+            password: The plaintext password to verify.
+
+        Returns:
+            The authenticated User, or None if credentials are invalid.
+        """
+        statement = select(User).where(User.username == username)
+        user = self._session.exec(statement).first()
+
+        if user is None:
+            logger.warning("auth_failed", reason="user_not_found", username=username)
+            return None
+
+        if not user.is_admin:
+            logger.warning("auth_failed", reason="not_admin", username=username)
+            return None
+
+        if not user.password_hash:
+            logger.warning("auth_failed", reason="no_password_hash", username=username)
+            return None
+
+        # Verify password against bcrypt hash
+        if not bcrypt.checkpw(
+            password.encode("utf-8"),
+            user.password_hash.encode("utf-8"),
+        ):
+            logger.warning("auth_failed", reason="wrong_password", username=username)
+            return None
+
+        logger.info("auth_success", username=username)
+        return user
+
+    def create_session_token(self, user_id: int) -> str:
+        """Create a signed session token for the given user.
+
+        Args:
+            user_id: The authenticated user's ID.
+
+        Returns:
+            A signed, URL-safe token string.
+        """
+        return self._serializer.dumps({"user_id": user_id})
+
+    def validate_session_token(self, token: str) -> Optional[int]:
+        """Validate a session token and extract the user_id.
+
+        Args:
+            token: The session token to validate.
+
+        Returns:
+            The user_id if the token is valid, or None.
+        """
+        try:
+            data = self._serializer.loads(token, max_age=SESSION_MAX_AGE_SECONDS)
+            return data.get("user_id")
+        except BadSignature:
+            logger.warning("session_invalid", reason="bad_signature")
+            return None
+        except Exception:
+            logger.warning("session_invalid", reason="unknown_error")
+            return None

app/services/log_service.py

@@ -0,0 +1,209 @@
+"""Service layer for workout log (set-level) data access.
+
+Handles CRUD for individual set logs within workout sessions.
+"""
+
+from typing import Optional
+
+import structlog
+from sqlmodel import Session, select
+
+from app.models.workout_log import WorkoutLog
+from app.models.workout_session import WorkoutSession
+
+logger = structlog.get_logger(__name__)
+
+
+class LogService:
+    """Handles CRUD operations for WorkoutLog records.
+
+    Args:
+        session: An active SQLModel Session.
+    """
+
+    def __init__(self, session: Session) -> None:
+        self._session = session
+
+    def create_log(
+        self,
+        session_id: int,
+        exercise_id: int,
+        set_number: int,
+        reps_completed: int,
+        weight_used: str,
+        felt_easy: bool,
+        notes: Optional[str] = None,
+    ) -> WorkoutLog:
+        """Create a new set log entry.
+
+        Args:
+            session_id: FK to workout_sessions.
+            exercise_id: FK to exercises.
+            set_number: Which set (1, 2, 3...).
+            reps_completed: Actual reps performed.
+            weight_used: Weight as string (e.g., "30 lbs").
+            felt_easy: Whether the set felt easy.
+            notes: Optional notes for this set.
+
+        Returns:
+            The newly created WorkoutLog record.
+        """
+        log = WorkoutLog(
+            session_id=session_id,
+            exercise_id=exercise_id,
+            set_number=set_number,
+            reps_completed=reps_completed,
+            weight_used=weight_used,
+            felt_easy=felt_easy,
+            notes=notes,
+        )
+        self._session.add(log)
+        self._session.commit()
+        self._session.refresh(log)
+        logger.info(
+            "log_created",
+            session_id=session_id,
+            exercise_id=exercise_id,
+            set=set_number,
+        )
+        return log
+
+    def list_logs_for_session(self, session_id: int) -> list[WorkoutLog]:
+        """List all log entries for a workout session.
+
+        Args:
+            session_id: The workout session ID.
+
+        Returns:
+            List of WorkoutLog records ordered by exercise and set number.
+        """
+        statement = (
+            select(WorkoutLog)
+            .where(WorkoutLog.session_id == session_id)
+            .order_by(WorkoutLog.exercise_id, WorkoutLog.set_number)
+        )
+        return list(self._session.exec(statement).all())
+
+    def list_logs_for_exercise(
+        self,
+        session_id: int,
+        exercise_id: int,
+    ) -> list[WorkoutLog]:
+        """List log entries for a specific exercise within a session.
+
+        Args:
+            session_id: The workout session ID.
+            exercise_id: The exercise ID.
+
+        Returns:
+            List of WorkoutLog records for this exercise, ordered by set.
+        """
+        statement = (
+            select(WorkoutLog)
+            .where(
+                WorkoutLog.session_id == session_id,
+                WorkoutLog.exercise_id == exercise_id,
+            )
+            .order_by(WorkoutLog.set_number)
+        )
+        return list(self._session.exec(statement).all())
+
+    def get_log_by_id(self, log_id: int) -> Optional[WorkoutLog]:
+        """Retrieve a log entry by primary key.
+
+        Args:
+            log_id: The log entry ID.
+
+        Returns:
+            The WorkoutLog record, or None if not found.
+        """
+        return self._session.get(WorkoutLog, log_id)
+
+    def update_log(self, log_id: int, **kwargs) -> WorkoutLog:
+        """Update fields on an existing log entry.
+
+        Args:
+            log_id: The log entry ID.
+            **kwargs: Field names and new values.
+
+        Returns:
+            The updated WorkoutLog record.
+
+        Raises:
+            ValueError: If the log is not found.
+        """
+        log = self.get_log_by_id(log_id)
+        if log is None:
+            raise ValueError(f"WorkoutLog with id {log_id} not found")
+
+        for key, value in kwargs.items():
+            if hasattr(log, key):
+                setattr(log, key, value)
+
+        self._session.add(log)
+        self._session.commit()
+        self._session.refresh(log)
+        logger.info("log_updated", log_id=log_id, fields=list(kwargs.keys()))
+        return log
+
+    def delete_log(self, log_id: int) -> None:
+        """Delete a log entry.
+
+        Removes the log and cleans up the parent session if no logs remain.
+
+        Args:
+            log_id: The log entry ID.
+
+        Raises:
+            ValueError: If the log is not found.
+        """
+        log = self.get_log_by_id(log_id)
+        if log is None:
+            raise ValueError(f"WorkoutLog with id {log_id} not found")
+
+        session_id = log.session_id
+        self._session.delete(log)
+        self._session.commit()
+        logger.info("log_deleted", log_id=log_id)
+
+        # Clean up orphaned session if no logs remain
+        remaining = self._session.exec(
+            select(WorkoutLog).where(WorkoutLog.session_id == session_id)
+        ).first()
+        if remaining is None:
+            ws = self._session.get(WorkoutSession, session_id)
+            if ws:
+                self._session.delete(ws)
+                self._session.commit()
+                logger.info("session_deleted_empty", session_id=session_id)
+
+    def get_latest_logs_for_exercise(
+        self,
+        user_id: int,
+        exercise_id: int,
+        limit: int = 10,
+    ) -> list[WorkoutLog]:
+        """Get the most recent log entries for an exercise across sessions.
+
+        Used by the progression engine (Phase 5) to determine
+        what the user last did for this exercise.
+
+        Args:
+            user_id: The user's ID.
+            exercise_id: The exercise ID.
+            limit: Maximum number of logs to return.
+
+        Returns:
+            List of recent WorkoutLog records, newest first.
+        """
+        statement = (
+            select(WorkoutLog)
+            .join(WorkoutSession, WorkoutLog.session_id == WorkoutSession.id)
+            .where(
+                WorkoutSession.user_id == user_id,
+                WorkoutLog.exercise_id == exercise_id,
+            )
+            .order_by(WorkoutSession.date.desc(), WorkoutLog.set_number)
+            .limit(limit)
+        )
+        return list(self._session.exec(statement).all())

app/services/progression_service.py

@@ -0,0 +1,271 @@
+"""Auto-progression engine for workout programming.
+
+Analyzes workout log history and applies the progression model:
+- +1-2 reps/week until wk4 rep target
+- +5 lbs every 2 weeks once at rep target
+- Deload at week 5 (-20% weight, reset to wk1 reps)
+- Accelerated weight increase when all sets felt easy
+"""
+
+import re
+from datetime import date
+from typing import Optional
+
+import structlog
+from sqlmodel import Session, select
+
+from app.models.progress_log import ProgressLog
+from app.models.user_exercise_program import UserExerciseProgram
+from app.models.workout_log import WorkoutLog
+from app.models.workout_session import WorkoutSession
+
+logger = structlog.get_logger(__name__)
+
+
+def _parse_weight(weight_str: str) -> Optional[float]:
+    """Extract numeric weight from a string like '30 lbs' or 'BW'.
+
+    Args:
+        weight_str: Weight as a string.
+
+    Returns:
+        Numeric weight in lbs, or None for bodyweight.
+    """
+    if not weight_str or weight_str.upper() == "BW":
+        return None
+    match = re.search(r"(\d+(?:\.\d+)?)", weight_str)
+    return float(match.group(1)) if match else None
+
+
+def _format_weight(weight_lbs: Optional[float]) -> str:
+    """Format a numeric weight back to a display string.
+
+    Args:
+        weight_lbs: Weight in lbs, or None for bodyweight.
+
+    Returns:
+        Formatted string like '35 lbs' or 'BW'.
+    """
+    if weight_lbs is None:
+        return "BW"
+    if weight_lbs == int(weight_lbs):
+        return f"{int(weight_lbs)} lbs"
+    return f"{weight_lbs:.1f} lbs"
+
+
+class ProgressionService:
+    """Implements the auto-progression engine.
+
+    Args:
+        session: An active SQLModel Session.
+    """
+
+    def __init__(self, session: Session) -> None:
+        self._session = session
+
+    def _get_program(
+        self, user_id: int, exercise_id: int,
+    ) -> Optional[UserExerciseProgram]:
+        """Look up the user's program for a specific exercise."""
+        statement = select(UserExerciseProgram).where(
+            UserExerciseProgram.user_id == user_id,
+            UserExerciseProgram.exercise_id == exercise_id,
+        )
+        return self._session.exec(statement).first()
+
+    def _get_recent_sessions(
+        self, user_id: int, exercise_id: int, limit: int = 5,
+    ) -> list[dict]:
+        """Get recent session summaries for an exercise.
+
+        Returns a list of dicts with: date, avg_reps, weight, all_felt_easy.
+        """
+        statement = (
+            select(WorkoutSession)
+            .where(WorkoutSession.user_id == user_id)
+            .order_by(WorkoutSession.date.desc())
+            .limit(limit * 2)
+        )
+        sessions = self._session.exec(statement).all()
+
+        results = []
+        for ws in sessions:
+            logs = self._session.exec(
+                select(WorkoutLog).where(
+                    WorkoutLog.session_id == ws.id,
+                    WorkoutLog.exercise_id == exercise_id,
+                )
+            ).all()
+
+            if not logs:
+                continue
+
+            avg_reps = sum(log.reps_completed for log in logs) / len(logs)
+            weight = logs[0].weight_used
+            all_felt_easy = all(log.felt_easy for log in logs)
+
+            results.append({
+                "date": ws.date,
+                "avg_reps": avg_reps,
+                "weight": weight,
+                "all_felt_easy": all_felt_easy,
+                "set_count": len(logs),
+            })
+
+            if len(results) >= limit:
+                break
+
+        return results
+
+    def get_suggestion(
+        self, user_id: int, exercise_id: int,
+    ) -> dict:
+        """Generate a progression suggestion for the next workout.
+
+        Analyzes recent log history against the user's program targets
+        and applies progression rules.
+
+        Returns:
+            Dict with keys: suggested_reps, suggested_weight,
+            progression_type, message.
+        """
+        program = self._get_program(user_id, exercise_id)
+
+        if program is None:
+            return {
+                "suggested_reps": 0,
+                "suggested_weight": "",
+                "progression_type": "no_program",
+                "message": "No program found for this exercise.",
+            }
+
+        try:
+            wk1_reps = int(program.wk1_reps)
+            wk4_reps = int(program.wk4_reps)
+        except (ValueError, TypeError):
+            wk1_reps = 0
+            wk4_reps = 0
+
+        wk1_weight = program.wk1_weight
+
+        recent = self._get_recent_sessions(user_id, exercise_id, limit=5)
+
+        if not recent:
+            return {
+                "suggested_reps": wk1_reps,
+                "suggested_weight": wk1_weight,
+                "progression_type": "baseline",
+                "message": f"Start with {wk1_reps} reps @ {wk1_weight}.",
+            }
+
+        latest = recent[0]
+        current_reps = int(round(latest["avg_reps"]))
+        current_weight = latest["weight"]
+        current_weight_num = _parse_weight(current_weight)
+        consecutive_sessions = len(recent)
+
+        # Rule: Deload at week 5 (4 consecutive sessions completed)
+        if consecutive_sessions >= 4:
+            if current_weight_num is not None:
+                deload_weight = current_weight_num * 0.8
+                return {
+                    "suggested_reps": wk1_reps,
+                    "suggested_weight": _format_weight(deload_weight),
+                    "progression_type": "deload",
+                    "message": (
+                        f"Deload week: {wk1_reps} reps @ "
+                        f"{_format_weight(deload_weight)} (-20%)."
+                    ),
+                }
+            return {
+                "suggested_reps": wk1_reps,
+                "suggested_weight": current_weight,
+                "progression_type": "deload",
+                "message": f"Deload week: reset to {wk1_reps} reps.",
+            }
+
+        # Rule: Weight increase if at rep target and felt easy
+        if current_reps >= wk4_reps and latest["all_felt_easy"]:
+            if current_weight_num is not None:
+                new_weight = current_weight_num + 5
+                return {
+                    "suggested_reps": wk1_reps,
+                    "suggested_weight": _format_weight(new_weight),
+                    "progression_type": "weight_increase",
+                    "message": (
+                        f"Weight up: {wk1_reps} reps @ "
+                        f"{_format_weight(new_weight)} (+5 lbs)."
+                    ),
+                }
+
+        # Rule: Weight increase after 2 weeks at rep target
+        if (
+            current_reps >= wk4_reps
+            and len(recent) >= 2
+            and int(round(recent[1]["avg_reps"])) >= wk4_reps
+        ):
+            if current_weight_num is not None:
+                new_weight = current_weight_num + 5
+                return {
+                    "suggested_reps": wk1_reps,
+                    "suggested_weight": _format_weight(new_weight),
+                    "progression_type": "weight_increase",
+                    "message": (
+                        f"2 weeks at target: {wk1_reps} reps @ "
+                        f"{_format_weight(new_weight)} (+5 lbs)."
+                    ),
+                }
+
+        # Rule: Rep increase (+1-2 reps)
+        if current_reps < wk4_reps:
+            increment = 2 if latest["all_felt_easy"] else 1
+            new_reps = min(current_reps + increment, wk4_reps)
+            return {
+                "suggested_reps": new_reps,
+                "suggested_weight": current_weight,
+                "progression_type": "reps_increase",
+                "message": (
+                    f"Reps up: {new_reps} reps @ {current_weight} "
+                    f"(+{increment})."
+                ),
+            }
+
+        # Hold: at target, waiting for biweekly weight increase
+        return {
+            "suggested_reps": current_reps,
+            "suggested_weight": current_weight,
+            "progression_type": "hold",
+            "message": f"Hold at {current_reps} reps @ {current_weight}.",
+        }
+
+    def record_progression(
+        self,
+        user_id: int,
+        exercise_id: int,
+        suggested_reps: int,
+        suggested_weight: str,
+        actual_reps: int,
+        actual_weight: str,
+        progression_type: str,
+    ) -> ProgressLog:
+        """Record a progression entry in the progress_log table."""
+        progress_log = ProgressLog(
+            user_id=user_id,
+            exercise_id=exercise_id,
+            date=date.today(),
+            suggested_reps=suggested_reps,
+            suggested_weight=suggested_weight,
+            actual_reps=actual_reps,
+            actual_weight=actual_weight,
+            progression_applied=progression_type,
+        )
+        self._session.add(progress_log)
+        self._session.commit()
+        self._session.refresh(progress_log)
+        logger.info(
+            "progression_recorded",
+            user_id=user_id,
+            exercise_id=exercise_id,
+            type=progression_type,
+        )
+        return progress_log

app/services/workout_session_service.py

@@ -0,0 +1,131 @@
+"""Service layer for workout session management.
+
+Handles creation, retrieval, and updates for workout sessions.
+A session represents a single workout on a specific date for a user.
+"""
+
+from datetime import date
+from typing import Optional
+
+import structlog
+from sqlmodel import Session, select
+
+from app.models.workout_session import WorkoutSession
+
+logger = structlog.get_logger(__name__)
+
+
+class WorkoutSessionService:
+    """Handles CRUD operations for WorkoutSession records.
+
+    Args:
+        session: An active SQLModel Session.
+    """
+
+    def __init__(self, session: Session) -> None:
+        self._session = session
+
+    def get_or_create_session(
+        self,
+        user_id: int,
+        workout_day_id: int,
+        session_date: date,
+    ) -> WorkoutSession:
+        """Get an existing session or create a new one.
+
+        If a session already exists for this user + day + date combo,
+        return it. Otherwise, create a new one. This allows logging
+        to start automatically without an explicit "start session" step.
+
+        Args:
+            user_id: The user's ID.
+            workout_day_id: The workout day's ID.
+            session_date: The date of the workout.
+
+        Returns:
+            The existing or newly created WorkoutSession.
+        """
+        statement = select(WorkoutSession).where(
+            WorkoutSession.user_id == user_id,
+            WorkoutSession.workout_day_id == workout_day_id,
+            WorkoutSession.date == session_date,
+        )
+        existing = self._session.exec(statement).first()
+
+        if existing:
+            return existing
+
+        ws = WorkoutSession(
+            user_id=user_id,
+            workout_day_id=workout_day_id,
+            date=session_date,
+        )
+        self._session.add(ws)
+        self._session.commit()
+        self._session.refresh(ws)
+        logger.info(
+            "workout_session_created",
+            user_id=user_id,
+            day_id=workout_day_id,
+            date=str(session_date),
+        )
+        return ws
+
+    def list_sessions(
+        self,
+        user_id: int,
+        limit: int = 50,
+    ) -> list[WorkoutSession]:
+        """List workout sessions for a user, most recent first.
+
+        Args:
+            user_id: The user's ID.
+            limit: Maximum number of sessions to return.
+
+        Returns:
+            List of WorkoutSession records, ordered by date descending.
+        """
+        statement = (
+            select(WorkoutSession)
+            .where(WorkoutSession.user_id == user_id)
+            .order_by(WorkoutSession.date.desc())
+            .limit(limit)
+        )
+        return list(self._session.exec(statement).all())
+
+    def get_session_by_id(self, session_id: int) -> Optional[WorkoutSession]:
+        """Retrieve a workout session by primary key.
+
+        Args:
+            session_id: The session ID.
+
+        Returns:
+            The WorkoutSession record, or None if not found.
+        """
+        return self._session.get(WorkoutSession, session_id)
+
+    def update_session(self, session_id: int, **kwargs) -> WorkoutSession:
+        """Update fields on an existing workout session.
+
+        Args:
+            session_id: The session ID.
+            **kwargs: Field names and new values.
+
+        Returns:
+            The updated WorkoutSession record.
+
+        Raises:
+            ValueError: If the session is not found.
+        """
+        ws = self.get_session_by_id(session_id)
+        if ws is None:
+            raise ValueError(f"WorkoutSession with id {session_id} not found")
+
+        for key, value in kwargs.items():
+            if hasattr(ws, key):
+                setattr(ws, key, value)
+
+        self._session.add(ws)
+        self._session.commit()
+        self._session.refresh(ws)
+        return ws

app/templates/base.html

@@ -27,14 +27,16 @@
             </ul>
             <ul>
                 {% block nav_items %}
-                <!-- Phase 3 adds: profile switcher, login/logout -->
+                {% include "partials/nav.html" ignore missing %}
                 {% endblock %}
             </ul>
         </nav>
     </header>
 
     <main class="container">
-        {% block flash %}{% endblock %}
+        {% block flash %}
+        {% include "partials/flash_message.html" ignore missing %}
+        {% endblock %}
         {% block content %}{% endblock %}
     </main>
 

app/templates/pages/dashboard.html

@@ -0,0 +1,46 @@
+{% extends "base.html" %}
+
+{% block title %}Dashboard -- SneakySwole{% endblock %}
+
+{% block head_extra %}
+<script src="https://cdn.jsdelivr.net/npm/chart.js@4"></script>
+{% endblock %}
+
+{% block content %}
+<hgroup>
+    <h1>Progress Dashboard</h1>
+    {% if active_profile %}
+    <p>{{ active_profile.display_name }}'s training overview</p>
+    {% else %}
+    <p>No profile selected -- <a href="/profiles">select one</a></p>
+    {% endif %}
+</hgroup>
+
+{% if stats %}
+<!-- Summary Stats -->
+<div class="grid">
+    {% include "partials/stats_card.html" %}
+</div>
+
+<!-- Volume by Day Chart -->
+<article>
+    <header><h3>Volume by Workout Day</h3></header>
+    {% include "partials/volume_chart.html" %}
+</article>
+
+<!-- Exercise Progress Links -->
+<article>
+    <header><h3>Per-Exercise Progress</h3></header>
+    <ul>
+        {% for exercise in exercises %}
+        <li>
+            <a href="/dashboard/exercise/{{ exercise.id }}">
+                {{ exercise.name }}
+            </a>
+            <small> -- {{ exercise.workout_day }} Day</small>
+        </li>
+        {% endfor %}
+    </ul>
+</article>
+{% endif %}
+{% endblock %}

app/templates/pages/exercise_browser.html

@@ -0,0 +1,38 @@
+{% extends "base.html" %}
+
+{% block title %}Exercise Library — SneakySwole{% endblock %}
+
+{% block content %}
+<hgroup>
+    <h1>Exercise Library</h1>
+    <p>Browse all exercises with form cues and programming details.</p>
+</hgroup>
+
+<!-- HTMX-powered filters -->
+<div class="grid">
+    <select name="workout_day"
+            hx-get="/exercises/search"
+            hx-target="#exercise-results"
+            hx-include="[name='muscle_group']">
+        <option value="">All Days</option>
+        {% for day in workout_days %}
+        <option value="{{ day.name }}">{{ day.name }}</option>
+        {% endfor %}
+    </select>
+
+    <select name="muscle_group"
+            hx-get="/exercises/search"
+            hx-target="#exercise-results"
+            hx-include="[name='workout_day']">
+        <option value="">All Muscle Groups</option>
+        {% for mg in muscle_groups %}
+        <option value="{{ mg }}">{{ mg }}</option>
+        {% endfor %}
+    </select>
+</div>
+
+<!-- Exercise results (replaced by HTMX on filter change) -->
+<div id="exercise-results">
+    {% include "partials/exercise_list.html" %}
+</div>
+{% endblock %}

app/templates/pages/exercise_progress.html

@@ -0,0 +1,48 @@
+{% extends "base.html" %}
+
+{% block title %}{{ exercise.name }} Progress -- SneakySwole{% endblock %}
+
+{% block head_extra %}
+<script src="https://cdn.jsdelivr.net/npm/chart.js@4"></script>
+{% endblock %}
+
+{% block content %}
+<hgroup>
+    <h1>{{ exercise.name }}</h1>
+    <p>{{ exercise.muscle_group }} | {{ exercise.workout_day }} Day</p>
+</hgroup>
+
+<!-- Progression Suggestion -->
+{% if suggestion %}
+<article>
+    <header><h3>Next Workout Suggestion</h3></header>
+    <p>{{ suggestion.message }}</p>
+    <div class="grid">
+        <div>
+            <small>Suggested Reps</small>
+            <p style="font-size:1.5rem; font-weight:700;">
+                {{ suggestion.suggested_reps }}
+            </p>
+        </div>
+        <div>
+            <small>Suggested Weight</small>
+            <p style="font-size:1.5rem; font-weight:700;">
+                {{ suggestion.suggested_weight }}
+            </p>
+        </div>
+        <div>
+            <small>Progression Type</small>
+            <p><mark>{{ suggestion.progression_type }}</mark></p>
+        </div>
+    </div>
+</article>
+{% endif %}
+
+<!-- Progress Chart -->
+<article>
+    <header><h3>Rep and Weight Trends</h3></header>
+    {% include "partials/progress_chart.html" %}
+</article>
+
+<a href="/dashboard" role="button" class="outline">Back to Dashboard</a>
+{% endblock %}

app/templates/pages/log_history.html

@@ -0,0 +1,23 @@
+{% extends "base.html" %}
+
+{% block title %}Workout History -- SneakySwole{% endblock %}
+
+{% block content %}
+<hgroup>
+    <h1>Workout History</h1>
+    {% if active_profile %}
+    <p>History for: <strong>{{ active_profile.display_name }}</strong></p>
+    {% else %}
+    <p>No profile selected -- <a href="/profiles">select one</a></p>
+    {% endif %}
+</hgroup>
+
+{% if sessions %}
+{% for ws in sessions %}
+    {% set day = days_by_id.get(ws.workout_day_id) %}
+    {% include "partials/session_card.html" %}
+{% endfor %}
+{% else %}
+<p>No workout sessions recorded yet.</p>
+{% endif %}
+{% endblock %}

app/templates/pages/login.html

@@ -0,0 +1,27 @@
+{% extends "base.html" %}
+
+{% block title %}SneakySwole — Login{% endblock %}
+
+{% block content %}
+<article>
+    <header>
+        <h2>Admin Login</h2>
+    </header>
+
+    {% if error %}
+    <div class="flash-error" role="alert">{{ error }}</div>
+    {% endif %}
+
+    <form method="POST" action="/login">
+        <label for="username">Username</label>
+        <input type="text" id="username" name="username"
+               placeholder="Enter username" required autofocus>
+
+        <label for="password">Password</label>
+        <input type="password" id="password" name="password"
+               placeholder="Enter password" required>
+
+        <button type="submit">Login</button>
+    </form>
+</article>
+{% endblock %}

app/templates/pages/profile_edit.html

@@ -0,0 +1,34 @@
+{% extends "base.html" %}
+
+{% block title %}Edit Profile — {{ profile.display_name }}{% endblock %}
+
+{% block content %}
+<article>
+    <header>
+        <h2>Edit Profile: {{ profile.display_name }}</h2>
+    </header>
+
+    <form method="POST" action="/profiles/{{ profile.id }}/edit">
+        <label for="display_name">Display Name</label>
+        <input type="text" id="display_name" name="display_name"
+               value="{{ profile.display_name }}" required>
+
+        <label for="height">Height</label>
+        <input type="text" id="height" name="height"
+               value="{{ profile.height or '' }}" placeholder="e.g., 6'0&quot;">
+
+        <label for="weight">Weight</label>
+        <input type="text" id="weight" name="weight"
+               value="{{ profile.weight or '' }}" placeholder="e.g., 260 lbs">
+
+        <label for="goals">Goals</label>
+        <textarea id="goals" name="goals"
+                  placeholder="Training goals...">{{ profile.goals or '' }}</textarea>
+
+        <div class="grid">
+            <a href="/profiles" role="button" class="outline secondary">Cancel</a>
+            <button type="submit">Save Changes</button>
+        </div>
+    </form>
+</article>
+{% endblock %}

app/templates/pages/profiles.html

@@ -0,0 +1,16 @@
+{% extends "base.html" %}
+
+{% block title %}User Profiles — SneakySwole{% endblock %}
+
+{% block content %}
+<hgroup>
+    <h1>User Profiles</h1>
+    <p>Manage training profiles.</p>
+</hgroup>
+
+<div class="grid">
+    {% for profile in profiles %}
+        {% include "partials/profile_card.html" %}
+    {% endfor %}
+</div>
+{% endblock %}

app/templates/pages/schedule.html

@@ -0,0 +1,50 @@
+{% extends "base.html" %}
+
+{% block title %}4-Week Schedule -- SneakySwole{% endblock %}
+
+{% block content %}
+<hgroup>
+    <h1>4-Week Schedule</h1>
+    {% if active_profile %}
+    <p>Schedule for: <strong>{{ active_profile.display_name }}</strong></p>
+    {% else %}
+    <p>No profile selected -- <a href="/profiles">select one</a></p>
+    {% endif %}
+</hgroup>
+
+{% for week in weeks %}
+<article>
+    <header>
+        <h3>Week {{ week.week_number }}</h3>
+    </header>
+    <div class="grid">
+        {% for day in week.days %}
+        <div style="text-align:center;
+                    padding:1rem;
+                    border-radius:0.5rem;
+                    {% if day.is_today %}
+                    border: 2px solid var(--pico-primary);
+                    {% endif %}
+                    {% if day.is_completed %}
+                    background: rgba(99, 102, 241, 0.15);
+                    {% endif %}">
+            <strong>{{ day.workout_day.name }}</strong>
+            <br>
+            <small>{{ day.date.strftime('%b %d') }}</small>
+            {% if day.is_completed %}
+            <br><mark>Done</mark>
+            {% endif %}
+            {% if day.is_today %}
+            <br><small><strong>Today</strong></small>
+            {% endif %}
+            <br>
+            <a href="/workouts/{{ day.workout_day.name|lower|replace(' ', '-') }}"
+               style="font-size:0.8rem;">
+                Start
+            </a>
+        </div>
+        {% endfor %}
+    </div>
+</article>
+{% endfor %}
+{% endblock %}

app/templates/pages/session_detail.html

@@ -0,0 +1,51 @@
+{% extends "base.html" %}
+
+{% block title %}Session Detail -- SneakySwole{% endblock %}
+
+{% block content %}
+<hgroup>
+    {% set day = days_by_id.get(workout_session.workout_day_id) %}
+    <h1>
+        {{ day.name if day else "Workout" }}
+        -- {{ workout_session.date.strftime('%B %d, %Y') }}
+    </h1>
+    {% if workout_session.notes %}
+    <p>{{ workout_session.notes }}</p>
+    {% endif %}
+</hgroup>
+
+{% for exercise_id, logs in logs_by_exercise.items() %}
+    {% set exercise = exercises_by_id[exercise_id] %}
+    <article>
+        <header>
+            <h3>{{ exercise.name }}</h3>
+        </header>
+        <table>
+            <thead>
+                <tr>
+                    <th>Set</th>
+                    <th>Reps</th>
+                    <th>Weight</th>
+                    <th>Easy?</th>
+                    <th>Notes</th>
+                </tr>
+            </thead>
+            <tbody>
+                {% for log in logs %}
+                <tr>
+                    <td>{{ log.set_number }}</td>
+                    <td>{{ log.reps_completed }}</td>
+                    <td>{{ log.weight_used }}</td>
+                    <td>{{ "Yes" if log.felt_easy else "No" }}</td>
+                    <td>{{ log.notes or "" }}</td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+    </article>
+{% else %}
+    <p>No exercises logged in this session.</p>
+{% endfor %}
+
+<a href="/history" role="button" class="outline">Back to History</a>
+{% endblock %}

app/templates/pages/workout_day.html

@@ -0,0 +1,31 @@
+{% extends "base.html" %}
+
+{% block title %}{{ day_name }} Day — SneakySwole{% endblock %}
+
+{% block content %}
+<hgroup>
+    <h1>{{ day_name }} Day</h1>
+    {% if active_profile %}
+    <p>Training as: <strong>{{ active_profile.display_name }}</strong></p>
+    {% else %}
+    <p>No profile selected — <a href="/profiles">select one</a></p>
+    {% endif %}
+</hgroup>
+
+<!-- Warmup Section -->
+<section>
+    <h2>Warmup</h2>
+    {% include "partials/warmup_list.html" %}
+</section>
+
+<!-- Exercises Section -->
+<section>
+    <h2>Exercises</h2>
+    {% for exercise in exercises %}
+        {% set program = programs.get(exercise.id) %}
+        {% include "partials/exercise_card.html" %}
+    {% endfor %}
+</section>
+
+<a href="/workouts" role="button" class="outline">Back to All Days</a>
+{% endblock %}

app/templates/pages/workout_days.html

@@ -0,0 +1,22 @@
+{% extends "base.html" %}
+
+{% block title %}Workout Days — SneakySwole{% endblock %}
+
+{% block content %}
+<h1>Workout Days</h1>
+
+<div class="grid">
+    {% for day in days %}
+    <article>
+        <header>
+            <h3>Day {{ day.day_number }}: {{ day.name }}</h3>
+        </header>
+        <p>{{ day.description }}</p>
+        <footer>
+            <a href="/workouts/{{ day.name|lower|replace(' ', '-') }}"
+               role="button">View Workout</a>
+        </footer>
+    </article>
+    {% endfor %}
+</div>
+{% endblock %}

app/templates/partials/exercise_card.html

@@ -0,0 +1,47 @@
+<article>
+    <header>
+        <hgroup>
+            <h3>{{ exercise.name }}</h3>
+            <p>{{ exercise.muscle_group }} | {{ exercise.sets }} sets | Tempo: {{ exercise.tempo }}</p>
+        </hgroup>
+    </header>
+
+    {% if program %}
+    <div class="grid">
+        <div>
+            <small>Week 1</small>
+            <p>{{ program.wk1_reps }} reps @ {{ program.wk1_weight }}</p>
+        </div>
+        <div>
+            <small>Week 4</small>
+            <p>{{ program.wk4_reps }} reps @ {{ program.wk4_weight }}</p>
+        </div>
+    </div>
+    {% endif %}
+
+    {% if suggestions and suggestions[exercise.id] %}
+        {% set suggestion = suggestions[exercise.id] %}
+        {% include "partials/progression_badge.html" %}
+    {% endif %}
+
+    <details>
+        <summary>Form Cues</summary>
+        <p>{{ exercise.form_cues }}</p>
+    </details>
+
+    <!-- Inline logging (Phase 4) -->
+    {% if active_profile %}
+    <div id="logs-exercise-{{ exercise.id }}">
+        {% if existing_logs and existing_logs[exercise.id] %}
+            {% set logs = existing_logs[exercise.id] %}
+            {% set exercise_id = exercise.id %}
+            {% set next_set = logs|length + 1 %}
+            {% include "partials/log_entry.html" %}
+        {% else %}
+            {% set exercise_id = exercise.id %}
+            {% set next_set = 1 %}
+            {% include "partials/log_form.html" %}
+        {% endif %}
+    </div>
+    {% endif %}
+</article>

app/templates/partials/exercise_list.html

@@ -0,0 +1,16 @@
+{% for exercise in exercises %}
+<article>
+    <header>
+        <hgroup>
+            <h3>{{ exercise.name }}</h3>
+            <p>{{ exercise.muscle_group }} | {{ exercise.workout_day }} Day | {{ exercise.sets }} sets | Tempo: {{ exercise.tempo }}</p>
+        </hgroup>
+    </header>
+    <details>
+        <summary>Form Cues</summary>
+        <p>{{ exercise.form_cues }}</p>
+    </details>
+</article>
+{% else %}
+<p>No exercises found matching your filters.</p>
+{% endfor %}

app/templates/partials/flash_message.html

@@ -0,0 +1,6 @@
+{% if flash_success %}
+<div class="flash-success" role="status">{{ flash_success }}</div>
+{% endif %}
+{% if flash_error %}
+<div class="flash-error" role="alert">{{ flash_error }}</div>
+{% endif %}

app/templates/partials/log_entry.html

@@ -0,0 +1,39 @@
+<!-- Displays logged sets for a single exercise within a session -->
+{% if logs %}
+<table>
+    <thead>
+        <tr>
+            <th>Set</th>
+            <th>Reps</th>
+            <th>Weight</th>
+            <th>Easy?</th>
+            <th>Actions</th>
+        </tr>
+    </thead>
+    <tbody>
+        {% for log in logs %}
+        <tr>
+            <td>{{ log.set_number }}</td>
+            <td>{{ log.reps_completed }}</td>
+            <td>{{ log.weight_used }}</td>
+            <td>{{ "Yes" if log.felt_easy else "No" }}</td>
+            <td>
+                <form hx-post="/log/{{ log.id }}/delete"
+                      hx-target="#logs-exercise-{{ exercise_id }}"
+                      hx-swap="innerHTML"
+                      hx-confirm="Delete this set?"
+                      style="display:inline; margin:0;">
+                    <button type="submit" class="outline secondary"
+                            style="padding:0.2rem 0.5rem; font-size:0.8rem;">
+                        Delete
+                    </button>
+                </form>
+            </td>
+        </tr>
+        {% endfor %}
+    </tbody>
+</table>
+{% endif %}
+
+<!-- Next set form -->
+{% include "partials/log_form.html" %}

app/templates/partials/log_form.html

@@ -0,0 +1,24 @@
+<!-- Inline logging form, included inside each exercise_card.html -->
+<form hx-post="/log"
+      hx-target="#logs-exercise-{{ exercise_id }}"
+      hx-swap="innerHTML"
+      style="margin-bottom:0;">
+    <input type="hidden" name="exercise_id" value="{{ exercise_id }}">
+    <input type="hidden" name="workout_day_id" value="{{ workout_day_id }}">
+    <input type="hidden" name="set_number" value="{{ next_set|default(1) }}">
+
+    <div style="display:flex; align-items:center; gap:0.5rem; flex-wrap:wrap;">
+        <small style="white-space:nowrap; opacity:0.7;">Set {{ next_set|default(1) }}</small>
+        <input type="number" name="reps" placeholder="Reps"
+               min="0" max="100" required
+               style="width:5rem; margin-bottom:0;">
+        <input type="text" name="weight" placeholder="Weight (lbs)"
+               required
+               style="width:8rem; margin-bottom:0;">
+        <label style="display:flex; align-items:center; gap:0.3rem; margin-bottom:0; white-space:nowrap;">
+            <input type="checkbox" name="felt_easy" role="switch" style="margin-bottom:0;">
+            Easy?
+        </label>
+        <button type="submit" style="margin-bottom:0; width:auto; white-space:nowrap;">Log Set</button>
+    </div>
+</form>

app/templates/partials/nav.html

@@ -0,0 +1,38 @@
+{% set admin = request.state.admin %}
+{% set profiles = request.state.profiles %}
+{% set active_profile = request.state.active_profile %}
+{% if admin %}
+<li>
+    <details class="dropdown">
+        <summary>
+            {% if active_profile %}
+                {{ active_profile.display_name }}
+            {% else %}
+                Select Profile
+            {% endif %}
+        </summary>
+        <ul dir="rtl">
+            {% for profile in profiles %}
+            <li>
+                <form method="POST" action="/profiles/switch" style="margin:0;">
+                    <input type="hidden" name="profile_id" value="{{ profile.id }}">
+                    <button type="submit" class="outline secondary"
+                            style="width:100%; text-align:left; border:none;">
+                        {{ profile.display_name }}
+                    </button>
+                </form>
+            </li>
+            {% endfor %}
+        </ul>
+    </details>
+</li>
+<li><a href="/workouts">Workouts</a></li>
+<li><a href="/schedule">Schedule</a></li>
+<li><a href="/dashboard">Dashboard</a></li>
+<li><a href="/history">History</a></li>
+<li><a href="/exercises">Exercises</a></li>
+<li><a href="/profiles">Profiles</a></li>
+<li><a href="/logout">Logout</a></li>
+{% else %}
+<li><a href="/login">Login</a></li>
+{% endif %}

app/templates/partials/profile_card.html

@@ -0,0 +1,12 @@
+<article>
+    <header>
+        <hgroup>
+            <h3>{{ profile.display_name }}</h3>
+            <p>{{ profile.height }} | {{ profile.weight }}</p>
+        </hgroup>
+    </header>
+    <p>{{ profile.goals or "No goals set" }}</p>
+    <footer>
+        <a href="/profiles/{{ profile.id }}/edit" role="button" class="outline">Edit</a>
+    </footer>
+</article>

app/templates/partials/progress_chart.html

@@ -0,0 +1,56 @@
+<canvas id="progress-chart" style="max-height:300px;"></canvas>
+<p id="progress-chart-empty" style="display:none;">No data yet.</p>
+<script>
+(function() {
+    var data = {{ progress_data_json|safe }};
+
+    if (!data.dates || data.dates.length === 0) {
+        document.getElementById('progress-chart').style.display = 'none';
+        document.getElementById('progress-chart-empty').style.display = 'block';
+        return;
+    }
+
+    new Chart(document.getElementById('progress-chart'), {
+        type: 'line',
+        data: {
+            labels: data.dates,
+            datasets: [
+                {
+                    label: 'Avg Reps',
+                    data: data.reps,
+                    borderColor: 'rgba(99, 102, 241, 1)',
+                    backgroundColor: 'rgba(99, 102, 241, 0.2)',
+                    yAxisID: 'y-reps',
+                    tension: 0.3
+                },
+                {
+                    label: 'Weight (lbs)',
+                    data: data.weights,
+                    borderColor: 'rgba(244, 63, 94, 1)',
+                    backgroundColor: 'rgba(244, 63, 94, 0.2)',
+                    yAxisID: 'y-weight',
+                    tension: 0.3
+                }
+            ]
+        },
+        options: {
+            responsive: true,
+            interaction: { mode: 'index', intersect: false },
+            scales: {
+                'y-reps': {
+                    type: 'linear', display: true, position: 'left',
+                    title: { display: true, text: 'Reps', color: '#ccc' },
+                    ticks: { color: '#ccc' }
+                },
+                'y-weight': {
+                    type: 'linear', display: true, position: 'right',
+                    title: { display: true, text: 'Weight (lbs)', color: '#ccc' },
+                    ticks: { color: '#ccc' },
+                    grid: { drawOnChartArea: false }
+                },
+                x: { ticks: { color: '#ccc' } }
+            }
+        }
+    });
+})();
+</script>

app/templates/partials/progression_badge.html

@@ -0,0 +1,11 @@
+{% if suggestion and suggestion.progression_type != "no_program" %}
+<div style="background: rgba(99, 102, 241, 0.1);
+            border-left: 3px solid var(--pico-primary);
+            padding: 0.5rem 1rem;
+            margin-bottom: 0.5rem;
+            border-radius: 0 0.25rem 0.25rem 0;">
+    <small>
+        <strong>Suggestion:</strong> {{ suggestion.message }}
+    </small>
+</div>
+{% endif %}

app/templates/partials/session_card.html

@@ -0,0 +1,16 @@
+<article>
+    <header>
+        <hgroup>
+            <h3>{{ day.name if day else "Unknown" }} Day</h3>
+            <p>{{ ws.date.strftime('%A, %B %d, %Y') }}</p>
+        </hgroup>
+    </header>
+    {% if ws.notes %}
+    <p>{{ ws.notes }}</p>
+    {% endif %}
+    <footer>
+        <a href="/history/{{ ws.id }}" role="button" class="outline">
+            View Details
+        </a>
+    </footer>
+</article>

app/templates/partials/stats_card.html

@@ -0,0 +1,24 @@
+<article>
+    <header><h4>Sessions</h4></header>
+    <p style="font-size:2rem; font-weight:700;">
+        {{ stats.total_sessions }}
+    </p>
+</article>
+<article>
+    <header><h4>Total Volume</h4></header>
+    <p style="font-size:2rem; font-weight:700;">
+        {{ "{:,}".format(stats.total_volume) }} lbs
+    </p>
+</article>
+<article>
+    <header><h4>Total Sets</h4></header>
+    <p style="font-size:2rem; font-weight:700;">
+        {{ stats.total_sets }}
+    </p>
+</article>
+<article>
+    <header><h4>Streak</h4></header>
+    <p style="font-size:2rem; font-weight:700;">
+        {{ stats.current_streak }} week{{ "s" if stats.current_streak != 1 }}
+    </p>
+</article>

app/templates/partials/volume_chart.html

@@ -0,0 +1,30 @@
+<canvas id="volume-chart" style="max-height:300px;"></canvas>
+<script>
+(function() {
+    var data = {{ volume_data_json|safe }};
+    var labels = Object.keys(data);
+    var values = Object.values(data);
+
+    new Chart(document.getElementById('volume-chart'), {
+        type: 'bar',
+        data: {
+            labels: labels,
+            datasets: [{
+                label: 'Total Volume (lbs)',
+                data: values,
+                backgroundColor: 'rgba(99, 102, 241, 0.7)',
+                borderColor: 'rgba(99, 102, 241, 1)',
+                borderWidth: 1
+            }]
+        },
+        options: {
+            responsive: true,
+            plugins: { legend: { display: false } },
+            scales: {
+                y: { beginAtZero: true, ticks: { color: '#ccc' } },
+                x: { ticks: { color: '#ccc' } }
+            }
+        }
+    });
+})();
+</script>

app/templates/partials/warmup_list.html

@@ -0,0 +1,23 @@
+<table>
+    <thead>
+        <tr>
+            <th>Exercise</th>
+            <th>Type</th>
+            <th>Reps</th>
+        </tr>
+    </thead>
+    <tbody>
+        {% for warmup in warmups %}
+        <tr>
+            <td>
+                <details>
+                    <summary>{{ warmup.name }}</summary>
+                    <p>{{ warmup.form_cues }}</p>
+                </details>
+            </td>
+            <td>{{ warmup.type }}</td>
+            <td>{{ warmup.reps }}</td>
+        </tr>
+        {% endfor %}
+    </tbody>
+</table>

app/utils/auth.py

@@ -0,0 +1,87 @@
+"""Authentication dependencies for FastAPI route protection.
+
+Provides dependency functions that verify the admin session cookie
+and return the authenticated User, or redirect to /login.
+"""
+
+from typing import Optional
+
+import structlog
+from fastapi import Depends, Request
+from fastapi.responses import RedirectResponse
+from sqlmodel import Session
+
+from app.database import get_db_session
+from app.models.user import User
+from app.services.auth_service import AuthService
+
+logger = structlog.get_logger(__name__)
+
+
+class NotAuthenticatedError(Exception):
+    """Raised when a request lacks valid authentication."""
+
+# Cookie name for the admin session
+SESSION_COOKIE_NAME = "session"
+
+
+def get_current_admin_user(request: Request, session: Session = Depends(get_db_session)) -> User:
+    """FastAPI dependency that extracts and validates the admin session.
+
+    Reads the session cookie, validates the token, and returns the
+    authenticated admin User. Redirects to /login (303) if not authenticated.
+
+    Args:
+        request: The incoming HTTP request.
+        session: Database session (injected by FastAPI).
+
+    Returns:
+        The authenticated admin User.
+
+    Raises:
+        RedirectResponse: 303 redirect to /login if no valid admin session.
+    """
+    token = request.cookies.get(SESSION_COOKIE_NAME)
+    if not token:
+        raise _login_redirect()
+
+    secret_key = getattr(request.app.state, "secret_key", "")
+    auth_service = AuthService(session, secret_key=secret_key)
+    user_id = auth_service.validate_session_token(token)
+
+    if user_id is None:
+        raise _login_redirect()
+
+    user = session.get(User, user_id)
+    if user is None or not user.is_admin:
+        raise _login_redirect()
+
+    return user
+
+
+def get_active_profile_id(request: Request) -> Optional[int]:
+    """Extract the active profile ID from the session cookie.
+
+    The admin selects which user profile to view/log as. This is stored
+    in a separate cookie called 'active_profile_id'.
+
+    Args:
+        request: The incoming HTTP request.
+
+    Returns:
+        The active profile user ID, or None if not set.
+    """
+    profile_id = request.cookies.get("active_profile_id")
+    if profile_id and profile_id.isdigit():
+        return int(profile_id)
+    return None
+
+
+def _login_redirect():
+    """Create a redirect exception to the login page.
+
+    Returns:
+        A NotAuthenticatedError handled by a registered exception handler
+        in main.py that sends a 302 redirect to /login.
+    """
+    return NotAuthenticatedError()

docs/roadmap.md

@@ -25,16 +25,42 @@ Build the database schema and seed it from YAML config files.
 - Two initial user profiles seeded: Phillip and Daughter
 - Service layer for all DB access (no direct queries from routes)
 
-## Phase 3: Workout UI
+### Phase 3: Workout UI ✅
 
-The core user-facing experience — viewing workouts and managing profiles.
+**Completed:** 2026-02-24
 
-- Admin login (simple session-based auth, password hashed)
+**Summary:** Built the core user-facing experience — admin login with bcrypt + signed session cookies, profile switcher, workout day viewer with warmups and exercise cards, and HTMX-powered exercise browser with search/filter. Added Jinja2 context processor middleware for automatic nav context injection.
-- Profile switcher in nav (admin selects active user profile)
+
-- Admin can create and edit user profiles (name, weight, height, goals)
+**Key files:**
-- Workout day viewer — warmup routine + main exercises with full form cues
+- `app/services/auth_service.py` — AuthService (bcrypt auth + itsdangerous session tokens)
-- Exercise library browser (search/filter by muscle group, workout day)
+- `app/utils/auth.py` — `get_current_admin_user` (303 redirect to /login), `get_active_profile_id`
-- All interactions via HTMX partials (no JSON APIs, no vanilla JS)
+- `app/routes/auth.py` — login/logout routes
+- `app/routes/profiles.py` — profile list, switch, edit routes
+- `app/routes/workouts.py` — workout day list + detail viewer
+- `app/routes/exercises.py` — exercise browser with HTMX search
+- `app/templates/partials/nav.html` — profile switcher dropdown (reads from request.state)
+- `app/main.py` — NavContextMiddleware, secret_key, all routers registered
+
+**Endpoints created:**
+- `GET /login` — render login form
+- `POST /login` — authenticate and set session cookie
+- `GET /logout` — clear session, redirect to /login
+- `GET /profiles` — list user profiles
+- `POST /profiles/switch` — set active profile cookie
+- `GET /profiles/{id}/edit` — profile edit form
+- `POST /profiles/{id}/edit` — update profile
+- `GET /workouts` — workout day cards
+- `GET /workouts/{day_name}` — warmups + exercises + programming targets
+- `GET /exercises` — exercise browser with filter dropdowns
+- `GET /exercises/search` — HTMX partial for filtered exercise list
+
+**Key details:**
+- Auth uses 303 redirect to /login (not 401) for browser UX
+- Nav context injected via `NavContextMiddleware` into `request.state` (admin, profiles, active_profile)
+- Session cookie: httponly=True, samesite="lax", max_age=86400 (24h)
+- `itsdangerous>=2.2.0` added to requirements.txt
+- `python-multipart>=0.0.20` added for form data parsing
+- 66 tests pass (12 new Phase 3 tests + 54 existing)
 
 ## Phase 4: Logging & Tracking
 

pyproject.toml

@@ -6,4 +6,7 @@ requires-python = ">=3.12"
 
 [build-system]
 requires = ["setuptools>=75.0"]
-build-backend = "setuptools.backends._legacy:_Backend"
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools.packages.find]
+include = ["app*"]

requirements.txt

@@ -4,6 +4,8 @@ jinja2>=3.1.0,<4.0.0
 structlog>=24.0.0,<25.0.0
 python-dotenv>=1.0.0,<2.0.0
 bcrypt>=4.2.0,<5.0.0
+itsdangerous>=2.2.0,<3.0.0
+python-multipart>=0.0.20,<1.0.0
 pyyaml>=6.0.0,<7.0.0
 sqlmodel>=0.0.22,<1.0.0
 alembic>=1.14.0,<2.0.0

tests/test_analytics_service.py

@@ -0,0 +1,96 @@
+"""Tests for the AnalyticsService class."""
+
+from datetime import date, timedelta
+
+from sqlmodel import SQLModel, Session, create_engine
+
+from app.models.user import User
+from app.models.exercise import Exercise
+from app.models.workout_day import WorkoutDay
+from app.models.workout_session import WorkoutSession
+from app.models.workout_log import WorkoutLog
+from app.services.analytics_service import AnalyticsService
+
+
+class TestAnalyticsService:
+    """Tests for analytics data aggregation."""
+
+    def _setup(self):
+        """Create DB with sessions and logs for analytics."""
+        engine = create_engine("sqlite:///:memory:")
+        SQLModel.metadata.create_all(engine)
+        session = Session(engine)
+
+        user = User(username="phil", password_hash="h", display_name="Phillip")
+        day = WorkoutDay(name="Push", day_number=1, description="Push day")
+        exercise = Exercise(
+            name="DB Chest Press", muscle_group="Chest",
+            workout_day="Push", sets=3, tempo="3-1-2", form_cues="...",
+        )
+        session.add_all([user, day, exercise])
+        session.commit()
+        session.refresh(user)
+        session.refresh(day)
+        session.refresh(exercise)
+
+        # Create 3 sessions over 3 weeks
+        for week in range(3):
+            ws = WorkoutSession(
+                user_id=user.id, workout_day_id=day.id,
+                date=date.today() - timedelta(days=(2 - week) * 7),
+            )
+            session.add(ws)
+            session.commit()
+            session.refresh(ws)
+
+            for set_num in range(1, 4):
+                session.add(WorkoutLog(
+                    session_id=ws.id, exercise_id=exercise.id,
+                    set_number=set_num,
+                    reps_completed=8 + week,
+                    weight_used="30 lbs",
+                    felt_easy=(week == 2),
+                ))
+            session.commit()
+
+        service = AnalyticsService(session)
+        return session, service, user, exercise
+
+    def test_get_total_sessions(self) -> None:
+        """Should return the total number of sessions for a user."""
+        session, service, user, exercise = self._setup()
+        stats = service.get_user_stats(user.id)
+        assert stats["total_sessions"] == 3
+        session.close()
+
+    def test_get_total_volume(self) -> None:
+        """Should calculate total volume (sets x reps x weight)."""
+        session, service, user, exercise = self._setup()
+        stats = service.get_user_stats(user.id)
+        assert stats["total_volume"] > 0
+        session.close()
+
+    def test_get_workout_streak(self) -> None:
+        """Should calculate consecutive workout weeks."""
+        session, service, user, exercise = self._setup()
+        stats = service.get_user_stats(user.id)
+        assert stats["current_streak"] >= 1
+        session.close()
+
+    def test_get_exercise_progress_data(self) -> None:
+        """Should return chart-ready data for an exercise."""
+        session, service, user, exercise = self._setup()
+        data = service.get_exercise_progress(user.id, exercise.id)
+        assert "dates" in data
+        assert "reps" in data
+        assert "weights" in data
+        assert len(data["dates"]) == 3
+        session.close()
+
+    def test_get_volume_by_day(self) -> None:
+        """Should return volume per workout day for charts."""
+        session, service, user, exercise = self._setup()
+        data = service.get_volume_by_day(user.id)
+        assert "Push" in data
+        assert data["Push"] > 0
+        session.close()

tests/test_auth_dependency.py

@@ -0,0 +1,56 @@
+"""Tests for the auth dependency (require_admin)."""
+
+from unittest.mock import MagicMock
+
+import pytest
+from fastapi import HTTPException
+
+from app.utils.auth import get_current_admin_user, get_active_profile_id
+
+
+class TestAuthDependency:
+    """Tests for the require_admin dependency."""
+
+    def test_redirects_when_no_session_cookie(self) -> None:
+        """Should redirect to /login (303) when no session cookie is present."""
+        request = MagicMock()
+        request.cookies = {}
+
+        with pytest.raises(HTTPException) as exc_info:
+            get_current_admin_user(request=request, session=MagicMock())
+        assert exc_info.value.status_code == 303
+
+    def test_redirects_when_invalid_token(self) -> None:
+        """Should redirect to /login (303) when session cookie has invalid token."""
+        request = MagicMock()
+        request.cookies = {"session": "invalid-token"}
+        request.app.state.secret_key = "test-secret"
+
+        mock_session = MagicMock()
+        mock_session.get.return_value = None
+
+        with pytest.raises(HTTPException) as exc_info:
+            get_current_admin_user(request=request, session=mock_session)
+        assert exc_info.value.status_code == 303
+
+
+class TestGetActiveProfileId:
+    """Tests for the get_active_profile_id dependency."""
+
+    def test_returns_profile_id_from_cookie(self) -> None:
+        """Should return the integer profile ID from cookie."""
+        request = MagicMock()
+        request.cookies = {"active_profile_id": "5"}
+        assert get_active_profile_id(request) == 5
+
+    def test_returns_none_when_no_cookie(self) -> None:
+        """Should return None when no active_profile_id cookie is set."""
+        request = MagicMock()
+        request.cookies = {}
+        assert get_active_profile_id(request) is None
+
+    def test_returns_none_for_non_numeric(self) -> None:
+        """Should return None for non-numeric cookie values."""
+        request = MagicMock()
+        request.cookies = {"active_profile_id": "abc"}
+        assert get_active_profile_id(request) is None

tests/test_auth_routes.py

@@ -0,0 +1,43 @@
+"""Tests for login/logout routes."""
+
+from fastapi.testclient import TestClient
+
+
+class TestLoginPage:
+    """Tests for GET /login."""
+
+    def test_login_page_returns_200(self, client: TestClient) -> None:
+        """GET /login should render the login form."""
+        response = client.get("/login")
+        assert response.status_code == 200
+        assert "Login" in response.text
+
+    def test_login_page_has_form(self, client: TestClient) -> None:
+        """GET /login should contain a login form with username and password."""
+        response = client.get("/login")
+        assert 'name="username"' in response.text
+        assert 'name="password"' in response.text
+
+
+class TestLoginPost:
+    """Tests for POST /login."""
+
+    def test_login_invalid_credentials_shows_error(self, client: TestClient) -> None:
+        """POST /login with wrong credentials should show error message."""
+        response = client.post(
+            "/login",
+            data={"username": "wrong", "password": "wrong"},
+            follow_redirects=False,
+        )
+        # Should re-render login page with error or redirect back
+        assert response.status_code in (200, 303)
+
+
+class TestLogout:
+    """Tests for GET /logout."""
+
+    def test_logout_redirects_to_login(self, client: TestClient) -> None:
+        """GET /logout should clear session and redirect to login."""
+        response = client.get("/logout", follow_redirects=False)
+        assert response.status_code in (303, 307)
+        assert "/login" in response.headers.get("location", "")

tests/test_auth_service.py

@@ -0,0 +1,93 @@
+"""Tests for the AuthService class."""
+
+import bcrypt
+from sqlmodel import SQLModel, Session, create_engine
+
+from app.models.user import User
+from app.services.auth_service import AuthService
+
+
+class TestAuthService:
+    """Tests for admin authentication logic."""
+
+    def _setup(self):
+        """Create an in-memory DB with an admin user."""
+        engine = create_engine("sqlite:///:memory:")
+        SQLModel.metadata.create_all(engine)
+        session = Session(engine)
+
+        # Create admin user with known password
+        pw_hash = bcrypt.hashpw(b"adminpass", bcrypt.gensalt()).decode("utf-8")
+        admin = User(
+            username="admin",
+            password_hash=pw_hash,
+            display_name="Admin",
+            is_admin=True,
+        )
+        session.add(admin)
+        session.commit()
+
+        service = AuthService(session, secret_key="test-secret-key")
+        return session, service
+
+    def test_authenticate_valid_credentials(self) -> None:
+        """authenticate should return the User for valid credentials."""
+        session, service = self._setup()
+        user = service.authenticate("admin", "adminpass")
+        assert user is not None
+        assert user.username == "admin"
+        session.close()
+
+    def test_authenticate_wrong_password(self) -> None:
+        """authenticate should return None for wrong password."""
+        session, service = self._setup()
+        user = service.authenticate("admin", "wrongpass")
+        assert user is None
+        session.close()
+
+    def test_authenticate_unknown_user(self) -> None:
+        """authenticate should return None for unknown username."""
+        session, service = self._setup()
+        user = service.authenticate("nobody", "anything")
+        assert user is None
+        session.close()
+
+    def test_authenticate_non_admin(self) -> None:
+        """authenticate should return None for non-admin users."""
+        session, service = self._setup()
+        pw_hash = bcrypt.hashpw(b"userpass", bcrypt.gensalt()).decode("utf-8")
+        non_admin = User(
+            username="regular",
+            password_hash=pw_hash,
+            display_name="Regular",
+            is_admin=False,
+        )
+        session.add(non_admin)
+        session.commit()
+
+        user = service.authenticate("regular", "userpass")
+        assert user is None
+        session.close()
+
+    def test_create_session_token(self) -> None:
+        """create_session_token should return a non-empty signed string."""
+        session, service = self._setup()
+        token = service.create_session_token(user_id=1)
+        assert isinstance(token, str)
+        assert len(token) > 0
+        session.close()
+
+    def test_validate_session_token(self) -> None:
+        """validate_session_token should return the user_id from a valid token."""
+        session, service = self._setup()
+        token = service.create_session_token(user_id=42)
+        user_id = service.validate_session_token(token)
+        assert user_id == 42
+        session.close()
+
+    def test_validate_session_token_invalid(self) -> None:
+        """validate_session_token should return None for tampered tokens."""
+        session, service = self._setup()
+        user_id = service.validate_session_token("fake-token-value")
+        assert user_id is None
+        session.close()

tests/test_dashboard_routes.py

@@ -0,0 +1,21 @@
+"""Tests for dashboard routes."""
+
+from fastapi.testclient import TestClient
+
+
+class TestDashboard:
+    """Tests for GET /dashboard."""
+
+    def test_dashboard_requires_auth(self, client: TestClient) -> None:
+        """GET /dashboard should require admin login."""
+        response = client.get("/dashboard", follow_redirects=False)
+        assert response.status_code in (401, 303)
+
+
+class TestExerciseProgress:
+    """Tests for GET /dashboard/exercise/<id>."""
+
+    def test_exercise_progress_requires_auth(self, client: TestClient) -> None:
+        """GET /dashboard/exercise/1 should require admin login."""
+        response = client.get("/dashboard/exercise/1", follow_redirects=False)
+        assert response.status_code in (401, 303)

tests/test_exercise_routes.py

@@ -0,0 +1,24 @@
+"""Tests for exercise browser routes."""
+
+from fastapi.testclient import TestClient
+
+
+class TestExerciseBrowser:
+    """Tests for GET /exercises."""
+
+    def test_exercise_browser_requires_auth(self, client: TestClient) -> None:
+        """GET /exercises should require admin login."""
+        response = client.get("/exercises", follow_redirects=False)
+        assert response.status_code in (401, 303)
+
+
+class TestExerciseSearch:
+    """Tests for HTMX exercise search."""
+
+    def test_exercise_search_requires_auth(self, client: TestClient) -> None:
+        """GET /exercises/search should require admin login."""
+        response = client.get(
+            "/exercises/search?workout_day=Push",
+            follow_redirects=False,
+        )
+        assert response.status_code in (401, 303)

tests/test_history_routes.py

@@ -0,0 +1,21 @@
+"""Tests for log history routes."""
+
+from fastapi.testclient import TestClient
+
+
+class TestLogHistory:
+    """Tests for GET /history."""
+
+    def test_history_requires_auth(self, client: TestClient) -> None:
+        """GET /history should require admin login."""
+        response = client.get("/history", follow_redirects=False)
+        assert response.status_code in (401, 303)
+
+
+class TestSessionDetail:
+    """Tests for GET /history/<session_id>."""
+
+    def test_session_detail_requires_auth(self, client: TestClient) -> None:
+        """GET /history/1 should require admin login."""
+        response = client.get("/history/1", follow_redirects=False)
+        assert response.status_code in (401, 303)

tests/test_log_service.py

@@ -0,0 +1,107 @@
+"""Tests for the LogService class."""
+
+from datetime import date
+
+from sqlmodel import SQLModel, Session, create_engine
+
+from app.models.user import User
+from app.models.exercise import Exercise
+from app.models.workout_day import WorkoutDay
+from app.models.workout_session import WorkoutSession
+from app.models.workout_log import WorkoutLog
+from app.services.log_service import LogService
+
+
+class TestLogService:
+    """Tests for workout log CRUD operations."""
+
+    def _setup(self):
+        """Create an in-memory DB with prerequisite data."""
+        engine = create_engine("sqlite:///:memory:")
+        SQLModel.metadata.create_all(engine)
+        session = Session(engine)
+
+        user = User(username="phil", password_hash="h", display_name="Phillip")
+        day = WorkoutDay(name="Push", day_number=1, description="Push day")
+        exercise = Exercise(
+            name="DB Chest Press", muscle_group="Chest",
+            workout_day="Push", sets=3, tempo="3-1-2", form_cues="...",
+        )
+        session.add_all([user, day, exercise])
+        session.commit()
+        session.refresh(user)
+        session.refresh(day)
+        session.refresh(exercise)
+
+        ws = WorkoutSession(
+            user_id=user.id, workout_day_id=day.id, date=date.today(),
+        )
+        session.add(ws)
+        session.commit()
+        session.refresh(ws)
+
+        service = LogService(session)
+        return session, service, ws, exercise
+
+    def test_create_log_entry(self) -> None:
+        """create_log should insert a new log entry."""
+        session, service, ws, exercise = self._setup()
+        log = service.create_log(
+            session_id=ws.id,
+            exercise_id=exercise.id,
+            set_number=1,
+            reps_completed=8,
+            weight_used="30 lbs",
+            felt_easy=False,
+        )
+        assert log.id is not None
+        assert log.reps_completed == 8
+        session.close()
+
+    def test_list_logs_for_session(self) -> None:
+        """list_logs_for_session should return all logs for a session."""
+        session, service, ws, exercise = self._setup()
+        service.create_log(ws.id, exercise.id, 1, 8, "30 lbs", False)
+        service.create_log(ws.id, exercise.id, 2, 8, "30 lbs", False)
+        service.create_log(ws.id, exercise.id, 3, 7, "30 lbs", True)
+        logs = service.list_logs_for_session(ws.id)
+        assert len(logs) == 3
+        session.close()
+
+    def test_list_logs_for_exercise_in_session(self) -> None:
+        """list_logs_for_exercise should filter by exercise within a session."""
+        session, service, ws, exercise = self._setup()
+        service.create_log(ws.id, exercise.id, 1, 8, "30 lbs", False)
+        logs = service.list_logs_for_exercise(ws.id, exercise.id)
+        assert len(logs) == 1
+        session.close()
+
+    def test_update_log(self) -> None:
+        """update_log should modify an existing log entry."""
+        session, service, ws, exercise = self._setup()
+        log = service.create_log(ws.id, exercise.id, 1, 8, "30 lbs", False)
+        updated = service.update_log(log.id, reps_completed=10, felt_easy=True)
+        assert updated.reps_completed == 10
+        assert updated.felt_easy is True
+        session.close()
+
+    def test_delete_log(self) -> None:
+        """delete_log should remove a log entry."""
+        session, service, ws, exercise = self._setup()
+        log = service.create_log(ws.id, exercise.id, 1, 8, "30 lbs", False)
+        service.delete_log(log.id)
+        logs = service.list_logs_for_session(ws.id)
+        assert len(logs) == 0
+        session.close()
+
+    def test_get_latest_logs_for_exercise(self) -> None:
+        """get_latest_logs should return the most recent logs for an exercise."""
+        session, service, ws, exercise = self._setup()
+        service.create_log(ws.id, exercise.id, 1, 8, "30 lbs", False)
+        service.create_log(ws.id, exercise.id, 2, 8, "30 lbs", True)
+        logs = service.get_latest_logs_for_exercise(
+            user_id=ws.user_id,
+            exercise_id=exercise.id,
+        )
+        assert len(logs) >= 1
+        session.close()

tests/test_logging_routes.py

@@ -0,0 +1,44 @@
+"""Tests for workout logging routes."""
+
+from fastapi.testclient import TestClient
+
+
+class TestLogSet:
+    """Tests for POST /log."""
+
+    def test_log_set_requires_auth(self, client: TestClient) -> None:
+        """POST /log should require admin login."""
+        response = client.post(
+            "/log",
+            data={
+                "exercise_id": "1",
+                "workout_day_id": "1",
+                "set_number": "1",
+                "reps": "8",
+                "weight": "30 lbs",
+            },
+            follow_redirects=False,
+        )
+        assert response.status_code in (401, 303)
+
+
+class TestLogEdit:
+    """Tests for POST /log/<id>/edit."""
+
+    def test_edit_log_requires_auth(self, client: TestClient) -> None:
+        """POST /log/1/edit should require admin login."""
+        response = client.post(
+            "/log/1/edit",
+            data={"reps": "10", "weight": "35 lbs"},
+            follow_redirects=False,
+        )
+        assert response.status_code in (401, 303)
+
+
+class TestLogDelete:
+    """Tests for POST /log/<id>/delete."""
+
+    def test_delete_log_requires_auth(self, client: TestClient) -> None:
+        """POST /log/1/delete should require admin login."""
+        response = client.post("/log/1/delete", follow_redirects=False)
+        assert response.status_code in (401, 303)

tests/test_profile_routes.py

@@ -0,0 +1,26 @@
+"""Tests for profile management routes."""
+
+from fastapi.testclient import TestClient
+
+
+class TestProfileSwitcher:
+    """Tests for POST /profiles/switch."""
+
+    def test_switch_profile_requires_auth(self, client: TestClient) -> None:
+        """POST /profiles/switch should require admin login."""
+        response = client.post(
+            "/profiles/switch",
+            data={"profile_id": "1"},
+            follow_redirects=False,
+        )
+        # Should redirect to login or return 401
+        assert response.status_code in (401, 303)
+
+
+class TestProfileList:
+    """Tests for GET /profiles."""
+
+    def test_profiles_page_requires_auth(self, client: TestClient) -> None:
+        """GET /profiles should require admin login."""
+        response = client.get("/profiles", follow_redirects=False)
+        assert response.status_code in (401, 303)

tests/test_progression_service.py

@@ -0,0 +1,161 @@
+"""Tests for the ProgressionService class."""
+
+from datetime import date, timedelta
+
+from sqlmodel import SQLModel, Session, create_engine
+
+from app.models.user import User
+from app.models.exercise import Exercise
+from app.models.workout_day import WorkoutDay
+from app.models.workout_session import WorkoutSession
+from app.models.workout_log import WorkoutLog
+from app.models.user_exercise_program import UserExerciseProgram
+from app.models.progress_log import ProgressLog
+from app.services.progression_service import ProgressionService
+
+
+class TestProgressionService:
+    """Tests for the auto-progression engine."""
+
+    def _setup(self):
+        """Create an in-memory DB with a user, exercise, and program."""
+        engine = create_engine("sqlite:///:memory:")
+        SQLModel.metadata.create_all(engine)
+        session = Session(engine)
+
+        user = User(username="phil", password_hash="h", display_name="Phillip")
+        day = WorkoutDay(name="Push", day_number=1, description="Push day")
+        exercise = Exercise(
+            name="DB Chest Press", muscle_group="Chest",
+            workout_day="Push", sets=3, tempo="3-1-2", form_cues="...",
+        )
+        session.add_all([user, day, exercise])
+        session.commit()
+        session.refresh(user)
+        session.refresh(day)
+        session.refresh(exercise)
+
+        program = UserExerciseProgram(
+            user_id=user.id, exercise_id=exercise.id,
+            wk1_reps="8", wk4_reps="12",
+            wk1_weight="30 lbs", wk4_weight="40 lbs",
+        )
+        session.add(program)
+        session.commit()
+        session.refresh(program)
+
+        service = ProgressionService(session)
+        return session, service, user, day, exercise, program
+
+    def test_suggest_reps_increase(self) -> None:
+        """Should suggest +1-2 reps when below wk4 target."""
+        session, service, user, day, exercise, program = self._setup()
+
+        # Log a session where user did 8 reps (wk1 target)
+        ws = WorkoutSession(
+            user_id=user.id, workout_day_id=day.id,
+            date=date.today() - timedelta(days=7),
+        )
+        session.add(ws)
+        session.commit()
+        session.refresh(ws)
+
+        for set_num in range(1, 4):
+            session.add(WorkoutLog(
+                session_id=ws.id, exercise_id=exercise.id,
+                set_number=set_num, reps_completed=8,
+                weight_used="30 lbs", felt_easy=False,
+            ))
+        session.commit()
+
+        suggestion = service.get_suggestion(user.id, exercise.id)
+        assert suggestion is not None
+        assert suggestion["suggested_reps"] >= 9  # +1-2 reps
+        assert suggestion["suggested_weight"] == "30 lbs"  # same weight
+        assert suggestion["progression_type"] == "reps_increase"
+        session.close()
+
+    def test_suggest_weight_increase(self) -> None:
+        """Should suggest +5 lbs when at wk4 rep target and felt easy."""
+        session, service, user, day, exercise, program = self._setup()
+
+        # Log two sessions at max reps, all felt easy
+        for week_offset in [14, 7]:
+            ws = WorkoutSession(
+                user_id=user.id, workout_day_id=day.id,
+                date=date.today() - timedelta(days=week_offset),
+            )
+            session.add(ws)
+            session.commit()
+            session.refresh(ws)
+
+            for set_num in range(1, 4):
+                session.add(WorkoutLog(
+                    session_id=ws.id, exercise_id=exercise.id,
+                    set_number=set_num, reps_completed=12,
+                    weight_used="30 lbs", felt_easy=True,
+                ))
+            session.commit()
+
+        suggestion = service.get_suggestion(user.id, exercise.id)
+        assert suggestion is not None
+        assert suggestion["suggested_weight"] == "35 lbs"  # +5 lbs
+        assert suggestion["progression_type"] == "weight_increase"
+        session.close()
+
+    def test_suggest_deload(self) -> None:
+        """Should suggest deload after 4 weeks of progression."""
+        session, service, user, day, exercise, program = self._setup()
+
+        # Log 4 weeks of sessions (simulate week 5 trigger)
+        for week in range(4):
+            ws = WorkoutSession(
+                user_id=user.id, workout_day_id=day.id,
+                date=date.today() - timedelta(days=(4 - week) * 7),
+            )
+            session.add(ws)
+            session.commit()
+            session.refresh(ws)
+
+            for set_num in range(1, 4):
+                session.add(WorkoutLog(
+                    session_id=ws.id, exercise_id=exercise.id,
+                    set_number=set_num, reps_completed=12,
+                    weight_used="40 lbs", felt_easy=False,
+                ))
+            session.commit()
+
+        suggestion = service.get_suggestion(user.id, exercise.id)
+        assert suggestion is not None
+        # After 4 consecutive weeks, week 5 should be deload
+        if suggestion["progression_type"] == "deload":
+            assert "32" in suggestion["suggested_weight"]  # -20% of 40
+        session.close()
+
+    def test_no_suggestion_without_logs(self) -> None:
+        """Should return program defaults when no logs exist."""
+        session, service, user, day, exercise, program = self._setup()
+        suggestion = service.get_suggestion(user.id, exercise.id)
+        assert suggestion is not None
+        assert suggestion["suggested_reps"] == 8  # wk1 default
+        assert suggestion["suggested_weight"] == "30 lbs"  # wk1 default
+        assert suggestion["progression_type"] == "baseline"
+        session.close()
+
+    def test_record_progression(self) -> None:
+        """record_progression should write to progress_log table."""
+        session, service, user, day, exercise, program = self._setup()
+        service.record_progression(
+            user_id=user.id,
+            exercise_id=exercise.id,
+            suggested_reps=10,
+            suggested_weight="30 lbs",
+            actual_reps=10,
+            actual_weight="30 lbs",
+            progression_type="reps_increase",
+        )
+        from sqlmodel import select
+        logs = session.exec(select(ProgressLog)).all()
+        assert len(logs) == 1
+        assert logs[0].progression_applied == "reps_increase"
+        session.close()

tests/test_schedule_routes.py

@@ -0,0 +1,12 @@
+"""Tests for schedule calendar routes."""
+
+from fastapi.testclient import TestClient
+
+
+class TestSchedule:
+    """Tests for GET /schedule."""
+
+    def test_schedule_requires_auth(self, client: TestClient) -> None:
+        """GET /schedule should require admin login."""
+        response = client.get("/schedule", follow_redirects=False)
+        assert response.status_code in (401, 303)

tests/test_workout_routes.py

@@ -0,0 +1,17 @@
+"""Tests for workout day viewer routes."""
+
+from fastapi.testclient import TestClient
+
+
+class TestWorkoutDayViewer:
+    """Tests for GET /workouts/<day_name>."""
+
+    def test_workout_day_requires_auth(self, client: TestClient) -> None:
+        """GET /workouts/push should require admin login."""
+        response = client.get("/workouts/push", follow_redirects=False)
+        assert response.status_code in (401, 303)
+
+    def test_workout_days_list_requires_auth(self, client: TestClient) -> None:
+        """GET /workouts should require admin login."""
+        response = client.get("/workouts", follow_redirects=False)
+        assert response.status_code in (401, 303)

tests/test_workout_session_service.py

@@ -0,0 +1,83 @@
+"""Tests for the WorkoutSessionService class."""
+
+from datetime import date
+
+from sqlmodel import SQLModel, Session, create_engine
+
+from app.models.user import User
+from app.models.workout_day import WorkoutDay
+from app.models.workout_session import WorkoutSession
+from app.services.workout_session_service import WorkoutSessionService
+
+
+class TestWorkoutSessionService:
+    """Tests for workout session CRUD operations."""
+
+    def _setup(self):
+        """Create an in-memory DB with prerequisite data."""
+        engine = create_engine("sqlite:///:memory:")
+        SQLModel.metadata.create_all(engine)
+        session = Session(engine)
+
+        user = User(username="phil", password_hash="h", display_name="Phillip")
+        day = WorkoutDay(name="Push", day_number=1, description="Push day")
+        session.add_all([user, day])
+        session.commit()
+        session.refresh(user)
+        session.refresh(day)
+
+        service = WorkoutSessionService(session)
+        return session, service, user, day
+
+    def test_get_or_create_session_creates_new(self) -> None:
+        """get_or_create_session should create a new session if none exists."""
+        session, service, user, day = self._setup()
+        ws = service.get_or_create_session(
+            user_id=user.id,
+            workout_day_id=day.id,
+            session_date=date.today(),
+        )
+        assert ws.id is not None
+        assert ws.user_id == user.id
+        assert ws.workout_day_id == day.id
+        session.close()
+
+    def test_get_or_create_session_returns_existing(self) -> None:
+        """get_or_create_session should return existing session for same day."""
+        session, service, user, day = self._setup()
+        ws1 = service.get_or_create_session(user.id, day.id, date.today())
+        ws2 = service.get_or_create_session(user.id, day.id, date.today())
+        assert ws1.id == ws2.id
+        session.close()
+
+    def test_list_sessions_for_user(self) -> None:
+        """list_sessions should return all sessions for a user."""
+        session, service, user, day = self._setup()
+        service.get_or_create_session(user.id, day.id, date.today())
+        sessions = service.list_sessions(user_id=user.id)
+        assert len(sessions) == 1
+        session.close()
+
+    def test_list_sessions_empty(self) -> None:
+        """list_sessions should return empty list for user with no sessions."""
+        session, service, user, day = self._setup()
+        sessions = service.list_sessions(user_id=user.id)
+        assert len(sessions) == 0
+        session.close()
+
+    def test_get_session_by_id(self) -> None:
+        """get_session_by_id should return the correct session."""
+        session, service, user, day = self._setup()
+        ws = service.get_or_create_session(user.id, day.id, date.today())
+        found = service.get_session_by_id(ws.id)
+        assert found is not None
+        assert found.id == ws.id
+        session.close()
+
+    def test_update_session_notes(self) -> None:
+        """update_session should allow updating notes."""
+        session, service, user, day = self._setup()
+        ws = service.get_or_create_session(user.id, day.id, date.today())
+        updated = service.update_session(ws.id, notes="Great workout!")
+        assert updated.notes == "Great workout!"
+        session.close()