Ensure only admins can delete users/exercises and users can only edit there own name

app.py

@@ -5,7 +5,7 @@ from flask_login import LoginManager, login_required, current_user
 import jinja_partials
 from jinja2_fragments import render_block
 from decorators import (validate_person, validate_topset, validate_workout, 
-                        require_ownership, get_auth_message, get_person_id_from_context)
+                        require_ownership, get_auth_message, get_person_id_from_context, admin_required)
 from routes.auth import auth, get_person_by_id
 from routes.changelog import changelog_bp
 from routes.calendar import calendar_bp # Import the new calendar blueprint
@@ -165,8 +165,8 @@ def create_person():
 
 @ app.route("/person/<int:person_id>/delete", methods=['DELETE'])
 @login_required
+@admin_required
 @validate_person
-@require_ownership
 def delete_person(person_id):
     db.delete_person(person_id)
     return "", 200, {"HX-Trigger": "updatedPeople"}
@@ -198,6 +198,7 @@ def get_person_name(person_id):
 
 
 @ app.route("/exercise", methods=['POST'])
+@login_required
 def create_exercise():
     name = request.form.get("name")
     attribute_ids = request.form.getlist('attribute_ids')
@@ -218,6 +219,7 @@ def get_exercise(exercise_id):
 
 
 @ app.route("/exercise/<int:exercise_id>/edit_form", methods=['GET'])
+@login_required
 def get_exercise_edit_form(exercise_id):
     exercise = db.get_exercise(exercise_id)
     all_attributes = db.exercises.get_attributes_by_category()
@@ -243,6 +245,7 @@ def get_exercise_edit_form(exercise_id):
 
 
 @ app.route("/exercise/<int:exercise_id>/update", methods=['PUT'])
+@login_required
 def update_exercise(exercise_id):
     new_name = request.form.get('name')
     attribute_ids = request.form.getlist('attribute_ids')
@@ -262,9 +265,6 @@ def delete_exercise(exercise_id):
 @ app.route("/settings")
 @ login_required
 def settings():
-    # check if user is admin
-    if current_user.id != 1007:
-        return redirect(url_for('dashboard'))
     people = db.get_people()
     exercises = db.get_all_exercises()
     all_attributes = db.exercises.get_attributes_by_category()
@@ -329,6 +329,7 @@ def get_exercises():
     return render_template('partials/exercise/exercise_dropdown.html', exercises=exercises, person_id=person_id)
 
 @app.route("/exercise/<int:exercise_id>/edit_name", methods=['GET', 'POST'])
+@login_required
 def edit_exercise_name(exercise_id):
     exercise = db.exercises.get_exercise(exercise_id)
     person_id = request.args.get('person_id', type=int)
@@ -340,6 +341,7 @@ def edit_exercise_name(exercise_id):
         return render_template('partials/exercise/exercise_list_item.html', exercise=updated_exercise, person_id=person_id)
 
 @app.route("/exercises/add", methods=['POST'])
+@login_required
 def add_exercise():
     exercise_name = request.form['query']
     new_exercise = db.exercises.add_exercise(exercise_name)
@@ -347,6 +349,8 @@ def add_exercise():
     return render_template('partials/exercise/exercise_list_item.html', exercise=new_exercise, person_id=person_id)
 
 @ app.route("/exercise/<int:exercise_id>/delete", methods=['DELETE'])
+@login_required
+@admin_required
 def delete_exercise(exercise_id):
     db.exercises.delete_exercise(exercise_id)
     return ""

decorators.py

@@ -97,11 +97,30 @@ ACTION_MAP = {
     'tags.delete_tag': 'delete this tag',
     'tags.add_tag_to_workout': 'add a tag to this workout',
     'tags.create_new_tag_for_workout': 'create a new tag for this workout',
-    'programs.create_program': 'create a workout program',
+    'workout.create_program': 'create a workout program',
     'programs.delete_program': 'delete this workout program',
+    'delete_exercise': 'delete an exercise',
+    'delete_person': 'delete a user',
 }
 
 
+def admin_required(func):
+    @wraps(func)
+    def wrapper(*args, **kwargs):
+        if not current_user.is_authenticated or not getattr(current_user, 'is_admin', False):
+            from flask import flash
+            msg = "You must be an admin to perform this action."
+            if request.endpoint in ACTION_MAP:
+                msg = f"You must be an admin to {ACTION_MAP[request.endpoint]}."
+            
+            flash(msg, "warning")
+            if request.headers.get('HX-Request'):
+                return '', 200, {'HX-Redirect': url_for('dashboard')}
+            return render_template('error.html', error='403', message=msg, url='/')
+        return func(*args, **kwargs)
+    return wrapper
+
+
 def get_auth_message(endpoint, person_id=None, is_authenticated=False):
     """Generates a friendly authorization message."""
     action = ACTION_MAP.get(endpoint)
@@ -128,8 +147,9 @@ def require_ownership(func):
     def wrapper(*args, **kwargs):
         person_id = get_person_id_from_context()
         
-        # Authorization check: must be logged in and the owner
-        if not current_user.is_authenticated or person_id is None or int(current_user.get_id()) != person_id:
+        # Authorization check: must be logged in and (the owner or an admin)
+        is_admin = getattr(current_user, 'is_admin', False)
+        if not current_user.is_authenticated or (person_id is not None and int(current_user.get_id()) != person_id and not is_admin):
             from flask import flash
             msg = get_auth_message(request.endpoint, person_id, is_authenticated=current_user.is_authenticated)
             flash(msg, "info")

routes/auth.py

@@ -12,11 +12,12 @@ class Person:
     """
     Simple Person class compatible with Flask-Login.
     """
-    def __init__(self, person_id, name, email, password_hash):
+    def __init__(self, person_id, name, email, password_hash, is_admin=False):
         self.id = person_id
         self.name = name
         self.email = email
         self.password_hash = password_hash
+        self.is_admin = is_admin
 
     def get_id(self):
         """Required by Flask-Login to get a unique user identifier."""
@@ -44,14 +45,14 @@ def get_person_by_id(person_id):
     Fetch a person record by person_id and return a Person object.
     """
     sql = """
-        SELECT person_id, name, email, password_hash
+        SELECT person_id, name, email, password_hash, is_admin
         FROM person
         WHERE person_id = %s
         LIMIT 1
     """
     row = db.execute(sql, [person_id], one=True)
     if row:
-        return Person(row['person_id'], row['name'], row['email'], row['password_hash'])
+        return Person(row['person_id'], row['name'], row['email'], row['password_hash'], row['is_admin'])
     return None
 
 
@@ -60,14 +61,14 @@ def get_person_by_email(email):
     Fetch a person record by email and return a Person object.
     """
     sql = """
-        SELECT person_id, name, email, password_hash
+        SELECT person_id, name, email, password_hash, is_admin
         FROM person
         WHERE email = %s
         LIMIT 1
     """
     row = db.execute(sql, [email], one=True)
     if row:
-        return Person(row['person_id'], row['name'], row['email'], row['password_hash'])
+        return Person(row['person_id'], row['name'], row['email'], row['password_hash'], row['is_admin'])
     return None
 
 

templates/settings.html

@@ -2,238 +2,307 @@
 
 {% block content %}
 
-<div class="mt-4 w-full grid grid-cols-1 md:grid-cols-2 xl:grid-cols-2 gap-4">
-    <div class="bg-white shadow rounded-lg p-4 sm:p-6 xl:p-8 mb-8">
-        <div class="mb-4 flex items-center justify-between">
-            <div>
-                <h3 class="text-xl font-bold text-gray-900 mb-2">Users</h3>
-            </div>
-        </div>
+<div class="mt-4 w-full h-full relative">
+    <!-- Hidden Radio Buttons for CSS Tabs -->
+    <input type="radio" name="settings_tabs" id="radio-users" class="peer/users hidden" checked>
+    <input type="radio" name="settings_tabs" id="radio-exercises" class="peer/exercises hidden">
+    <input type="radio" name="settings_tabs" id="radio-export" class="peer/export hidden">
 
-        <div class="flex flex-col">
-            <div class="overflow-x-hidden rounded-lg max-h-96">
-                <div class="align-middle inline-block min-w-full">
-                    <div class="shadow overflow-x-hidden sm:rounded-lg max-h-96 overflow-y-auto overflow-x-hidden">
-                        <table class="table-fixed min-w-full divide-y divide-gray-200">
-                            <thead class="bg-gray-50">
-                                <tr>
-                                    <th scope="col"
-                                        class="p-4 text-left text-xs font-medium text-gray-500 uppercase tracking-wider w-3/5">
-                                        Name
-                                    </th>
-                                    <th scope="col"
-                                        class="p-4 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">
-                                        <div class="relative">
-                                            <div
-                                                class="absolute inset-y-0 left-0 flex items-center pl-3 pointer-events-none">
-                                                <svg class="w-4 h-4 text-gray-500 dark:text-gray-400" aria-hidden="true"
-                                                    xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 20 20">
-                                                    <path stroke="currentColor" stroke-linecap="round"
-                                                        stroke-linejoin="round" stroke-width="2"
-                                                        d="m19 19-4-4m0-7A7 7 0 1 1 1 8a7 7 0 0 1 14 0Z"
-                                                        data-darkreader-inline-stroke=""
-                                                        style="--darkreader-inline-stroke: currentColor;"></path>
-                                                </svg>
-                                            </div>
-                                            <input type="search" id="people-search"
-                                                class="block w-full p-4 pl-10 text-sm text-gray-900 border border-gray-300 rounded-lg bg-gray-50 focus:ring-blue-500 focus:border-blue-500"
-                                                placeholder="Search users..." _="on input
-                                                show <tbody>tr/> in closest <table/>
-                                                  when its textContent.toLowerCase() contains my value.toLowerCase()
-                                               ">
-
-                                        </div>
-                                    </th>
-                                </tr>
-                            </thead>
-                            <tbody class="bg-white" id="new-person" hx-target="closest tr"
-                                hx-swap="outerHTML swap:0.5s">
-                                {% for p in people %}
-                                {{ render_partial('partials/person.html', person_id=p['PersonId'],
-                                name=p['Name'])}}
-                                {% endfor %}
-                            </tbody>
-                        </table>
-                    </div>
-                </div>
-            </div>
-        </div>
-
-        <form class="w-full mt-3" hx-post="{{ url_for('create_person') }}" hx-swap="beforeend" hx-target="#new-person"
-            _="on htmx:afterRequest
-            render #notification-template with (message: 'User added') then append it to #notifications-container
-            then call _hyperscript.processNode(#notifications-container)
-            then reset() me">
-            <div class="flex flex-wrap -mx-3 mb-2">
-                <div class="grow px-3">
-                    <label class="block uppercase tracking-wide text-gray-700 text-xs font-bold mb-2" for="grid-city">
-                        New user
-                    </label>
-                    <input
-                        class="appearance-none block w-full bg-gray-200 text-gray-700 border border-gray-200 rounded py-3 px-4 leading-tight focus:outline-none focus:bg-white focus:border-gray-500"
-                        type="text" name="name">
-                </div>
-
-                <div class="flex flex-row pt-6 px-3 w-36">
-                    <button
-                        class="w-full flex text-white bg-cyan-600 hover:bg-cyan-700 focus:ring-4 focus:ring-cyan-200 font-medium rounded-lg text-sm px-5 py-2.5 text-center items-center h-12"
-                        type="submit">
-                        <svg class="w-6 h-6 text-gray-500 group-hover:text-gray-900 transition duration-75"
-                            fill="currentColor" viewBox="0 0 20 20" xmlns="http://www.w3.org/2000/svg"
-                            data-darkreader-inline-fill="" style="--darkreader-inline-fill:currentColor;">
-                            <path fill-rule="evenodd"
-                                d="M10 5a1 1 0 011 1v3h3a1 1 0 110 2h-3v3a1 1 0 11-2 0v-3H6a1 1 0 110-2h3V6a1 1 0 011-1z"
-                                clip-rule="evenodd"></path>
-                        </svg>
-                        &nbsp; Add
-                    </button>
-                </div>
-            </div>
-        </form>
+    <!-- Tab Navigation -->
+    <div class="border-b border-gray-200 mb-6 bg-gray-50 z-10">
+        <ul class="flex flex-wrap -mb-px text-sm font-medium text-center text-gray-500">
+            <li class="mr-2">
+                <label for="radio-users"
+                    class="inline-flex items-center justify-center p-4 border-b-2 rounded-t-lg group cursor-pointer transition-colors
+                           peer-checked/users:border-cyan-600 peer-checked/users:text-cyan-600 border-transparent hover:text-gray-700 hover:border-gray-300">
+                    <svg class="w-5 h-5 mr-2" fill="currentColor" viewBox="0 0 20 20"
+                        xmlns="http://www.w3.org/2000/svg">
+                        <path fill-rule="evenodd" d="M10 9a3 3 0 100-6 3 3 0 000 6zm-7 9a7 7 0 1114 0H3z"
+                            clip-rule="evenodd"></path>
+                    </svg>
+                    Users
+                </label>
+            </li>
+            <li class="mr-2">
+                <label for="radio-exercises"
+                    class="inline-flex items-center justify-center p-4 border-b-2 rounded-t-lg group cursor-pointer transition-colors
+                           peer-checked/exercises:border-cyan-600 peer-checked/exercises:text-cyan-600 border-transparent hover:text-gray-700 hover:border-gray-300">
+                    <svg class="w-5 h-5 mr-2" fill="currentColor" viewBox="0 0 20 20"
+                        xmlns="http://www.w3.org/2000/svg">
+                        <path d="M9 2a1 1 0 000 2h2a1 1 0 100-2H9z"></path>
+                        <path fill-rule="evenodd"
+                            d="M4 5a2 2 0 012-2 3 3 0 003 3h2a3 3 0 003-3 2 2 0 012 2v11a2 2 0 01-2 2H6a2 2 0 01-2-2V5zm3 4a1 1 0 000 2h.01a1 1 0 100-2H7zm3 0a1 1 0 000 2h3a1 1 0 100-2h-3zm-3 4a1 1 0 100 2h.01a1 1 0 100-2H7zm3 0a1 1 0 100 2h3a1 1 0 100-2h-3z"
+                            clip-rule="evenodd"></path>
+                    </svg>
+                    Exercises
+                </label>
+            </li>
+            <li class="mr-2">
+                <label for="radio-export"
+                    class="inline-flex items-center justify-center p-4 border-b-2 rounded-t-lg group cursor-pointer transition-colors
+                           peer-checked/export:border-cyan-600 peer-checked/export:text-cyan-600 border-transparent hover:text-gray-700 hover:border-gray-300">
+                    <svg class="w-5 h-5 mr-2" fill="currentColor" viewBox="0 0 20 20"
+                        xmlns="http://www.w3.org/2000/svg">
+                        <path fill-rule="evenodd"
+                            d="M3 17a1 1 0 011-1h12a1 1 0 110 2H4a1 1 0 01-1-1zm3.293-7.707a1 1 0 011.414 0L9 10.586V3a1 1 0 112 0v7.586l1.293-1.293a1 1 0 111.414 1.414l-3 3a1 1 0 01-1.414 0l-3-3a1 1 0 010-1.414z"
+                            clip-rule="evenodd"></path>
+                    </svg>
+                    Data & Export
+                </label>
+            </li>
+        </ul>
     </div>
 
-    <div class="bg-white shadow rounded-lg p-4 sm:p-6 xl:p-8 mb-8">
-        <div class="mb-4 flex items-center justify-between">
-            <div>
-                <h3 class="text-xl font-bold text-gray-900 mb-2">Exercises</h3>
+    <!-- Users Tab Content -->
+    <div class="hidden peer-checked/users:block">
+        <div class="bg-white shadow rounded-lg p-4 sm:p-6 lg:p-8 mb-8">
+            <div class="mb-4 flex items-center justify-between">
+                <div>
+                    <h3 class="text-xl font-bold text-gray-900">User Management</h3>
+                    <p class="text-sm text-gray-500">Add, edit or remove people from the tracker.</p>
+                </div>
             </div>
-        </div>
 
-        <div class="flex flex-col">
-            <div class="rounded-lg">
-                <div class="align-middle inline-block min-w-full max-h-96 overflow-y-auto overflow-x-hidden">
-                    <div class="shadow overflow-hidden sm:rounded-lg ">
-                        <table class="table-fixed min-w-full divide-y divide-gray-200">
-                            <thead class="bg-gray-50">
-                                <tr>
-                                    <th scope="col"
-                                        class="p-4 text-left text-xs font-medium text-gray-500 uppercase tracking-wider w-1/5">
-                                        Name
-                                    </th>
-                                    <th scope="col"
-                                        class="p-4 text-left text-xs font-medium text-gray-500 uppercase tracking-wider w-3/5">
-                                        Attributes
-                                    </th>
-                                    <th scope="col"
-                                        class="p-4 text-left text-xs font-medium text-gray-500 uppercase tracking-wider w-1/5">
-                                        <div class="relative">
-                                            <div
-                                                class="absolute inset-y-0 left-0 flex items-center pl-3 pointer-events-none">
-                                                <svg class="w-4 h-4 text-gray-500 dark:text-gray-400" aria-hidden="true"
-                                                    xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 20 20">
-                                                    <path stroke="currentColor" stroke-linecap="round"
-                                                        stroke-linejoin="round" stroke-width="2"
-                                                        d="m19 19-4-4m0-7A7 7 0 1 1 1 8a7 7 0 0 1 14 0Z"
-                                                        data-darkreader-inline-stroke=""
-                                                        style="--darkreader-inline-stroke: currentColor;"></path>
-                                                </svg>
+            <div class="flex flex-col">
+                <div class="overflow-x-auto rounded-lg">
+                    <div class="align-middle inline-block min-w-full">
+                        <div class="shadow overflow-hidden border-b border-gray-200 sm:rounded-lg">
+                            <table class="min-w-full divide-y divide-gray-200">
+                                <thead class="bg-gray-50">
+                                    <tr>
+                                        <th scope="col"
+                                            class="p-4 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">
+                                            Name
+                                        </th>
+                                        <th scope="col"
+                                            class="p-4 text-right text-xs font-medium text-gray-500 uppercase tracking-wider">
+                                            <div class="relative max-w-xs ml-auto">
+                                                <div
+                                                    class="absolute inset-y-0 left-0 flex items-center pl-3 pointer-events-none">
+                                                    <svg class="w-4 h-4 text-gray-500" aria-hidden="true"
+                                                        xmlns="http://www.w3.org/2000/svg" fill="none"
+                                                        viewBox="0 0 20 20">
+                                                        <path stroke="currentColor" stroke-linecap="round"
+                                                            stroke-linejoin="round" stroke-width="2"
+                                                            d="m19 19-4-4m0-7A7 7 0 1 1 1 8a7 7 0 0 1 14 0Z"></path>
+                                                    </svg>
+                                                </div>
+                                                <input type="search" id="people-search"
+                                                    class="block w-full p-2 pl-10 text-sm text-gray-900 border border-gray-300 rounded-lg bg-gray-50 focus:ring-cyan-500 focus:border-cyan-500 shadow-sm"
+                                                    placeholder="Search users..."
+                                                    _="on input show <tbody>tr/> in closest <table/> when its textContent.toLowerCase() contains my value.toLowerCase()">
                                             </div>
-                                            <input type="search" id="exercise-search"
-                                                class="block w-full p-4 pl-10 text-sm text-gray-900 border border-gray-300 rounded-lg bg-gray-50 focus:ring-blue-500 focus:border-blue-500"
-                                                placeholder="Search exercises..." _="on input
-                                                show <tbody>tr/> in closest <table/>
-                                                  when its textContent.toLowerCase() contains my value.toLowerCase()
-                                               ">
-
-                                        </div>
-                                    </th>
-                                </tr>
-                            </thead>
-                            <tbody class="bg-white" id="new-exercise" hx-target="closest tr"
-                                hx-swap="outerHTML swap:0.5s">
-                                {% for exercise in exercises %}
-                                {{ render_partial('partials/exercise.html', exercise_id=exercise.exercise_id,
-                                name=exercise.name, attributes=exercise.attributes)}}
-                                {% endfor %}
-                            </tbody>
-                        </table>
+                                        </th>
+                                    </tr>
+                                </thead>
+                                <tbody class="bg-white divide-y divide-gray-200" id="new-person" hx-target="closest tr"
+                                    hx-swap="outerHTML swap:0.5s">
+                                    {% for p in people %}
+                                    {{ render_partial('partials/person.html', person_id=p['PersonId'], name=p['Name'])}}
+                                    {% endfor %}
+                                </tbody>
+                            </table>
+                        </div>
                     </div>
                 </div>
             </div>
-        </div>
 
-        <form class="w-full mt-8" hx-post="{{ url_for('create_exercise') }}" hx-swap="beforeend"
-            hx-target="#new-exercise" _="on htmx:afterRequest
-                render #notification-template with (message: 'Exercise added') then append it to #notifications-container
+            <form class="w-full mt-6 bg-gray-50 p-4 rounded-lg border border-gray-100"
+                hx-post="{{ url_for('create_person') }}" hx-swap="beforeend" hx-target="#new-person" _="on htmx:afterRequest
+                render #notification-template with (message: 'User added') then append it to #notifications-container
                 then call _hyperscript.processNode(#notifications-container)
                 then reset() me">
-            <div class="flex flex-wrap -mx-3 mb-2">
-                <div class="grow px-3">
-                    <label class="block uppercase tracking-wide text-gray-700 text-xs font-bold mb-2">
-                        New exercise
-                    </label>
-                    <input
-                        class="appearance-none block w-full bg-gray-200 text-gray-700 border border-gray-200 rounded py-3 px-4 leading-tight focus:outline-none focus:bg-white focus:border-gray-500 mb-4"
-                        type="text" name="name" placeholder="Exercise Name">
-
-                    <div class="grid grid-cols-1 sm:grid-cols-3 gap-4">
-                        {% for cat_name, options in all_attributes.items() %}
-                        <div>
-                            <label class="block text-xs font-bold text-gray-500 uppercase mb-1">{{ cat_name }}</label>
-                            {{ render_partial('partials/custom_select.html',
-                            name='attribute_ids',
-                            options=options,
-                            multiple=true,
-                            search=true,
-                            placeholder='Select ' ~ cat_name
-                            )}}
-                        </div>
-                        {% endfor %}
+                <div class="flex flex-col sm:flex-row gap-4 items-end">
+                    <div class="grow w-full sm:w-auto">
+                        <label class="block uppercase tracking-wide text-gray-700 text-xs font-bold mb-2"
+                            for="person-name">
+                            New user
+                        </label>
+                        <input id="person-name"
+                            class="appearance-none block w-full bg-white text-gray-700 border border-gray-300 rounded-lg py-3 px-4 leading-tight focus:outline-none focus:ring-2 focus:ring-cyan-500 focus:border-transparent"
+                            type="text" name="name" placeholder="Full Name">
                     </div>
-                </div>
-
-                <div class="flex flex-row pt-6 px-3 w-36">
                     <button
-                        class="w-full flex text-white bg-cyan-600 hover:bg-cyan-700 focus:ring-4 focus:ring-cyan-200 font-medium rounded-lg text-sm px-5 py-2.5 text-center items-center h-12 cursor-pointer"
+                        class="w-full sm:w-auto flex items-center justify-center text-white bg-cyan-600 hover:bg-cyan-700 focus:ring-4 focus:ring-cyan-200 font-medium rounded-lg text-sm px-5 py-3 transition-colors shadow-sm"
                         type="submit">
-                        <svg class="w-6 h-6 text-gray-500 group-hover:text-gray-900 transition duration-75"
-                            fill="currentColor" viewBox="0 0 20 20" xmlns="http://www.w3.org/2000/svg"
-                            data-darkreader-inline-fill="" style="--darkreader-inline-fill:currentColor;">
+                        <svg class="w-5 h-5 mr-2" fill="currentColor" viewBox="0 0 20 20"
+                            xmlns="http://www.w3.org/2000/svg">
                             <path fill-rule="evenodd"
                                 d="M10 5a1 1 0 011 1v3h3a1 1 0 110 2h-3v3a1 1 0 11-2 0v-3H6a1 1 0 110-2h3V6a1 1 0 011-1z"
                                 clip-rule="evenodd"></path>
                         </svg>
-                        &nbsp; Add
+                        Add User
                     </button>
                 </div>
-            </div>
-        </form>
-
-    </div>
-
-    <!-- Data Export Section -->
-    <div class="bg-white shadow rounded-lg p-4 sm:p-6 xl:p-8 mb-8">
-        <div class="mb-4 flex items-center justify-between">
-            <div>
-                <h3 class="text-xl font-bold text-gray-900 mb-2">Data Export</h3>
-            </div>
-        </div>
-        <div class="flex flex-col space-y-4"> <!-- Added space-y-4 for spacing between buttons -->
-            <p class="text-sm text-gray-600">Download all workout set data as a CSV file, or the entire database
-                structure and data as an SQL script.</p>
-            <a href="{{ url_for('export.export_workouts_csv') }}" class="text-white bg-green-600 hover:bg-green-700 focus:ring-4 focus:ring-green-300 font-medium
-                rounded-lg text-sm px-5 py-2.5 text-center inline-flex items-center justify-center w-full sm:w-auto">
-                <svg class="w-5 h-5 mr-2 -ml-1" fill="currentColor" viewBox="0 0 20 20"
-                    xmlns="http://www.w3.org/2000/svg">
-                    <path fill-rule="evenodd"
-                        d="M6 2a2 2 0 00-2 2v12a2 2 0 002 2h8a2 2 0 002-2V7.414A2 2 0 0015.414 6L12 2.586A2 2 0 0010.586 2H6zm5 6a1 1 0 10-2 0v3.586l-1.293-1.293a1 1 0 10-1.414 1.414l3 3a1 1 0 001.414 0l3-3a1 1 0 00-1.414-1.414L11 11.586V8z"
-                        clip-rule="evenodd"></path>
-                </svg>
-                Export All Workouts (CSV)
-            </a>
-            <a href="{{ url_for('export.export_database_sql') }}"
-                class="text-white bg-blue-600 hover:bg-blue-700 focus:ring-4 focus:ring-blue-300 font-medium rounded-lg text-sm px-5 py-2.5 text-center inline-flex items-center justify-center w-full sm:w-auto">
-                <svg class="w-5 h-5 mr-2 -ml-1" fill="currentColor" viewBox="0 0 20 20"
-                    xmlns="http://www.w3.org/2000/svg">
-                    <path
-                        d="M2 5a2 2 0 012-2h12a2 2 0 012 2v10a2 2 0 01-2 2H4a2 2 0 01-2-2V5zm3.293 1.293a1 1 0 011.414 0L10 10.586l3.293-3.293a1 1 0 111.414 1.414l-4 4a1 1 0 01-1.414 0l-4-4a1 1 0 010-1.414z"
-                        clip-rule="evenodd"></path>
-                </svg> <!-- Using a generic download/database icon -->
-                Export Database (SQL Script)
-            </a>
+            </form>
         </div>
     </div>
 
+    <!-- Exercises Tab Content -->
+    <div class="hidden peer-checked/exercises:block">
+        <div class="bg-white shadow rounded-lg p-4 sm:p-6 lg:p-8 mb-8">
+            <div class="mb-6">
+                <h3 class="text-xl font-bold text-gray-900">Exercise Configuration</h3>
+                <p class="text-sm text-gray-500">Manage available exercises and their categories.</p>
+            </div>
+
+            <div class="flex flex-col">
+                <div class="overflow-x-auto rounded-lg">
+                    <div class="align-middle inline-block min-w-full">
+                        <div class="shadow overflow-hidden border-b border-gray-200 sm:rounded-lg">
+                            <table class="min-w-full divide-y divide-gray-200">
+                                <thead class="bg-gray-50">
+                                    <tr>
+                                        <th scope="col"
+                                            class="p-4 text-left text-xs font-medium text-gray-500 uppercase tracking-wider w-1/4">
+                                            Name
+                                        </th>
+                                        <th scope="col"
+                                            class="p-4 text-left text-xs font-medium text-gray-500 uppercase tracking-wider w-1/2">
+                                            Attributes
+                                        </th>
+                                        <th scope="col"
+                                            class="p-4 text-right text-xs font-medium text-gray-500 uppercase tracking-wider w-1/4">
+                                            <div class="relative max-w-xs ml-auto">
+                                                <div
+                                                    class="absolute inset-y-0 left-0 flex items-center pl-3 pointer-events-none">
+                                                    <svg class="w-4 h-4 text-gray-500" aria-hidden="true"
+                                                        xmlns="http://www.w3.org/2000/svg" fill="none"
+                                                        viewBox="0 0 20 20">
+                                                        <path stroke="currentColor" stroke-linecap="round"
+                                                            stroke-linejoin="round" stroke-width="2"
+                                                            d="m19 19-4-4m0-7A7 7 0 1 1 1 8a7 7 0 0 1 14 0Z"></path>
+                                                    </svg>
+                                                </div>
+                                                <input type="search" id="exercise-search"
+                                                    class="block w-full p-2 pl-10 text-sm text-gray-900 border border-gray-300 rounded-lg bg-gray-50 focus:ring-cyan-500 focus:border-cyan-500 shadow-sm"
+                                                    placeholder="Search exercises..."
+                                                    _="on input show <tbody>tr/> in closest <table/> when its textContent.toLowerCase() contains my value.toLowerCase()">
+                                            </div>
+                                        </th>
+                                    </tr>
+                                </thead>
+                                <tbody class="bg-white divide-y divide-gray-200" id="new-exercise"
+                                    hx-target="closest tr" hx-swap="outerHTML swap:0.5s">
+                                    {% for exercise in exercises %}
+                                    {{ render_partial('partials/exercise.html', exercise_id=exercise.exercise_id,
+                                    name=exercise.name, attributes=exercise.attributes)}}
+                                    {% endfor %}
+                                </tbody>
+                            </table>
+                        </div>
+                    </div>
+                </div>
+            </div>
+
+            <div class="mt-10">
+                <h4 class="text-lg font-semibold text-gray-900 mb-4">Add New Exercise</h4>
+                <form class="bg-gray-50 p-6 rounded-lg border border-gray-100"
+                    hx-post="{{ url_for('create_exercise') }}" hx-swap="beforeend" hx-target="#new-exercise" _="on htmx:afterRequest
+                        render #notification-template with (message: 'Exercise added') then append it to #notifications-container
+                        then call _hyperscript.processNode(#notifications-container)
+                        then reset() me">
+
+                    <div class="grid grid-cols-1 lg:grid-cols-4 gap-6 items-start">
+                        <div class="lg:col-span-1">
+                            <label class="block uppercase tracking-wide text-gray-700 text-xs font-bold mb-2">
+                                Exercise Name
+                            </label>
+                            <input
+                                class="appearance-none block w-full bg-white text-gray-700 border border-gray-300 rounded-lg py-3 px-4 leading-tight focus:outline-none focus:ring-2 focus:ring-cyan-500 focus:border-transparent"
+                                type="text" name="name" placeholder="e.g. Bench Press">
+                        </div>
+
+                        <div class="lg:col-span-2 grid grid-cols-1 sm:grid-cols-3 gap-4">
+                            {% for cat_name, options in all_attributes.items() %}
+                            <div>
+                                <label class="block text-xs font-bold text-gray-500 uppercase mb-1">{{ cat_name
+                                    }}</label>
+                                {{ render_partial('partials/custom_select.html',
+                                name='attribute_ids',
+                                options=options,
+                                multiple=true,
+                                search=true,
+                                placeholder='Select ' ~ cat_name
+                                )}}
+                            </div>
+                            {% endfor %}
+                        </div>
+
+                        <div class="lg:col-span-1 pt-6">
+                            <button
+                                class="w-full flex items-center justify-center text-white bg-cyan-600 hover:bg-cyan-700 focus:ring-4 focus:ring-cyan-200 font-medium rounded-lg text-sm px-5 py-3 transition-colors h-12 cursor-pointer shadow-sm"
+                                type="submit">
+                                <svg class="w-5 h-5 mr-2" fill="currentColor" viewBox="0 0 20 20"
+                                    xmlns="http://www.w3.org/2000/svg">
+                                    <path fill-rule="evenodd"
+                                        d="M10 5a1 1 0 011 1v3h3a1 1 0 110 2h-3v3a1 1 0 11-2 0v-3H6a1 1 0 110-2h3V6a1 1 0 011-1z"
+                                        clip-rule="evenodd"></path>
+                                </svg>
+                                Add Exercise
+                            </button>
+                        </div>
+                    </div>
+                </form>
+            </div>
+        </div>
+    </div>
+
+    <!-- Export Tab Content -->
+    <div class="hidden peer-checked/export:block">
+        <div class="bg-white shadow rounded-lg p-4 sm:p-6 lg:p-8 mb-8">
+            <div class="mb-6">
+                <h3 class="text-xl font-bold text-gray-900">Data & Portability</h3>
+                <p class="text-sm text-gray-500">Export your data for backup or external analysis.</p>
+            </div>
+
+            <div class="grid grid-cols-1 md:grid-cols-2 gap-8">
+                <!-- CSV Export -->
+                <div
+                    class="border border-gray-200 rounded-xl p-6 hover:border-cyan-200 transition-colors bg-gray-50/50">
+                    <div class="flex items-center mb-4">
+                        <div class="p-3 bg-green-100 rounded-lg text-green-600 mr-4 shadow-sm">
+                            <svg class="w-6 h-6" fill="currentColor" viewBox="0 0 20 20"
+                                xmlns="http://www.w3.org/2000/svg">
+                                <path fill-rule="evenodd"
+                                    d="M6 2a2 2 0 00-2 2v12a2 2 0 002 2h8a2 2 0 002-2V7.414A2 2 0 0015.414 6L12 2.586A2 2 0 0010.586 2H6zm5 6a1 1 0 10-2 0v3.586l-1.293-1.293a1 1 0 10-1.414 1.414l3 3a1 1 0 001.414 0l3-3a1 1 0 00-1.414-1.414L11 11.586V8z"
+                                    clip-rule="evenodd"></path>
+                            </svg>
+                        </div>
+                        <h4 class="text-lg font-bold text-gray-900">Workout History</h4>
+                    </div>
+                    <p class="text-sm text-gray-600 mb-6 font-medium">Download all workout records, sets, and
+                        performance data in CSV format.</p>
+                    <a href="{{ url_for('export.export_workouts_csv') }}"
+                        class="text-white bg-green-600 hover:bg-green-700 focus:ring-4 focus:ring-green-300 font-medium rounded-lg text-sm px-5 py-2.5 text-center inline-flex items-center justify-center w-full shadow-sm">
+                        Download CSV
+                    </a>
+                </div>
+
+                <!-- SQL Export -->
+                <div
+                    class="border border-gray-200 rounded-xl p-6 hover:border-cyan-200 transition-colors bg-gray-50/50">
+                    <div class="flex items-center mb-4">
+                        <div class="p-3 bg-blue-100 rounded-lg text-blue-600 mr-4 shadow-sm">
+                            <svg class="w-6 h-6" fill="currentColor" viewBox="0 0 20 20"
+                                xmlns="http://www.w3.org/2000/svg">
+                                <path
+                                    d="M2 5a2 2 0 012-2h12a2 2 0 012 2v10a2 2 0 01-2 2H4a2 2 0 01-2-2V5zm3.293 1.293a1 1 0 011.414 0L10 10.586l3.293-3.293a1 1 0 111.414 1.414l-4 4a1 1 0 01-1.414 0l-4-4a1 1 0 010-1.414z"
+                                    clip-rule="evenodd"></path>
+                            </svg>
+                        </div>
+                        <h4 class="text-lg font-bold text-gray-900">Database Snapshot</h4>
+                    </div>
+                    <p class="text-sm text-gray-600 mb-6 font-medium">Create a full SQL dump of your database including
+                        schema and all records.</p>
+                    <a href="{{ url_for('export.export_database_sql') }}"
+                        class="text-white bg-blue-600 hover:bg-blue-700 focus:ring-4 focus:ring-blue-300 font-medium rounded-lg text-sm px-5 py-2.5 text-center inline-flex items-center justify-center w-full shadow-sm">
+                        Download SQL Script
+                    </a>
+                </div>
+            </div>
+        </div>
+    </div>
 </div>
 
 {% endblock %}