From e939dd3a53296bc7fbe1f145e2ad32a1f6e5604d Mon Sep 17 00:00:00 2001
From: ghassan <ghassan@innovator.bh>
Date: Wed, 21 Oct 2026 10:37:59 +0300
Subject: [PATCH] feat(channel): /@handle route + hide composer in preview mode

- New /@handle route (channel.handle name) that maps to UserController@channel,
  so YouTube-style profile URLs work. Handle is the existing username
  slug for now; a dedicated `handle` column can land later if we want
  the two to diverge. {handle} is constrained to [A-Za-z0-9][A-Za-z0-9._-]*
  so arbitrary paths don't match this route.
- Composer on the Wall tab used Auth::id() === $user->id directly,
  which bypassed the $isOwner flip-to-false that preview-as-visitor
  does. The composer now also checks !$preview so previewing an
  owner's channel hides the post box as a visitor would see it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 resources/views/user/channel.blade.php | 4 ++--
 routes/web.php                         | 8 ++++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/resources/views/user/channel.blade.php b/resources/views/user/channel.blade.php
index 67707b2..9b3e5f1 100644
--- a/resources/views/user/channel.blade.php
+++ b/resources/views/user/channel.blade.php
@@ -414,9 +414,9 @@ $headerSocialMap = [
         {{-- ── LEFT: composer + feed ── --}}
         <div>
 
-            {{-- Composer (owner only) --}}
+            {{-- Composer (owner only, hidden when previewing as a visitor) --}}
             @auth
-            @if(Auth::id() === $user->id)
+            @if(Auth::id() === $user->id && !$preview)
             <div class="ch-composer">
                 <form action="{{ route('posts.store', $user->id) }}" method="POST" enctype="multipart/form-data" id="postForm">
                     @csrf
diff --git a/routes/web.php b/routes/web.php
index c786a8f..6a490e0 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -185,6 +185,14 @@ Route::middleware(['auth', 'verified'])->group(function () {
 
 // Channel - public for viewing. {username} is the user's slug (non-sequential, safe to share).
 Route::get('/channel/{username?}', [UserController::class, 'channel'])->name('channel');
+// YouTube-style @handle alias. For now `handle` is just the existing
+// `username` slug — if the two ever diverge, flip the controller lookup
+// in UserController::channel() to prefer a dedicated `handle` column.
+// The {handle} segment must be url-encoded (e.g. /%40alice) OR plain `@alice`
+// — Laravel's router accepts both because `@` is allowed in URI path segments.
+Route::get('/@{handle}', [UserController::class, 'channel'])
+    ->where('handle', '[A-Za-z0-9][A-Za-z0-9._-]*')
+    ->name('channel.handle');
 
 // Post routes - auth required
 Route::middleware(['auth'])->group(function () {