From bc42adcad94994422949068a2934db0285b0505b Mon Sep 17 00:00:00 2001
From: Frank <frank.van.den.berg@eleaf.com>
Date: Sun, 6 Sep 2026 21:39:12 +0200
Subject: [PATCH] Add delete button on the enemy detail page

CSRF-protected POST to /enemies/{id}/delete with a confirm. Any
combatants referencing the enemy keep their snapshotted stats (the FK
sets enemy_id null), so deleting a monster type won't disturb a fight.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 src/Controller/EnemyController.php | 14 ++++++++++++++
 templates/enemy/show.html.twig     |  9 ++++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/src/Controller/EnemyController.php b/src/Controller/EnemyController.php
index 435f840..c63b0ba 100644
--- a/src/Controller/EnemyController.php
+++ b/src/Controller/EnemyController.php
@@ -100,6 +100,20 @@ class EnemyController extends AbstractController
         return $this->handleForm($request, $em, $enemy);
     }
 
+    #[Route('/enemies/{id}/delete', name: 'app_enemies_delete', requirements: ['id' => '\d+'], methods: ['POST'])]
+    public function delete(Request $request, Enemy $enemy, EntityManagerInterface $em): Response
+    {
+        if ($this->isCsrfTokenValid('delete-enemy-'.$enemy->getId(), (string) $request->request->get('_token'))) {
+            $name = $enemy->getName();
+            // Combatants keep their snapshotted stats; enemy_id is set null by the FK.
+            $em->remove($enemy);
+            $em->flush();
+            $this->addFlash('success', sprintf('Deleted "%s".', $name));
+        }
+
+        return $this->redirectToRoute('app_enemies');
+    }
+
     private function handleForm(Request $request, EntityManagerInterface $em, Enemy $enemy): Response
     {
         $isNew = null === $enemy->getId();
diff --git a/templates/enemy/show.html.twig b/templates/enemy/show.html.twig
index b294cf7..92b69e6 100644
--- a/templates/enemy/show.html.twig
+++ b/templates/enemy/show.html.twig
@@ -11,7 +11,14 @@
             <h1 class="h3 mb-0">{{ enemy.name }}</h1>
             <span class="text-body-secondary fst-italic">{{ enemy.metaLine }}</span>
         </div>
-        <a href="{{ path('app_enemies_edit', {id: enemy.id}) }}" class="btn btn-outline-secondary btn-sm">Edit stats</a>
+        <div class="d-flex gap-2">
+            <a href="{{ path('app_enemies_edit', {id: enemy.id}) }}" class="btn btn-outline-secondary btn-sm">Edit stats</a>
+            <form method="post" action="{{ path('app_enemies_delete', {id: enemy.id}) }}"
+                  onsubmit="return confirm('Delete “{{ enemy.name|e('js') }}” from the enemy list?')">
+                <input type="hidden" name="_token" value="{{ csrf_token('delete-enemy-' ~ enemy.id) }}">
+                <button class="btn btn-outline-danger btn-sm">Delete</button>
+            </form>
+        </div>
     </div>
 
     <div class="row g-4">