geofence refinement

and manual failsafe

apps/admin/src/app/api/attendance/__tests__/attendance.test.ts

@@ -1,137 +1,180 @@
 /**
  * @jest-environment node
  */
-import { POST as checkIn } from '../check-in/route'
-import { POST as checkOut } from '../check-out/route'
-import { GET as history } from '../history/route'
-import { NextRequest } from 'next/server'
+import { POST as checkIn } from "../check-in/route";
+import { POST as checkOut } from "../check-out/route";
+import { GET as history } from "../history/route";
+import { NextRequest } from "next/server";
 
 // Mock dependencies
-jest.mock('@clerk/nextjs/server', () => ({
-    auth: jest.fn(() => Promise.resolve({ userId: 'test_user_id' })),
-    currentUser: jest.fn(() => Promise.resolve({ id: 'test_user_id', emailAddresses: [{ emailAddress: 'test@example.com' }] }))
-}))
+jest.mock("@clerk/nextjs/server", () => ({
+  auth: jest.fn(() => Promise.resolve({ userId: "test_user_id" })),
+  currentUser: jest.fn(() =>
+    Promise.resolve({
+      id: "test_user_id",
+      emailAddresses: [{ emailAddress: "test@example.com" }],
+    }),
+  ),
+}));
 
-jest.mock('@/lib/sync-user', () => ({
-    ensureUserSynced: jest.fn()
-}))
+jest.mock("@/lib/sync-user", () => ({
+  ensureUserSynced: jest.fn(),
+}));
+
+jest.mock("@/lib/geofence", () => ({
+  getUserGymGeofence: jest.fn(() =>
+    Promise.resolve({
+      id: "gym_1",
+      name: "Test Gym",
+      latitude: 1,
+      longitude: 1,
+      geofenceRadiusMeters: 30,
+      geofenceEnabled: true,
+    }),
+  ),
+  parseUserLocation: jest.fn(() => ({
+    latitude: 1,
+    longitude: 1,
+    accuracy: 10,
+  })),
+  validateGeofence: jest.fn(() => ({ ok: true })),
+  validateGeofenceWithFallback: jest.fn(() => ({ ok: true })),
+  validateCheckInGeofence: jest.fn(() => ({ ok: true })),
+}));
 
 const mockDb = {
-    checkIn: jest.fn(),
-    checkOut: jest.fn(),
-    getAttendanceHistory: jest.fn(),
-    getActiveCheckIn: jest.fn(),
-    getUserById: jest.fn(),
-    createUser: jest.fn(),
-    getClientByUserId: jest.fn(),
-    createClient: jest.fn(),
-    getFitnessProfileByUserId: jest.fn(),
-    createFitnessProfile: jest.fn(),
-}
+  checkIn: jest.fn(),
+  checkOut: jest.fn(),
+  getAttendanceHistory: jest.fn(),
+  getActiveCheckIn: jest.fn(),
+  getUserById: jest.fn(),
+  createUser: jest.fn(),
+  getClientByUserId: jest.fn(),
+  createClient: jest.fn(),
+  getFitnessProfileByUserId: jest.fn(),
+  createFitnessProfile: jest.fn(),
+};
 
-jest.mock('@/lib/database', () => ({
-    getDatabase: jest.fn(() => Promise.resolve(mockDb))
-}))
+jest.mock("@/lib/database", () => ({
+  getDatabase: jest.fn(() => Promise.resolve(mockDb)),
+}));
 
-describe('Attendance API', () => {
-    beforeEach(() => {
-        jest.clearAllMocks()
-    })
+describe("Attendance API", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
 
-    describe('POST /api/attendance/check-in', () => {
-        it('should successfully check in', async () => {
-            mockDb.getUserById.mockResolvedValue({ id: 'test_user_id' })
-            mockDb.getActiveCheckIn.mockResolvedValue(null)
-            mockDb.checkIn.mockResolvedValue({
-                id: 'attendance_id',
-                userId: 'test_user_id',
-                checkInTime: new Date(),
-                type: 'gym'
-            })
+  describe("POST /api/attendance/check-in", () => {
+    it("should successfully check in", async () => {
+      mockDb.getUserById.mockResolvedValue({ id: "test_user_id" });
+      mockDb.getActiveCheckIn.mockResolvedValue(null);
+      mockDb.checkIn.mockResolvedValue({
+        id: "attendance_id",
+        userId: "test_user_id",
+        checkInTime: new Date(),
+        type: "gym",
+      });
 
-            const req = new NextRequest('http://localhost/api/attendance/check-in', {
-                method: 'POST',
-                body: JSON.stringify({ type: 'gym', notes: 'Test check-in' })
-            })
+      const req = new NextRequest("http://localhost/api/attendance/check-in", {
+        method: "POST",
+        body: JSON.stringify({
+          type: "gym",
+          notes: "Test check-in",
+          location: { latitude: 1, longitude: 1, accuracy: 10 },
+        }),
+      });
 
-            const res = await checkIn(req)
-            const data = await res.json()
+      const res = await checkIn(req);
+      const data = await res.json();
 
-            expect(res.status).toBe(200)
-            expect(data.id).toBe('attendance_id')
-            expect(data.userId).toBe('test_user_id')
-            expect(mockDb.checkIn).toHaveBeenCalledWith('test_user_id', 'gym', 'Test check-in')
-        })
+      expect(res.status).toBe(200);
+      expect(data.id).toBe("attendance_id");
+      expect(data.userId).toBe("test_user_id");
+      expect(mockDb.checkIn).toHaveBeenCalledWith(
+        "test_user_id",
+        "gym",
+        "Test check-in",
+      );
+    });
 
-        it('should fail if already checked in', async () => {
-            mockDb.getUserById.mockResolvedValue({ id: 'test_user_id' })
-            mockDb.getActiveCheckIn.mockResolvedValue({ id: 'existing_id' })
+    it("should fail if already checked in", async () => {
+      mockDb.getUserById.mockResolvedValue({ id: "test_user_id" });
+      mockDb.getActiveCheckIn.mockResolvedValue({ id: "existing_id" });
 
-            const req = new NextRequest('http://localhost/api/attendance/check-in', {
-                method: 'POST',
-                body: JSON.stringify({ type: 'gym' })
-            })
+      const req = new NextRequest("http://localhost/api/attendance/check-in", {
+        method: "POST",
+        body: JSON.stringify({
+          type: "gym",
+          location: { latitude: 1, longitude: 1, accuracy: 10 },
+        }),
+      });
 
-            const res = await checkIn(req)
-            const text = await res.text()
+      const res = await checkIn(req);
+      const text = await res.text();
 
-            expect(res.status).toBe(400)
-            expect(text).toBe('Already checked in')
-        })
-    })
+      expect(res.status).toBe(400);
+      expect(text).toBe("Already checked in");
+    });
+  });
 
-    describe('POST /api/attendance/check-out', () => {
-        it('should successfully check out', async () => {
-            mockDb.getActiveCheckIn.mockResolvedValue({ id: 'attendance_id' })
-            mockDb.checkOut.mockResolvedValue({
-                id: 'attendance_id',
-                checkOutTime: new Date()
-            })
+  describe("POST /api/attendance/check-out", () => {
+    it("should successfully check out", async () => {
+      mockDb.getActiveCheckIn.mockResolvedValue({ id: "attendance_id" });
+      mockDb.checkOut.mockResolvedValue({
+        id: "attendance_id",
+        checkOutTime: new Date(),
+      });
 
-            const req = new NextRequest('http://localhost/api/attendance/check-out', {
-                method: 'POST'
-            })
+      const req = new NextRequest("http://localhost/api/attendance/check-out", {
+        method: "POST",
+        body: JSON.stringify({
+          location: { latitude: 1, longitude: 1, accuracy: 10 },
+        }),
+      });
 
-            const res = await checkOut(req)
-            const data = await res.json()
+      const res = await checkOut(req);
+      const data = await res.json();
 
-            expect(res.status).toBe(200)
-            expect(data.id).toBe('attendance_id')
-            expect(data.checkOutTime).toBeDefined()
-            expect(mockDb.checkOut).toHaveBeenCalledWith('attendance_id')
-        })
+      expect(res.status).toBe(200);
+      expect(data.id).toBe("attendance_id");
+      expect(data.checkOutTime).toBeDefined();
+      expect(mockDb.checkOut).toHaveBeenCalledWith("attendance_id");
+    });
 
-        it('should fail if not checked in', async () => {
-            mockDb.getActiveCheckIn.mockResolvedValue(null)
+    it("should fail if not checked in", async () => {
+      mockDb.getActiveCheckIn.mockResolvedValue(null);
 
-            const req = new NextRequest('http://localhost/api/attendance/check-out', {
-                method: 'POST'
-            })
+      const req = new NextRequest("http://localhost/api/attendance/check-out", {
+        method: "POST",
+        body: JSON.stringify({
+          location: { latitude: 1, longitude: 1, accuracy: 10 },
+        }),
+      });
 
-            const res = await checkOut(req)
-            const text = await res.text()
+      const res = await checkOut(req);
+      const text = await res.text();
 
-            expect(res.status).toBe(404)
-            expect(text).toBe('No active check-in found')
-        })
-    })
+      expect(res.status).toBe(404);
+      expect(text).toBe("No active check-in found");
+    });
+  });
 
-    describe('GET /api/attendance/history', () => {
-        it('should return attendance history', async () => {
-            const historyData = [
-                { id: '1', checkInTime: new Date() },
-                { id: '2', checkInTime: new Date() }
-            ]
-            mockDb.getUserById.mockResolvedValue({ id: 'test_user_id' })
-            mockDb.getAttendanceHistory.mockResolvedValue(historyData)
+  describe("GET /api/attendance/history", () => {
+    it("should return attendance history", async () => {
+      const historyData = [
+        { id: "1", checkInTime: new Date() },
+        { id: "2", checkInTime: new Date() },
+      ];
+      mockDb.getUserById.mockResolvedValue({ id: "test_user_id" });
+      mockDb.getAttendanceHistory.mockResolvedValue(historyData);
 
-            const req = new NextRequest('http://localhost/api/attendance/history')
-            const res = await history(req)
-            const data = await res.json()
+      const req = new NextRequest("http://localhost/api/attendance/history");
+      const res = await history(req);
+      const data = await res.json();
 
-            expect(res.status).toBe(200)
-            expect(data).toEqual(JSON.parse(JSON.stringify(historyData))) // Handle date serialization
-            expect(mockDb.getAttendanceHistory).toHaveBeenCalledWith('test_user_id')
-        })
-    })
-})
+      expect(res.status).toBe(200);
+      expect(data).toEqual(JSON.parse(JSON.stringify(historyData))); // Handle date serialization
+      expect(mockDb.getAttendanceHistory).toHaveBeenCalledWith("test_user_id");
+    });
+  });
+});

apps/admin/src/app/api/attendance/check-in/route.ts

@@ -2,12 +2,12 @@ import { auth } from "@clerk/nextjs/server";
 import { NextRequest, NextResponse } from "next/server";
 import { getDatabase } from "@/lib/database";
 import { ensureUserSynced } from "@/lib/sync-user";
-import log from "@/lib/logger";
-import { checkInSchema } from "@/lib/validation/schemas";
 import {
-  validateRequestBody,
-  validationErrorResponse,
-} from "@/lib/validation/helpers";
+  getUserGymGeofence,
+  parseUserLocation,
+  validateCheckInGeofence,
+} from "@/lib/geofence";
+import log from "@/lib/logger";
 
 export async function POST(req: NextRequest) {
   try {
@@ -25,8 +25,26 @@ export async function POST(req: NextRequest) {
       return new NextResponse("Already checked in", { status: 400 });
     }
 
-    const body = await req.json();
+    const body = await req.json().catch(() => ({}));
     const { type = "gym", notes } = body;
+    const fallbackRequested = Boolean(body.fallbackRequested);
+
+    const gym = await getUserGymGeofence(userId);
+    if (!gym) {
+      return NextResponse.json(
+        { error: "No gym assigned for this user" },
+        { status: 400 },
+      );
+    }
+
+    const location = parseUserLocation(body.location);
+    const geofence = validateCheckInGeofence(gym, location, fallbackRequested);
+    if (!geofence.ok) {
+      return NextResponse.json(
+        { error: geofence.error },
+        { status: geofence.status },
+      );
+    }
 
     const attendance = await db.checkIn(userId, type, notes);
     return NextResponse.json(attendance);

apps/admin/src/app/api/attendance/check-out/route.ts

@@ -1,6 +1,11 @@
 import { auth } from "@clerk/nextjs/server";
 import { NextResponse } from "next/server";
 import { getDatabase } from "@/lib/database";
+import {
+  getUserGymGeofence,
+  parseUserLocation,
+  validateGeofenceWithFallback,
+} from "@/lib/geofence";
 import log from "@/lib/logger";
 
 export async function POST(req: Request) {
@@ -15,6 +20,30 @@ export async function POST(req: Request) {
       return new NextResponse("No active check-in found", { status: 404 });
     }
 
+    const body = await req.json().catch(() => ({}));
+    const fallbackRequested = Boolean(body.fallbackRequested);
+
+    const gym = await getUserGymGeofence(userId);
+    if (!gym) {
+      return NextResponse.json(
+        { error: "No gym assigned for this user" },
+        { status: 400 },
+      );
+    }
+
+    const location = parseUserLocation(body.location);
+    const geofence = validateGeofenceWithFallback(
+      gym,
+      location,
+      fallbackRequested,
+    );
+    if (!geofence.ok) {
+      return NextResponse.json(
+        { error: geofence.error },
+        { status: geofence.status },
+      );
+    }
+
     const attendance = await db.checkOut(activeCheckIn.id);
     return NextResponse.json(attendance);
   } catch (error) {

apps/admin/src/app/api/gyms/[id]/route.ts

@@ -18,6 +18,178 @@ async function ensureGymsTable() {
       updated_at INTEGER NOT NULL
     )
   `);
+
+  const columns = await db.all(sql`PRAGMA table_info('gyms')`);
+  const columnNames = new Set(
+    (columns as Array<{ name?: string }>)
+      .map((col) => col.name)
+      .filter(Boolean),
+  );
+
+  if (!columnNames.has("latitude")) {
+    await db.run(sql`ALTER TABLE gyms ADD COLUMN latitude REAL`);
+  }
+
+  if (!columnNames.has("longitude")) {
+    await db.run(sql`ALTER TABLE gyms ADD COLUMN longitude REAL`);
+  }
+
+  if (!columnNames.has("geofence_radius_meters")) {
+    await db.run(
+      sql`ALTER TABLE gyms ADD COLUMN geofence_radius_meters REAL NOT NULL DEFAULT 30`,
+    );
+  }
+
+  if (!columnNames.has("geofence_enabled")) {
+    await db.run(
+      sql`ALTER TABLE gyms ADD COLUMN geofence_enabled INTEGER NOT NULL DEFAULT 1`,
+    );
+  }
+}
+
+// PATCH /api/gyms/[id]
+// Update gym details and geofence configuration
+export async function PATCH(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  try {
+    const { id: gymId } = await params;
+    const { userId } = await auth();
+
+    if (!userId) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const appDb = await getDatabase();
+    const currentUser = await ensureUserSynced(userId, appDb);
+
+    if (
+      !currentUser ||
+      (currentUser.role !== "superAdmin" && currentUser.role !== "admin")
+    ) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    await ensureGymsTable();
+
+    const existingGym = await db
+      .select()
+      .from(gymsTable)
+      .where(eq(gymsTable.id, gymId))
+      .get();
+
+    if (!existingGym) {
+      return NextResponse.json({ error: "Gym not found" }, { status: 404 });
+    }
+
+    if (
+      currentUser.role === "admin" &&
+      currentUser.gymId &&
+      currentUser.gymId !== gymId
+    ) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+
+    const body = await request.json().catch(() => null);
+    if (!body || typeof body !== "object") {
+      return NextResponse.json({ error: "Invalid body" }, { status: 400 });
+    }
+
+    const latitude =
+      body.latitude === undefined || body.latitude === null
+        ? null
+        : Number(body.latitude);
+    const longitude =
+      body.longitude === undefined || body.longitude === null
+        ? null
+        : Number(body.longitude);
+    const geofenceRadiusMeters =
+      body.geofenceRadiusMeters === undefined ||
+      body.geofenceRadiusMeters === null
+        ? 30
+        : Number(body.geofenceRadiusMeters);
+    const geofenceEnabled =
+      body.geofenceEnabled === undefined ? true : Boolean(body.geofenceEnabled);
+
+    if (
+      latitude !== null &&
+      (!Number.isFinite(latitude) || latitude < -90 || latitude > 90)
+    ) {
+      return NextResponse.json(
+        { error: "latitude must be between -90 and 90" },
+        { status: 400 },
+      );
+    }
+
+    if (
+      longitude !== null &&
+      (!Number.isFinite(longitude) || longitude < -180 || longitude > 180)
+    ) {
+      return NextResponse.json(
+        { error: "longitude must be between -180 and 180" },
+        { status: 400 },
+      );
+    }
+
+    if (!Number.isFinite(geofenceRadiusMeters) || geofenceRadiusMeters <= 0) {
+      return NextResponse.json(
+        { error: "geofenceRadiusMeters must be a positive number" },
+        { status: 400 },
+      );
+    }
+
+    await db.run(sql`
+      UPDATE gyms
+      SET
+        latitude = ${latitude},
+        longitude = ${longitude},
+        geofence_radius_meters = ${geofenceRadiusMeters},
+        geofence_enabled = ${geofenceEnabled ? 1 : 0},
+        updated_at = ${Math.floor(Date.now() / 1000)}
+      WHERE id = ${gymId}
+    `);
+
+    const updatedRows = await db.all(sql`
+      SELECT
+        id,
+        name,
+        location,
+        latitude,
+        longitude,
+        geofence_radius_meters as geofenceRadiusMeters,
+        geofence_enabled as geofenceEnabled,
+        status,
+        admin_user_id as adminUserId,
+        created_at as createdAt,
+        updated_at as updatedAt
+      FROM gyms
+      WHERE id = ${gymId}
+      LIMIT 1
+    `);
+
+    const updated = updatedRows?.[0]
+      ? {
+          ...updatedRows[0],
+          geofenceEnabled:
+            typeof (updatedRows[0] as { geofenceEnabled?: unknown })
+              .geofenceEnabled === "boolean"
+              ? (updatedRows[0] as { geofenceEnabled: boolean }).geofenceEnabled
+              : Boolean(
+                  (updatedRows[0] as { geofenceEnabled?: unknown })
+                    .geofenceEnabled,
+                ),
+        }
+      : null;
+
+    return NextResponse.json(updated);
+  } catch (error) {
+    log.error("Failed to update gym", error);
+    return NextResponse.json(
+      { error: "Internal Server Error" },
+      { status: 500 },
+    );
+  }
 }
 
 // DELETE /api/gyms/[id]

apps/admin/src/app/api/gyms/route.ts

@@ -18,6 +18,33 @@ async function ensureGymsTable() {
       updated_at INTEGER NOT NULL
     )
   `);
+
+  const columns = await db.all(sql`PRAGMA table_info('gyms')`);
+  const columnNames = new Set(
+    (columns as Array<{ name?: string }>)
+      .map((col) => col.name)
+      .filter(Boolean),
+  );
+
+  if (!columnNames.has("latitude")) {
+    await db.run(sql`ALTER TABLE gyms ADD COLUMN latitude REAL`);
+  }
+
+  if (!columnNames.has("longitude")) {
+    await db.run(sql`ALTER TABLE gyms ADD COLUMN longitude REAL`);
+  }
+
+  if (!columnNames.has("geofence_radius_meters")) {
+    await db.run(
+      sql`ALTER TABLE gyms ADD COLUMN geofence_radius_meters REAL NOT NULL DEFAULT 30`,
+    );
+  }
+
+  if (!columnNames.has("geofence_enabled")) {
+    await db.run(
+      sql`ALTER TABLE gyms ADD COLUMN geofence_enabled INTEGER NOT NULL DEFAULT 1`,
+    );
+  }
 }
 
 // GET /api/gyms
@@ -41,12 +68,35 @@ export async function GET() {
     }
 
     await ensureGymsTable();
-    let rows = await db
-      .select()
-      .from(gymsTable)
-      .where(eq(gymsTable.status, "active"))
-      .orderBy(sql`created_at DESC`)
-      .all();
+    let rows = (await db.all(sql`
+      SELECT
+        id,
+        name,
+        location,
+        latitude,
+        longitude,
+        geofence_radius_meters as geofenceRadiusMeters,
+        geofence_enabled as geofenceEnabled,
+        status,
+        admin_user_id as adminUserId,
+        created_at as createdAt,
+        updated_at as updatedAt
+      FROM gyms
+      WHERE status = 'active'
+      ORDER BY created_at DESC
+    `)) as Array<{
+      id: string;
+      name: string;
+      location: string | null;
+      latitude: number | null;
+      longitude: number | null;
+      geofenceRadiusMeters: number | null;
+      geofenceEnabled: number | boolean | null;
+      status: "active" | "inactive";
+      adminUserId: string;
+      createdAt: number;
+      updatedAt: number;
+    }>;
 
     if (currentUser.role !== "superAdmin") {
       if (!currentUser.gymId) {
@@ -55,7 +105,15 @@ export async function GET() {
       rows = rows.filter((row) => row.id === currentUser.gymId);
     }
 
-    return NextResponse.json(rows);
+    return NextResponse.json(
+      rows.map((row) => ({
+        ...row,
+        geofenceEnabled:
+          typeof row.geofenceEnabled === "boolean"
+            ? row.geofenceEnabled
+            : Boolean(row.geofenceEnabled),
+      })),
+    );
   } catch (error) {
     log.error("Failed to get gyms", error);
     return new NextResponse("Internal Server Error", { status: 500 });
@@ -89,6 +147,21 @@ export async function POST(req: Request) {
 
     const name = String(body.name ?? "").trim();
     const location = body.location ? String(body.location).trim() : null;
+    const latitude =
+      body.latitude === undefined || body.latitude === null
+        ? null
+        : Number(body.latitude);
+    const longitude =
+      body.longitude === undefined || body.longitude === null
+        ? null
+        : Number(body.longitude);
+    const geofenceRadiusMeters =
+      body.geofenceRadiusMeters === undefined ||
+      body.geofenceRadiusMeters === null
+        ? 30
+        : Number(body.geofenceRadiusMeters);
+    const geofenceEnabled =
+      body.geofenceEnabled === undefined ? true : Boolean(body.geofenceEnabled);
     let adminUserId: string | null = body.adminUserId
       ? String(body.adminUserId)
       : null;
@@ -97,6 +170,33 @@ export async function POST(req: Request) {
       return NextResponse.json({ error: "name is required" }, { status: 400 });
     }
 
+    if (
+      latitude !== null &&
+      (!Number.isFinite(latitude) || latitude < -90 || latitude > 90)
+    ) {
+      return NextResponse.json(
+        { error: "latitude must be between -90 and 90" },
+        { status: 400 },
+      );
+    }
+
+    if (
+      longitude !== null &&
+      (!Number.isFinite(longitude) || longitude < -180 || longitude > 180)
+    ) {
+      return NextResponse.json(
+        { error: "longitude must be between -180 and 180" },
+        { status: 400 },
+      );
+    }
+
+    if (!Number.isFinite(geofenceRadiusMeters) || geofenceRadiusMeters <= 0) {
+      return NextResponse.json(
+        { error: "geofenceRadiusMeters must be a positive number" },
+        { status: 400 },
+      );
+    }
+
     // Enforce admin ownership rules
     if (currentUser.role === "admin") {
       adminUserId = currentUser.id;
@@ -124,15 +224,33 @@ export async function POST(req: Request) {
     const nowTs = new Date();
 
     // Use Drizzle's insert method instead of raw SQL
-    await db.insert(gymsTable).values({
-      id,
-      name,
-      location: location ?? null,
-      status: "active",
-      adminUserId: adminUserId!,
-      createdAt: nowTs,
-      updatedAt: nowTs,
-    });
+    await db.run(sql`
+      INSERT INTO gyms (
+        id,
+        name,
+        location,
+        latitude,
+        longitude,
+        geofence_radius_meters,
+        geofence_enabled,
+        status,
+        admin_user_id,
+        created_at,
+        updated_at
+      ) VALUES (
+        ${id},
+        ${name},
+        ${location ?? null},
+        ${latitude},
+        ${longitude},
+        ${geofenceRadiusMeters},
+        ${geofenceEnabled ? 1 : 0},
+        ${"active"},
+        ${adminUserId!},
+        ${Math.floor(nowTs.getTime() / 1000)},
+        ${Math.floor(nowTs.getTime() / 1000)}
+      )
+    `);
 
     // Assign the admin to this gym immediately after creation
     await db
@@ -140,11 +258,36 @@ export async function POST(req: Request) {
       .set({ gymId: id, updatedAt: nowTs })
       .where(eq(usersTable.id, adminUserId!));
 
-    const created = await db
-      .select()
-      .from(gymsTable)
-      .where(eq(gymsTable.id, id))
-      .get();
+    const rowsCreated = await db.all(sql`
+      SELECT
+        id,
+        name,
+        location,
+        latitude,
+        longitude,
+        geofence_radius_meters as geofenceRadiusMeters,
+        geofence_enabled as geofenceEnabled,
+        status,
+        admin_user_id as adminUserId,
+        created_at as createdAt,
+        updated_at as updatedAt
+      FROM gyms
+      WHERE id = ${id}
+      LIMIT 1
+    `);
+    const createdRow = rowsCreated?.[0] ?? null;
+    const created = createdRow
+      ? {
+          ...createdRow,
+          geofenceEnabled:
+            typeof (createdRow as { geofenceEnabled?: unknown })
+              .geofenceEnabled === "boolean"
+              ? (createdRow as { geofenceEnabled: boolean }).geofenceEnabled
+              : Boolean(
+                  (createdRow as { geofenceEnabled?: unknown }).geofenceEnabled,
+                ),
+        }
+      : null;
     return NextResponse.json(created, { status: 201 });
   } catch (error) {
     log.error("Failed to create gym", error);

apps/admin/src/app/api/users/gym/route.ts

@@ -1,8 +1,78 @@
 import { NextResponse } from "next/server";
 import { auth } from "@clerk/nextjs/server";
 import { db, users as usersTable, eq, sql } from "@fitai/database";
+import { ensureGymsGeofenceColumns } from "@/lib/geofence";
 import log from "@/lib/logger";
 
+export async function GET() {
+  try {
+    const { userId } = await auth();
+    if (!userId) return new NextResponse("Unauthorized", { status: 401 });
+
+    const user = await db
+      .select()
+      .from(usersTable)
+      .where(eq(usersTable.id, userId))
+      .get();
+
+    if (!user) {
+      return new NextResponse("User not found", { status: 404 });
+    }
+
+    if (!user.gymId) {
+      return NextResponse.json({ gymId: null, gym: null });
+    }
+
+    await ensureGymsGeofenceColumns();
+
+    const rows = await db.all(sql`
+      SELECT
+        id,
+        name,
+        location,
+        latitude,
+        longitude,
+        geofence_radius_meters as geofenceRadiusMeters,
+        geofence_enabled as geofenceEnabled,
+        status
+      FROM gyms
+      WHERE id = ${user.gymId}
+      LIMIT 1
+    `);
+
+    const gym = rows?.[0] as
+      | {
+          id: string;
+          name: string;
+          location: string | null;
+          latitude: number | null;
+          longitude: number | null;
+          geofenceRadiusMeters: number | null;
+          geofenceEnabled: number | boolean | null;
+          status: "active" | "inactive";
+        }
+      | undefined;
+
+    if (!gym || gym.status !== "active") {
+      return NextResponse.json({ gymId: user.gymId, gym: null });
+    }
+
+    return NextResponse.json({
+      gymId: user.gymId,
+      gym: {
+        ...gym,
+        geofenceEnabled:
+          typeof gym.geofenceEnabled === "boolean"
+            ? gym.geofenceEnabled
+            : Boolean(gym.geofenceEnabled),
+      },
+    });
+  } catch (error) {
+    log.error("Failed to fetch current user gym", error);
+    return new NextResponse("Internal Server Error", { status: 500 });
+  }
+}
+
 /**
  * PATCH /api/users/gym
  * Body: { gymId: string | null }

apps/admin/src/app/settings/page.tsx

@@ -29,6 +29,10 @@ interface Gym {
   id: string;
   name: string;
   location?: string | null;
+  latitude?: number | null;
+  longitude?: number | null;
+  geofenceRadiusMeters?: number | null;
+  geofenceEnabled?: boolean;
   status: "active" | "inactive";
   adminUserId: string;
   createdAt?: number;
@@ -72,6 +76,11 @@ export default function SettingsPage() {
   const [gymStats, setGymStats] = useState<GymStats | null>(null);
   const [statsLoading, setStatsLoading] = useState(false);
   const [deletingGym, setDeletingGym] = useState(false);
+  const [savingGeofence, setSavingGeofence] = useState(false);
+  const [geofenceLatitude, setGeofenceLatitude] = useState("");
+  const [geofenceLongitude, setGeofenceLongitude] = useState("");
+  const [geofenceRadiusMeters, setGeofenceRadiusMeters] = useState("30");
+  const [geofenceEnabled, setGeofenceEnabled] = useState(true);
 
   // Create Gym modal state
   const [showCreateGym, setShowCreateGym] = useState(false);
@@ -186,6 +195,87 @@ export default function SettingsPage() {
   const handleSelectGym = async (gym: Gym | null) => {
     setSelectedGym(gym);
     setGymStats(null);
+
+    if (gym) {
+      setGeofenceLatitude(
+        gym.latitude !== null && gym.latitude !== undefined
+          ? String(gym.latitude)
+          : "",
+      );
+      setGeofenceLongitude(
+        gym.longitude !== null && gym.longitude !== undefined
+          ? String(gym.longitude)
+          : "",
+      );
+      setGeofenceRadiusMeters(String(gym.geofenceRadiusMeters ?? 30));
+      setGeofenceEnabled(gym.geofenceEnabled ?? true);
+    }
+  };
+
+  const handleSaveGeofence = async () => {
+    if (!selectedGym) return;
+
+    const latitude =
+      geofenceLatitude.trim() === "" ? null : Number(geofenceLatitude);
+    const longitude =
+      geofenceLongitude.trim() === "" ? null : Number(geofenceLongitude);
+    const radius = Number(geofenceRadiusMeters);
+
+    if (
+      latitude !== null &&
+      (!Number.isFinite(latitude) || latitude < -90 || latitude > 90)
+    ) {
+      setGymMessage({
+        type: "error",
+        text: "Latitude must be between -90 and 90",
+      });
+      return;
+    }
+
+    if (
+      longitude !== null &&
+      (!Number.isFinite(longitude) || longitude < -180 || longitude > 180)
+    ) {
+      setGymMessage({
+        type: "error",
+        text: "Longitude must be between -180 and 180",
+      });
+      return;
+    }
+
+    if (!Number.isFinite(radius) || radius <= 0) {
+      setGymMessage({
+        type: "error",
+        text: "Radius must be a positive number",
+      });
+      return;
+    }
+
+    setSavingGeofence(true);
+    setGymMessage(null);
+
+    try {
+      const response = await axios.patch(`/api/gyms/${selectedGym.id}`, {
+        latitude,
+        longitude,
+        geofenceRadiusMeters: radius,
+        geofenceEnabled,
+      });
+      setGymMessage({ type: "success", text: "Geofence settings updated" });
+      const updatedGym = response.data as Gym;
+      setSelectedGym(updatedGym);
+      setGyms((prev) =>
+        prev.map((gym) => (gym.id === updatedGym.id ? updatedGym : gym)),
+      );
+    } catch (error) {
+      log.error("Failed to update geofence settings", error);
+      setGymMessage({
+        type: "error",
+        text: "Failed to update geofence settings",
+      });
+    } finally {
+      setSavingGeofence(false);
+    }
   };
 
   const handleDeleteGym = async (gymId: string) => {
@@ -475,6 +565,91 @@ export default function SettingsPage() {
                       {selectedGym.status}
                     </p>
                   </div>
+                  <div>
+                    <p className="text-xs text-slate-500">Geofence</p>
+                    <p className="font-medium">
+                      {selectedGym.geofenceEnabled === false
+                        ? "Disabled"
+                        : `${selectedGym.geofenceRadiusMeters ?? 30}m`}
+                    </p>
+                  </div>
+                </div>
+
+                {/* Geofence Settings */}
+                <div className="p-4 border rounded-lg space-y-3">
+                  <div className="flex items-center justify-between">
+                    <h5 className="text-sm font-medium text-slate-700">
+                      Attendance Geofence
+                    </h5>
+                    <label className="inline-flex items-center gap-2 text-sm text-slate-700">
+                      <input
+                        type="checkbox"
+                        checked={geofenceEnabled}
+                        onChange={(e) => setGeofenceEnabled(e.target.checked)}
+                      />
+                      Enabled
+                    </label>
+                  </div>
+
+                  <div className="grid grid-cols-1 md:grid-cols-3 gap-3">
+                    <div>
+                      <label className="block text-xs text-slate-500 mb-1">
+                        Latitude
+                      </label>
+                      <input
+                        type="number"
+                        step="any"
+                        value={geofenceLatitude}
+                        onChange={(e) => setGeofenceLatitude(e.target.value)}
+                        className="w-full border border-gray-300 rounded px-3 py-2"
+                        placeholder="e.g. 37.7749"
+                      />
+                    </div>
+                    <div>
+                      <label className="block text-xs text-slate-500 mb-1">
+                        Longitude
+                      </label>
+                      <input
+                        type="number"
+                        step="any"
+                        value={geofenceLongitude}
+                        onChange={(e) => setGeofenceLongitude(e.target.value)}
+                        className="w-full border border-gray-300 rounded px-3 py-2"
+                        placeholder="e.g. -122.4194"
+                      />
+                    </div>
+                    <div>
+                      <label className="block text-xs text-slate-500 mb-1">
+                        Radius (meters)
+                      </label>
+                      <input
+                        type="number"
+                        min="1"
+                        value={geofenceRadiusMeters}
+                        onChange={(e) =>
+                          setGeofenceRadiusMeters(e.target.value)
+                        }
+                        className="w-full border border-gray-300 rounded px-3 py-2"
+                      />
+                    </div>
+                  </div>
+
+                  <div className="flex items-center justify-between">
+                    <p className="text-xs text-slate-500">
+                      Default radius is 30m and geofence is enabled by default.
+                    </p>
+                    <Button
+                      size="sm"
+                      onClick={handleSaveGeofence}
+                      disabled={savingGeofence}
+                    >
+                      {savingGeofence ? (
+                        <Loader2 className="w-4 h-4 animate-spin" />
+                      ) : (
+                        "Save Geofence"
+                      )}
+                    </Button>
+                  </div>
                 </div>
 
                 {/* Stats */}

apps/admin/src/lib/geofence.ts

@@ -0,0 +1,277 @@
+import { db, eq, sql, users } from "@fitai/database";
+
+export const DEFAULT_GEOFENCE_RADIUS_METERS = 30;
+export const MAX_LOCATION_ACCURACY_METERS = 50;
+export const MAX_FALLBACK_ACCURACY_MARGIN_METERS = 120;
+
+export interface UserLocation {
+  latitude: number;
+  longitude: number;
+  accuracy: number;
+}
+
+export async function ensureGymsGeofenceColumns(): Promise<void> {
+  const rows = await db.all(sql`PRAGMA table_info('gyms')`);
+  const columns = new Set(
+    (rows as Array<{ name?: string }>).map((row) => row.name).filter(Boolean),
+  );
+
+  if (!columns.has("latitude")) {
+    await db.run(sql`ALTER TABLE gyms ADD COLUMN latitude REAL`);
+  }
+
+  if (!columns.has("longitude")) {
+    await db.run(sql`ALTER TABLE gyms ADD COLUMN longitude REAL`);
+  }
+
+  if (!columns.has("geofence_radius_meters")) {
+    await db.run(
+      sql`ALTER TABLE gyms ADD COLUMN geofence_radius_meters REAL NOT NULL DEFAULT 30`,
+    );
+  }
+
+  if (!columns.has("geofence_enabled")) {
+    await db.run(
+      sql`ALTER TABLE gyms ADD COLUMN geofence_enabled INTEGER NOT NULL DEFAULT 1`,
+    );
+  }
+}
+
+interface GymGeofenceConfig {
+  id: string;
+  name: string;
+  latitude: number | null;
+  longitude: number | null;
+  geofenceRadiusMeters: number | null;
+  geofenceEnabled: boolean | null;
+}
+
+export async function getUserGymGeofence(
+  userId: string,
+): Promise<GymGeofenceConfig | null> {
+  await ensureGymsGeofenceColumns();
+
+  const user = await db.select().from(users).where(eq(users.id, userId)).get();
+  if (!user?.gymId) {
+    return null;
+  }
+
+  const rows = await db.all(sql`
+    SELECT
+      id,
+      name,
+      latitude,
+      longitude,
+      geofence_radius_meters as geofenceRadiusMeters,
+      geofence_enabled as geofenceEnabled
+    FROM gyms
+    WHERE id = ${user.gymId}
+    LIMIT 1
+  `);
+  const gym = rows?.[0] as
+    | {
+        id: string;
+        name: string;
+        latitude: number | null;
+        longitude: number | null;
+        geofenceRadiusMeters: number | null;
+        geofenceEnabled: number | boolean | null;
+      }
+    | undefined;
+  if (!gym) {
+    return null;
+  }
+
+  return {
+    id: gym.id,
+    name: gym.name,
+    latitude: gym.latitude,
+    longitude: gym.longitude,
+    geofenceRadiusMeters: gym.geofenceRadiusMeters,
+    geofenceEnabled:
+      typeof gym.geofenceEnabled === "boolean"
+        ? gym.geofenceEnabled
+        : gym.geofenceEnabled === null
+          ? null
+          : Boolean(gym.geofenceEnabled),
+  };
+}
+
+export function parseUserLocation(payload: unknown): UserLocation | null {
+  if (!payload || typeof payload !== "object") {
+    return null;
+  }
+
+  const raw = payload as Record<string, unknown>;
+  const latitude = Number(raw.latitude);
+  const longitude = Number(raw.longitude);
+  const accuracy = Number(raw.accuracy);
+
+  if (
+    !Number.isFinite(latitude) ||
+    !Number.isFinite(longitude) ||
+    !Number.isFinite(accuracy)
+  ) {
+    return null;
+  }
+
+  return { latitude, longitude, accuracy };
+}
+
+export function validateGeofence(
+  gym: GymGeofenceConfig,
+  location: UserLocation | null,
+): { ok: true } | { ok: false; status: number; error: string } {
+  const geofenceEnabled = gym.geofenceEnabled ?? true;
+  if (!geofenceEnabled) {
+    return { ok: true };
+  }
+
+  if (!location) {
+    return {
+      ok: false,
+      status: 400,
+      error: "Location is required for gym check-in/check-out",
+    };
+  }
+
+  if (location.accuracy > MAX_LOCATION_ACCURACY_METERS) {
+    return {
+      ok: false,
+      status: 400,
+      error: `Location accuracy too low (${Math.round(location.accuracy)}m). Move to an open area and try again.`,
+    };
+  }
+
+  if (gym.latitude === null || gym.longitude === null) {
+    return {
+      ok: false,
+      status: 400,
+      error: "Gym geofence is enabled but gym coordinates are not configured",
+    };
+  }
+
+  const radius = gym.geofenceRadiusMeters ?? DEFAULT_GEOFENCE_RADIUS_METERS;
+  const distanceMeters = haversineDistanceMeters(
+    gym.latitude,
+    gym.longitude,
+    location.latitude,
+    location.longitude,
+  );
+
+  if (distanceMeters > radius) {
+    return {
+      ok: false,
+      status: 403,
+      error: `You are outside the gym geofence (${Math.round(distanceMeters)}m away, allowed ${Math.round(radius)}m).`,
+    };
+  }
+
+  return { ok: true };
+}
+
+export function validateGeofenceWithFallback(
+  gym: GymGeofenceConfig,
+  location: UserLocation | null,
+  fallbackRequested: boolean,
+): { ok: true } | { ok: false; status: number; error: string } {
+  const geofenceEnabled = gym.geofenceEnabled ?? true;
+  if (!geofenceEnabled) {
+    return { ok: true };
+  }
+
+  if (!location) {
+    return {
+      ok: false,
+      status: 400,
+      error: "Location is required for gym check-in/check-out",
+    };
+  }
+
+  if (gym.latitude === null || gym.longitude === null) {
+    return {
+      ok: false,
+      status: 400,
+      error: "Gym geofence is enabled but gym coordinates are not configured",
+    };
+  }
+
+  const radius = gym.geofenceRadiusMeters ?? DEFAULT_GEOFENCE_RADIUS_METERS;
+  const distanceMeters = haversineDistanceMeters(
+    gym.latitude,
+    gym.longitude,
+    location.latitude,
+    location.longitude,
+  );
+
+  if (location.accuracy <= MAX_LOCATION_ACCURACY_METERS) {
+    if (distanceMeters > radius) {
+      return {
+        ok: false,
+        status: 403,
+        error: `You are outside the gym geofence (${Math.round(distanceMeters)}m away, allowed ${Math.round(radius)}m).`,
+      };
+    }
+
+    return { ok: true };
+  }
+
+  if (!fallbackRequested) {
+    return {
+      ok: false,
+      status: 400,
+      error: `Location accuracy too low (${Math.round(location.accuracy)}m). Move to an open area and try again.`,
+    };
+  }
+
+  const fallbackMargin = Math.min(
+    location.accuracy,
+    MAX_FALLBACK_ACCURACY_MARGIN_METERS,
+  );
+  const fallbackAllowedDistance = radius + fallbackMargin;
+
+  if (distanceMeters > fallbackAllowedDistance) {
+    return {
+      ok: false,
+      status: 403,
+      error: `You are outside the gym geofence (${Math.round(distanceMeters)}m away, fallback allowed ${Math.round(fallbackAllowedDistance)}m).`,
+    };
+  }
+
+  return { ok: true };
+}
+
+export function validateCheckInGeofence(
+  gym: GymGeofenceConfig,
+  location: UserLocation | null,
+  fallbackRequested: boolean,
+): { ok: true } | { ok: false; status: number; error: string } {
+  return validateGeofenceWithFallback(gym, location, fallbackRequested);
+}
+
+function haversineDistanceMeters(
+  latitude1: number,
+  longitude1: number,
+  latitude2: number,
+  longitude2: number,
+): number {
+  const earthRadiusMeters = 6371000;
+  const dLat = toRadians(latitude2 - latitude1);
+  const dLng = toRadians(longitude2 - longitude1);
+  const lat1Rad = toRadians(latitude1);
+  const lat2Rad = toRadians(latitude2);
+
+  const a =
+    Math.sin(dLat / 2) * Math.sin(dLat / 2) +
+    Math.sin(dLng / 2) *
+      Math.sin(dLng / 2) *
+      Math.cos(lat1Rad) *
+      Math.cos(lat2Rad);
+
+  const c = 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1 - a));
+  return earthRadiusMeters * c;
+}
+
+function toRadians(degrees: number): number {
+  return (degrees * Math.PI) / 180;
+}

apps/mobile/app.json

@@ -17,7 +17,13 @@
       "infoPlist": {
         "NSCameraUsageDescription": "This app uses the camera to scan food barcodes and identify nutritional information.",
         "NSUserNotificationsUsageDescription": "This app uses notifications to keep you updated on your fitness progress, recommendation approvals, and important reminders.",
-        "NSMotionUsageDescription": "This app uses motion data to track your daily steps and activity progress."
+        "NSMotionUsageDescription": "This app uses motion data to track your daily steps and activity progress.",
+        "NSLocationWhenInUseUsageDescription": "This app uses your location to verify you are at your gym when checking in and checking out.",
+        "NSLocationAlwaysAndWhenInUseUsageDescription": "This app uses your location in the background to automatically start and end workouts when you enter or leave your gym geofence."
+      },
+      "bundleIdentifier": "com.anonymous.fitai",
+      "config": {
+        "usesNonExemptEncryption": false
       }
     },
     "android": {
@@ -29,7 +35,10 @@
         "CAMERA",
         "POST_NOTIFICATIONS",
         "android.permission.CAMERA",
-        "android.permission.ACTIVITY_RECOGNITION"
+        "android.permission.ACTIVITY_RECOGNITION",
+        "android.permission.ACCESS_FINE_LOCATION",
+        "android.permission.ACCESS_COARSE_LOCATION",
+        "android.permission.ACCESS_BACKGROUND_LOCATION"
       ],
       "package": "com.anonymous.fitai"
     },
@@ -40,6 +49,15 @@
       "expo-router",
       "expo-font",
       "expo-barcode-scanner",
+      [
+        "expo-location",
+        {
+          "locationWhenInUsePermission": "Allow FitAI to use your location to verify gym check-ins and check-outs.",
+          "locationAlwaysAndWhenInUsePermission": "Allow FitAI to use your location in the background to automatically start and end workouts at your gym.",
+          "isIosBackgroundLocationEnabled": true,
+          "isAndroidBackgroundLocationEnabled": true
+        }
+      ],
       [
         "expo-notifications",
         {

apps/mobile/package-lock.json

@@ -29,11 +29,13 @@
         "expo-haptics": "^15.0.7",
         "expo-linear-gradient": "~15.0.7",
         "expo-linking": "~8.0.0",
+        "expo-location": "~19.0.7",
         "expo-notifications": "~0.32.0",
         "expo-router": "~6.0.14",
         "expo-secure-store": "~15.0.7",
         "expo-sensors": "~14.1.4",
         "expo-status-bar": "^3.0.8",
+        "expo-task-manager": "~14.0.8",
         "expo-web-browser": "^15.0.10",
         "react": "19.1.0",
         "react-dom": "^19.1.0",
@@ -7464,6 +7466,15 @@
         "react-native": "*"
       }
     },
+    "node_modules/expo-location": {
+      "version": "19.0.8",
+      "resolved": "https://registry.npmjs.org/expo-location/-/expo-location-19.0.8.tgz",
+      "integrity": "sha512-H/FI75VuJ1coodJbbMu82pf+Zjess8X8Xkiv9Bv58ZgPKS/2ztjC1YO1/XMcGz7+s9DrbLuMIw22dFuP4HqneA==",
+      "license": "MIT",
+      "peerDependencies": {
+        "expo": "*"
+      }
+    },
     "node_modules/expo-modules-autolinking": {
       "version": "3.0.22",
       "resolved": "https://registry.npmjs.org/expo-modules-autolinking/-/expo-modules-autolinking-3.0.22.tgz",
@@ -7640,6 +7651,19 @@
         "react-native": "*"
       }
     },
+    "node_modules/expo-task-manager": {
+      "version": "14.0.9",
+      "resolved": "https://registry.npmjs.org/expo-task-manager/-/expo-task-manager-14.0.9.tgz",
+      "integrity": "sha512-GKWtXrkedr4XChHfTm5IyTcSfMtCPxzx89y4CMVqKfyfROATibrE/8UI5j7UC/pUOfFoYlQvulQEvECMreYuUA==",
+      "license": "MIT",
+      "dependencies": {
+        "unimodules-app-loader": "~6.0.8"
+      },
+      "peerDependencies": {
+        "expo": "*",
+        "react-native": "*"
+      }
+    },
     "node_modules/expo-web-browser": {
       "version": "15.0.10",
       "resolved": "https://registry.npmjs.org/expo-web-browser/-/expo-web-browser-15.0.10.tgz",
@@ -13433,6 +13457,12 @@
         "node": ">=4"
       }
     },
+    "node_modules/unimodules-app-loader": {
+      "version": "6.0.8",
+      "resolved": "https://registry.npmjs.org/unimodules-app-loader/-/unimodules-app-loader-6.0.8.tgz",
+      "integrity": "sha512-fqS8QwT/MC/HAmw1NKCHdzsPA6WaLm0dNmoC5Pz6lL+cDGYeYCNdHMO9fy08aL2ZD7cVkNM0pSR/AoNRe+rslA==",
+      "license": "MIT"
+    },
     "node_modules/unique-string": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/unique-string/-/unique-string-2.0.0.tgz",

apps/mobile/package.json

@@ -35,8 +35,10 @@
     "expo-haptics": "^15.0.7",
     "expo-linear-gradient": "~15.0.7",
     "expo-linking": "~8.0.0",
+    "expo-location": "~19.0.7",
     "expo-notifications": "~0.32.0",
     "expo-router": "~6.0.14",
+    "expo-task-manager": "~14.0.8",
     "expo-secure-store": "~15.0.7",
     "expo-sensors": "~14.1.4",
     "expo-status-bar": "^3.0.8",

apps/mobile/src/api/attendance.ts

@@ -1,47 +1,88 @@
 import { apiClient } from "./client";
 import { API_ENDPOINTS } from "../config/api";
+import { isAxiosError } from "axios";
 
 export interface Attendance {
-    id: string;
-    checkInTime: string;
-    checkOutTime?: string;
-    type: string;
-    notes?: string;
+  id: string;
+  checkInTime: string;
+  checkOutTime?: string;
+  type: string;
+  notes?: string;
+}
+
+export interface AttendanceLocationPayload {
+  latitude: number;
+  longitude: number;
+  accuracy: number;
 }
 
 export const attendanceApi = {
-    getHistory: async (token: string): Promise<Attendance[]> => {
-        try {
-            const response = await apiClient.get(API_ENDPOINTS.ATTENDANCE.HISTORY, {
-                headers: { Authorization: `Bearer ${token}` },
-            });
-            return response.data;
-        } catch (error) {
-            throw error;
-        }
-    },
+  getHistory: async (token: string): Promise<Attendance[]> => {
+    try {
+      const response = await apiClient.get(API_ENDPOINTS.ATTENDANCE.HISTORY, {
+        headers: { Authorization: `Bearer ${token}` },
+      });
+      return response.data;
+    } catch (error) {
+      throw new Error(
+        getAttendanceErrorMessage(error, "Failed to load attendance history."),
+      );
+    }
+  },
 
-    checkIn: async (type: string, token: string): Promise<void> => {
-        try {
-            await apiClient.post(
-                API_ENDPOINTS.ATTENDANCE.CHECK_IN,
-                { type },
-                { headers: { Authorization: `Bearer ${token}` } },
-            );
-        } catch (error) {
-            throw error;
-        }
-    },
+  checkIn: async (
+    type: string,
+    token: string,
+    location: AttendanceLocationPayload,
+    fallbackRequested = false,
+  ): Promise<void> => {
+    try {
+      await apiClient.post(
+        API_ENDPOINTS.ATTENDANCE.CHECK_IN,
+        { type, location, fallbackRequested },
+        { headers: { Authorization: `Bearer ${token}` } },
+      );
+    } catch (error) {
+      throw new Error(
+        getAttendanceErrorMessage(error, "Failed to start workout."),
+      );
+    }
+  },
 
-    checkOut: async (token: string): Promise<void> => {
-        try {
-            await apiClient.post(
-                API_ENDPOINTS.ATTENDANCE.CHECK_OUT,
-                {},
-                { headers: { Authorization: `Bearer ${token}` } },
-            );
-        } catch (error) {
-            throw error;
-        }
-    },
+  checkOut: async (
+    token: string,
+    location: AttendanceLocationPayload,
+    fallbackRequested = false,
+  ): Promise<void> => {
+    try {
+      await apiClient.post(
+        API_ENDPOINTS.ATTENDANCE.CHECK_OUT,
+        { location, fallbackRequested },
+        { headers: { Authorization: `Bearer ${token}` } },
+      );
+    } catch (error) {
+      throw new Error(
+        getAttendanceErrorMessage(error, "Failed to end workout."),
+      );
+    }
+  },
 };
+
+function getAttendanceErrorMessage(error: unknown, fallback: string): string {
+  if (isAxiosError(error)) {
+    const payload = error.response?.data;
+
+    if (typeof payload === "string" && payload.trim()) {
+      return payload;
+    }
+
+    if (payload && typeof payload === "object") {
+      const message = (payload as { error?: unknown }).error;
+      if (typeof message === "string" && message.trim()) {
+        return message;
+      }
+    }
+  }
+
+  return fallback;
+}

apps/mobile/src/api/gyms.ts

@@ -6,6 +6,10 @@ export interface Gym {
   id: string;
   name: string;
   location?: string;
+  latitude?: number | null;
+  longitude?: number | null;
+  geofenceRadiusMeters?: number;
+  geofenceEnabled?: boolean;
 }
 
 export const gymsApi = {

apps/mobile/src/api/userGym.ts

@@ -0,0 +1,28 @@
+import { API_ENDPOINTS } from "../config/api";
+import { apiClient, withAuth } from "./client";
+
+export interface UserGymGeofence {
+  id: string;
+  name: string;
+  location: string | null;
+  latitude: number | null;
+  longitude: number | null;
+  geofenceRadiusMeters: number | null;
+  geofenceEnabled: boolean;
+  status: "active" | "inactive";
+}
+
+export interface UserGymResponse {
+  gymId: string | null;
+  gym: UserGymGeofence | null;
+}
+
+export const userGymApi = {
+  getCurrentGym: async (token: string | null): Promise<UserGymResponse> => {
+    const response = await apiClient.get<UserGymResponse>(
+      API_ENDPOINTS.USERS.GYM,
+      withAuth(token),
+    );
+    return response.data;
+  },
+};

apps/mobile/src/app/(auth)/onboarding.tsx

@@ -17,6 +17,7 @@ import { useTheme } from "../../contexts/ThemeContext";
 import { Input } from "../../components/Input";
 import { MinimalButton } from "../../components/MinimalButton";
 import { MinimalCard } from "../../components/MinimalCard";
+import { syncAutoWorkoutGeofenceWithToken } from "../../services/autoWorkoutGeofence";
 import log from "../../utils/logger";
 
 export default function OnboardingScreen() {
@@ -81,6 +82,9 @@ export default function OnboardingScreen() {
       // selectedGymId: string gym id, or null to proceed without gym
       try {
         await gymsApi.updateUserGym(selectedGymId, token);
+        await syncAutoWorkoutGeofenceWithToken(token, {
+          requestPermissions: true,
+        });
       } catch (e) {
         log.warn("Failed to update gym selection", { gymId: selectedGymId });
       }

apps/mobile/src/app/(tabs)/index.tsx

@@ -10,6 +10,7 @@ import {
   Alert,
   AppState,
 } from "react-native";
+import * as Location from "expo-location";
 import { useAuth, useUser } from "@clerk/clerk-expo";
 import { useState, useCallback, useEffect, useRef, useMemo } from "react";
 import { useFocusEffect } from "@react-navigation/native";
@@ -29,6 +30,7 @@ import { ActivityRing } from "../../components/ActivityRing";
 import { useMembership } from "../../hooks/useMembership";
 import { attendanceApi, type Attendance } from "../../api/attendance";
 import { useDailySteps } from "../../hooks/useDailySteps";
+import { syncAutoWorkoutGeofenceWithToken } from "../../services/autoWorkoutGeofence";
 import {
   checkInsToActivities,
   completedGoalsToActivities,
@@ -236,11 +238,40 @@ export default function HomeScreen() {
         return;
       }
 
+      await syncAutoWorkoutGeofenceWithToken(token, {
+        requestPermissions: true,
+      });
+
+      const permission = await Location.requestForegroundPermissionsAsync();
+      if (permission.status !== "granted") {
+        Alert.alert(
+          "Location required",
+          "Location access is required to check in and check out.",
+        );
+        return;
+      }
+
+      const position = await Location.getCurrentPositionAsync({
+        accuracy: Location.Accuracy.Balanced,
+      });
+      const locationPayload = {
+        latitude: position.coords.latitude,
+        longitude: position.coords.longitude,
+        accuracy: position.coords.accuracy ?? 999,
+      };
+
       if (activeWorkoutSession) {
-        await attendanceApi.checkOut(token);
+        const fallbackRequested = locationPayload.accuracy > 50;
+        await attendanceApi.checkOut(token, locationPayload, fallbackRequested);
         Alert.alert("Workout logged", "Session ended successfully.");
       } else {
-        await attendanceApi.checkIn("gym", token);
+        const fallbackRequested = locationPayload.accuracy > 50;
+        await attendanceApi.checkIn(
+          "gym",
+          token,
+          locationPayload,
+          fallbackRequested,
+        );
         Alert.alert("Workout started", "Session started successfully.");
       }
 

apps/mobile/src/app/(tabs)/profile.tsx

@@ -21,6 +21,7 @@ import { IconContainer } from "../../components/IconContainer";
 import { fitnessProfileApi, FitnessProfile } from "../../api/fitnessProfile";
 import { gymsApi, type Gym } from "../../api/gyms";
 import { useMembership } from "../../hooks/useMembership";
+import { syncAutoWorkoutGeofenceWithToken } from "../../services/autoWorkoutGeofence";
 import log from "../../utils/logger";
 
 export default function ProfileScreen() {
@@ -115,6 +116,12 @@ export default function ProfileScreen() {
         "Success",
         selectedGymId ? "Gym selected successfully" : "Proceeding without gym",
       );
+
+      if (token) {
+        await syncAutoWorkoutGeofenceWithToken(token, {
+          requestPermissions: true,
+        });
+      }
     } catch (err) {
       log.error("Failed to update gym selection", err);
       Alert.alert("Error", "Failed to update gym selection");

apps/mobile/src/app/_layout.tsx

@@ -13,6 +13,7 @@ import { RecommendationsProvider } from "../contexts/RecommendationsContext";
 import { NotificationsProvider } from "../contexts/NotificationsContext";
 import { MembershipProvider } from "../contexts/MembershipContext";
 import { queryClient } from "../lib/query-client";
+import { useAutoWorkoutGeofence } from "../hooks/useAutoWorkoutGeofence";
 import log from "../utils/logger";
 
 // Wrapper to use notification permissions hook after ClerkLoaded
@@ -22,6 +23,7 @@ function AppContent() {
     useNotificationPermissions,
   } = require("../hooks/useNotificationPermissions");
   useNotificationPermissions();
+  useAutoWorkoutGeofence();
 
   return (
     <Stack>

apps/mobile/src/hooks/useAutoWorkoutGeofence.ts

@@ -0,0 +1,68 @@
+import { useAuth } from "@clerk/clerk-expo";
+import { useCallback, useEffect } from "react";
+import { AppState } from "react-native";
+import {
+  disableAutoWorkoutGeofence,
+  syncAutoWorkoutGeofenceWithToken,
+} from "../services/autoWorkoutGeofence";
+import log from "../utils/logger";
+
+export function useAutoWorkoutGeofence() {
+  const { isSignedIn, getToken } = useAuth();
+
+  const syncGeofence = useCallback(async () => {
+    try {
+      if (!isSignedIn) {
+        await disableAutoWorkoutGeofence();
+        return;
+      }
+
+      const token = await getToken();
+      if (!token) {
+        await disableAutoWorkoutGeofence();
+        return;
+      }
+
+      await syncAutoWorkoutGeofenceWithToken(token, {
+        requestPermissions: true,
+      });
+    } catch (error) {
+      log.warn("Failed to sync auto workout geofence", {
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }, [getToken, isSignedIn]);
+
+  useEffect(() => {
+    void syncGeofence();
+  }, [syncGeofence]);
+
+  useEffect(() => {
+    const appStateSubscription = AppState.addEventListener(
+      "change",
+      (state) => {
+        if (state === "active") {
+          void syncGeofence();
+        }
+      },
+    );
+
+    const interval = setInterval(
+      () => {
+        void syncGeofence();
+      },
+      5 * 60 * 1000,
+    );
+
+    return () => {
+      appStateSubscription.remove();
+      clearInterval(interval);
+    };
+  }, [syncGeofence]);
+
+  useEffect(() => {
+    if (!isSignedIn) {
+      void disableAutoWorkoutGeofence();
+    }
+  }, [isSignedIn]);
+}

apps/mobile/src/lib/background-auth-token.ts

@@ -0,0 +1,19 @@
+import * as SecureStore from "expo-secure-store";
+
+const BACKGROUND_AUTH_TOKEN_KEY = "fitai_background_auth_token";
+
+export async function saveBackgroundAuthToken(token: string): Promise<void> {
+  if (!looksLikeJwt(token)) {
+    return;
+  }
+
+  await SecureStore.setItemAsync(BACKGROUND_AUTH_TOKEN_KEY, token);
+}
+
+export async function getBackgroundAuthToken(): Promise<string | null> {
+  return SecureStore.getItemAsync(BACKGROUND_AUTH_TOKEN_KEY);
+}
+
+function looksLikeJwt(token: string): boolean {
+  return token.split(".").length === 3;
+}

apps/mobile/src/services/autoWorkoutGeofence.ts

@@ -0,0 +1,296 @@
+import * as Location from "expo-location";
+import * as TaskManager from "expo-task-manager";
+import { apiClient } from "../api/client";
+import { userGymApi } from "../api/userGym";
+import { API_ENDPOINTS } from "../config/api";
+import { saveBackgroundAuthToken } from "../lib/background-auth-token";
+import { getBackgroundAuthToken } from "../lib/background-auth-token";
+import log from "../utils/logger";
+
+const AUTO_WORKOUT_GEOFENCE_TASK = "fitai-auto-workout-geofence";
+const DEFAULT_RADIUS_METERS = 30;
+const MAX_ACCEPTABLE_ACCURACY_METERS = 50;
+const ACTION_COOLDOWN_MS = 90_000;
+
+let lastActionAt = 0;
+
+interface GeofenceRegion {
+  identifier: string;
+  latitude: number;
+  longitude: number;
+  radius: number;
+  notifyOnEnter: boolean;
+  notifyOnExit: boolean;
+}
+
+if (!TaskManager.isTaskDefined(AUTO_WORKOUT_GEOFENCE_TASK)) {
+  TaskManager.defineTask(
+    AUTO_WORKOUT_GEOFENCE_TASK,
+    async ({ data, error }: TaskManager.TaskManagerTaskBody) => {
+      if (error) {
+        log.error("Auto workout geofence task failed", error);
+        return;
+      }
+
+      const event = data as
+        | {
+            eventType?: Location.GeofencingEventType;
+            region?: GeofenceRegion;
+          }
+        | undefined;
+
+      const eventType = event?.eventType;
+      if (
+        eventType !== Location.GeofencingEventType.Enter &&
+        eventType !== Location.GeofencingEventType.Exit
+      ) {
+        return;
+      }
+
+      const now = Date.now();
+      if (now - lastActionAt < ACTION_COOLDOWN_MS) {
+        return;
+      }
+      lastActionAt = now;
+
+      try {
+        const token = await getBackgroundAuthToken();
+        if (!token) {
+          log.warn("Skipping geofence auto-workout due to missing auth token");
+          return;
+        }
+
+        const location = await Location.getCurrentPositionAsync({
+          accuracy: Location.Accuracy.Balanced,
+        });
+
+        const accuracy = location.coords.accuracy ?? 999;
+        if (accuracy > MAX_ACCEPTABLE_ACCURACY_METERS) {
+          log.warn("Skipping geofence auto-workout due to poor GPS accuracy", {
+            accuracy,
+          });
+          return;
+        }
+
+        const headers = { Authorization: `Bearer ${token}` };
+        const locationPayload = {
+          latitude: location.coords.latitude,
+          longitude: location.coords.longitude,
+          accuracy,
+        };
+
+        const historyRes = await apiClient.get(
+          API_ENDPOINTS.ATTENDANCE.HISTORY,
+          {
+            headers,
+          },
+        );
+        const history = Array.isArray(historyRes.data)
+          ? (historyRes.data as Array<{ id: string; checkOutTime?: string }>)
+          : [];
+        const activeSession = history.find((item) => !item.checkOutTime);
+
+        if (eventType === Location.GeofencingEventType.Enter) {
+          if (activeSession) {
+            return;
+          }
+
+          await apiClient.post(
+            API_ENDPOINTS.ATTENDANCE.CHECK_IN,
+            { type: "gym", location: locationPayload },
+            { headers },
+          );
+          log.info("Auto-started workout after geofence enter");
+          return;
+        }
+
+        if (!activeSession) {
+          return;
+        }
+
+        await apiClient.post(
+          API_ENDPOINTS.ATTENDANCE.CHECK_OUT,
+          {
+            location: locationPayload,
+            fallbackRequested: accuracy > MAX_ACCEPTABLE_ACCURACY_METERS,
+          },
+          { headers },
+        );
+        log.info("Auto-ended workout after geofence exit");
+      } catch (taskError: unknown) {
+        if (
+          isApiError(taskError, 400, "Already checked in") ||
+          isApiError(taskError, 404, "No active check-in found")
+        ) {
+          return;
+        }
+
+        log.error("Auto workout geofence action failed", taskError);
+      }
+    },
+  );
+}
+
+export async function configureAutoWorkoutGeofence(params: {
+  latitude: number;
+  longitude: number;
+  radiusMeters?: number | null;
+}): Promise<void> {
+  const started = await Location.hasStartedGeofencingAsync(
+    AUTO_WORKOUT_GEOFENCE_TASK,
+  );
+
+  const region: GeofenceRegion = {
+    identifier: "user-gym",
+    latitude: params.latitude,
+    longitude: params.longitude,
+    radius: params.radiusMeters ?? DEFAULT_RADIUS_METERS,
+    notifyOnEnter: true,
+    notifyOnExit: true,
+  };
+
+  if (started) {
+    try {
+      await Location.stopGeofencingAsync(AUTO_WORKOUT_GEOFENCE_TASK);
+    } catch (error) {
+      if (!isTaskNotFoundError(error)) {
+        throw error;
+      }
+
+      log.warn("Geofence task was not found while stopping before restart", {
+        task: AUTO_WORKOUT_GEOFENCE_TASK,
+      });
+    }
+  }
+
+  await Location.startGeofencingAsync(AUTO_WORKOUT_GEOFENCE_TASK, [region]);
+}
+
+export async function disableAutoWorkoutGeofence(): Promise<void> {
+  try {
+    const started = await Location.hasStartedGeofencingAsync(
+      AUTO_WORKOUT_GEOFENCE_TASK,
+    );
+
+    if (!started) {
+      return;
+    }
+
+    await Location.stopGeofencingAsync(AUTO_WORKOUT_GEOFENCE_TASK);
+  } catch (error) {
+    if (!isTaskNotFoundError(error)) {
+      throw error;
+    }
+
+    log.warn("Geofence task was not found while disabling", {
+      task: AUTO_WORKOUT_GEOFENCE_TASK,
+    });
+  }
+}
+
+export async function syncAutoWorkoutGeofenceWithToken(
+  token: string,
+  options?: { requestPermissions?: boolean },
+): Promise<void> {
+  const shouldRequestPermissions = options?.requestPermissions ?? false;
+
+  await saveBackgroundAuthToken(token);
+
+  const foregroundPermission = await Location.getForegroundPermissionsAsync();
+  const foregroundStatus =
+    foregroundPermission.status === "granted"
+      ? foregroundPermission.status
+      : shouldRequestPermissions
+        ? (await Location.requestForegroundPermissionsAsync()).status
+        : foregroundPermission.status;
+
+  if (foregroundStatus !== "granted") {
+    log.info("Auto workout geofence disabled: foreground location not granted");
+    await disableAutoWorkoutGeofence();
+    return;
+  }
+
+  const backgroundPermission = await Location.getBackgroundPermissionsAsync();
+  const backgroundStatus =
+    backgroundPermission.status === "granted"
+      ? backgroundPermission.status
+      : shouldRequestPermissions
+        ? (await Location.requestBackgroundPermissionsAsync()).status
+        : backgroundPermission.status;
+
+  if (backgroundStatus !== "granted") {
+    log.info("Auto workout geofence disabled: background location not granted");
+    await disableAutoWorkoutGeofence();
+    return;
+  }
+
+  const currentGym = await userGymApi.getCurrentGym(token);
+  const gym = currentGym.gym;
+
+  if (
+    !gym ||
+    gym.geofenceEnabled === false ||
+    gym.latitude === null ||
+    gym.longitude === null
+  ) {
+    log.info("Auto workout geofence disabled: missing/disabled gym geofence");
+    await disableAutoWorkoutGeofence();
+    return;
+  }
+
+  await configureAutoWorkoutGeofence({
+    latitude: gym.latitude,
+    longitude: gym.longitude,
+    radiusMeters: gym.geofenceRadiusMeters ?? DEFAULT_RADIUS_METERS,
+  });
+}
+
+function isApiError(
+  error: unknown,
+  status: number,
+  expectedMessage: string,
+): boolean {
+  if (!error || typeof error !== "object") {
+    return false;
+  }
+
+  const maybe = error as {
+    response?: {
+      status?: number;
+      data?: unknown;
+    };
+  };
+
+  if (maybe.response?.status !== status) {
+    return false;
+  }
+
+  const data = maybe.response.data;
+  if (typeof data === "string") {
+    return data === expectedMessage;
+  }
+
+  if (data && typeof data === "object") {
+    const errorField = (data as { error?: unknown }).error;
+    if (typeof errorField === "string") {
+      return errorField.includes(expectedMessage);
+    }
+  }
+
+  return false;
+}
+
+function isTaskNotFoundError(error: unknown): boolean {
+  if (!error || typeof error !== "object") {
+    return false;
+  }
+
+  const message =
+    "message" in error && typeof error.message === "string"
+      ? error.message
+      : String(error);
+
+  return (
+    message.includes("TaskNotFoundException") || message.includes("not found")
+  );
+}

packages/database/src/schema.ts

@@ -48,6 +48,12 @@ export const gyms = sqliteTable(
     id: text("id").primaryKey(),
     name: text("name").notNull(),
     location: text("location"),
+    latitude: real("latitude"),
+    longitude: real("longitude"),
+    geofenceRadiusMeters: real("geofence_radius_meters").notNull().default(30),
+    geofenceEnabled: integer("geofence_enabled", { mode: "boolean" })
+      .notNull()
+      .default(true),
     status: text("status", { enum: ["active", "inactive"] })
       .notNull()
       .default("active"),

packages/shared/src/types/index.ts

@@ -137,6 +137,10 @@ export interface Gym {
   id: string;
   name: string;
   location?: string;
+  latitude?: number;
+  longitude?: number;
+  geofenceRadiusMeters?: number;
+  geofenceEnabled?: boolean;
   status: GymStatus;
   adminUserId: string;
 }