enforce membership feature access in api and surface plans in admin

apps/admin/src/app/api/hydration/route.ts

@@ -3,6 +3,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { getDatabase } from "@/lib/database";
 import { ensureUserSynced } from "@/lib/sync-user";
 import log from "@/lib/logger";
+import { getUserMembershipContext } from "@/lib/membership/access";
 
 export async function POST(req: NextRequest) {
   try {
@@ -11,6 +12,18 @@ export async function POST(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.hydrationTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Hydration tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const body = await req.json();
     const { date, entries, totalWater, waterGoal } = body;
@@ -58,6 +71,18 @@ export async function GET(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.hydrationTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Hydration tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const url = new URL(req.url);
     const date = url.searchParams.get("date");
@@ -100,6 +125,18 @@ export async function DELETE(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.hydrationTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Hydration tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const url = new URL(req.url);
     const id = url.searchParams.get("id");

apps/admin/src/app/api/nutrition/meals/route.ts

@@ -3,6 +3,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { getDatabase } from "@/lib/database";
 import { ensureUserSynced } from "@/lib/sync-user";
 import log from "@/lib/logger";
+import { getUserMembershipContext } from "@/lib/membership/access";
 
 export async function POST(req: NextRequest) {
   try {
@@ -11,6 +12,18 @@ export async function POST(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.nutritionTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Nutrition tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const body = await req.json();
     const {
@@ -59,6 +72,18 @@ export async function GET(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.nutritionTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Nutrition tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const url = new URL(req.url);
     const date = url.searchParams.get("date");
@@ -88,6 +113,18 @@ export async function DELETE(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.nutritionTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Nutrition tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const url = new URL(req.url);
     const id = url.searchParams.get("id");

apps/admin/src/app/api/nutrition/route.ts

@@ -3,6 +3,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { getDatabase } from "@/lib/database";
 import { ensureUserSynced } from "@/lib/sync-user";
 import log from "@/lib/logger";
+import { getUserMembershipContext } from "@/lib/membership/access";
 
 export async function POST(req: NextRequest) {
   try {
@@ -11,6 +12,18 @@ export async function POST(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.nutritionTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Nutrition tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const body = await req.json();
     const { date, meals, totalCalories, calorieGoal } = body;
@@ -58,6 +71,18 @@ export async function GET(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.nutritionTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Nutrition tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const url = new URL(req.url);
     const date = url.searchParams.get("date");
@@ -100,6 +125,18 @@ export async function DELETE(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.nutritionTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Nutrition tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const url = new URL(req.url);
     const id = url.searchParams.get("id");

apps/admin/src/app/api/recommendations/generate/route.ts

@@ -5,6 +5,7 @@ import { buildAIContext } from "@/lib/ai/ai-context";
 import { buildEnhancedPrompt, buildBasicPrompt } from "@/lib/ai/prompt-builder";
 import log from "@/lib/logger";
 import { ensureUserSynced } from "@/lib/sync-user";
+import { getUserMembershipContext } from "@/lib/membership/access";
 
 export async function POST(req: Request) {
   try {
@@ -49,6 +50,41 @@ export async function POST(req: Request) {
       return NextResponse.json({ error: "User not found" }, { status: 404 });
     }
 
+    const { membershipType, features } = await getUserMembershipContext(userId);
+
+    if (features.recommendationsPerMonth === 1) {
+      const currentMonth = new Date();
+      const monthStart = new Date(
+        currentMonth.getFullYear(),
+        currentMonth.getMonth(),
+        1,
+      );
+      const monthEnd = new Date(
+        currentMonth.getFullYear(),
+        currentMonth.getMonth() + 1,
+        1,
+      );
+
+      const existingRecommendations =
+        await db.getRecommendationsByUserId(userId);
+      const recommendationsThisMonth = existingRecommendations.filter(
+        (recommendation) =>
+          recommendation.generatedAt >= monthStart &&
+          recommendation.generatedAt < monthEnd,
+      ).length;
+
+      if (recommendationsThisMonth >= 1) {
+        return NextResponse.json(
+          {
+            error:
+              "Basic membership includes 1 recommendation per month. Upgrade to Premium or VIP for unlimited recommendations.",
+            membershipType,
+          },
+          { status: 403 },
+        );
+      }
+    }
+
     if (currentUser.role !== "superAdmin") {
       if (!currentUser.gymId || targetUser.gymId !== currentUser.gymId) {
         return NextResponse.json(

apps/admin/src/app/settings/page.tsx

@@ -17,6 +17,7 @@ import {
 import { Button } from "@/components/ui/button";
 import { useUser } from "@clerk/nextjs";
 import log from "@/lib/logger";
+import { MEMBERSHIP_FEATURES } from "@/lib/membership/features";
 
 interface Backup {
   name: string;
@@ -558,6 +559,109 @@ export default function SettingsPage() {
                     </div>
                   </div>
                 )}
+
+                {/* Membership Feature Access */}
+                <div className="mt-6">
+                  <h5 className="text-sm font-medium text-slate-700 mb-2">
+                    Membership Feature Access
+                  </h5>
+                  <div className="overflow-x-auto border rounded-lg">
+                    <table className="w-full text-left text-sm">
+                      <thead className="bg-slate-50 border-b">
+                        <tr>
+                          <th className="px-4 py-3 font-semibold text-slate-900">
+                            Feature
+                          </th>
+                          <th className="px-4 py-3 font-semibold text-slate-900">
+                            Basic
+                          </th>
+                          <th className="px-4 py-3 font-semibold text-slate-900">
+                            Premium
+                          </th>
+                          <th className="px-4 py-3 font-semibold text-slate-900">
+                            VIP
+                          </th>
+                        </tr>
+                      </thead>
+                      <tbody className="divide-y">
+                        <tr>
+                          <td className="px-4 py-3 text-slate-700">
+                            Recommendations per month
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.basic.recommendationsPerMonth}
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            Unlimited
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            Unlimited
+                          </td>
+                        </tr>
+                        <tr>
+                          <td className="px-4 py-3 text-slate-700">
+                            Nutrition tracking
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.basic.nutritionTracking
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.premium.nutritionTracking
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.vip.nutritionTracking
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                        </tr>
+                        <tr>
+                          <td className="px-4 py-3 text-slate-700">
+                            Hydration tracking
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.basic.hydrationTracking
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.premium.hydrationTracking
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.vip.hydrationTracking
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                        </tr>
+                        <tr>
+                          <td className="px-4 py-3 text-slate-700">
+                            Advanced statistics
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.basic.advancedStatistics
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.premium.advancedStatistics
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.vip.advancedStatistics
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                        </tr>
+                      </tbody>
+                    </table>
+                  </div>
+                </div>
               </div>
             ) : (
               <div className="flex items-center justify-center h-64 bg-slate-50 rounded-lg">

apps/admin/src/lib/membership/access.ts

@@ -0,0 +1,26 @@
+import { getDatabase } from "@/lib/database";
+import { getMembershipFeatures } from "./features";
+
+export async function getUserMembershipContext(userId: string): Promise<{
+  membershipType: "basic" | "premium" | "vip";
+  features: ReturnType<typeof getMembershipFeatures>;
+}> {
+  const db = await getDatabase();
+  const user = await db.getUserById(userId);
+
+  if (!user || user.role !== "client") {
+    const membershipType = "vip" as const;
+    return {
+      membershipType,
+      features: getMembershipFeatures(membershipType),
+    };
+  }
+
+  const client = await db.getClientByUserId(userId);
+  const membershipType = client?.membershipType ?? "basic";
+
+  return {
+    membershipType,
+    features: getMembershipFeatures(membershipType),
+  };
+}

apps/admin/src/lib/membership/features.ts

@@ -0,0 +1,35 @@
+import type { MembershipType } from "@/lib/validation/schemas";
+
+export interface MembershipFeatures {
+  recommendationsPerMonth: number;
+  hydrationTracking: boolean;
+  nutritionTracking: boolean;
+  advancedStatistics: boolean;
+}
+
+export const MEMBERSHIP_FEATURES: Record<MembershipType, MembershipFeatures> = {
+  basic: {
+    recommendationsPerMonth: 1,
+    hydrationTracking: false,
+    nutritionTracking: false,
+    advancedStatistics: false,
+  },
+  premium: {
+    recommendationsPerMonth: -1,
+    hydrationTracking: true,
+    nutritionTracking: true,
+    advancedStatistics: true,
+  },
+  vip: {
+    recommendationsPerMonth: -1,
+    hydrationTracking: true,
+    nutritionTracking: true,
+    advancedStatistics: true,
+  },
+};
+
+export function getMembershipFeatures(
+  membershipType: MembershipType,
+): MembershipFeatures {
+  return MEMBERSHIP_FEATURES[membershipType];
+}

apps/mobile/src/api/__tests__/notifications.test.ts

@@ -0,0 +1,120 @@
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+import {
+  deleteNotification,
+  fetchNotifications,
+  fetchUnreadCount,
+  markAllAsRead,
+  markAsRead,
+  savePushToken,
+} from "../notifications";
+import { apiClient, withAuth } from "../client";
+
+jest.mock("../client", () => ({
+  apiClient: {
+    get: jest.fn(),
+    put: jest.fn(),
+    post: jest.fn(),
+    delete: jest.fn(),
+  },
+  withAuth: jest.fn((token?: string | null) =>
+    token ? { headers: { Authorization: `Bearer ${token}` } } : {},
+  ),
+}));
+
+describe("notifications api", () => {
+  const getMock = apiClient.get as any;
+  const putMock = apiClient.put as any;
+  const postMock = apiClient.post as any;
+  const deleteMock = apiClient.delete as any;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("returns notifications and normalizes createdAt", async () => {
+    getMock.mockResolvedValue({
+      data: {
+        success: true,
+        data: [
+          {
+            id: "n_1",
+            userId: "u_1",
+            title: "Hi",
+            message: "Welcome",
+            type: "system",
+            read: false,
+            createdAt: "2026-03-29T10:00:00.000Z",
+          },
+        ],
+      },
+    });
+
+    const result = await fetchNotifications("token_1");
+
+    expect(result).toHaveLength(1);
+    expect(result[0].createdAt).toBeInstanceOf(Date);
+    expect(withAuth).toHaveBeenCalledWith("token_1");
+  });
+
+  it("returns unread count from response wrapper", async () => {
+    getMock.mockResolvedValue({
+      data: {
+        success: true,
+        data: { count: 3 },
+      },
+    });
+
+    const count = await fetchUnreadCount(null);
+    expect(count).toBe(3);
+  });
+
+  it("marks notification as read", async () => {
+    putMock.mockResolvedValue({
+      data: {
+        success: true,
+        data: {
+          id: "n_1",
+          userId: "u_1",
+          title: "Hi",
+          message: "Welcome",
+          type: "system",
+          read: true,
+          createdAt: "2026-03-29T10:00:00.000Z",
+        },
+      },
+    });
+
+    const result = await markAsRead("n_1", "token_1");
+
+    expect(result.read).toBe(true);
+    expect(putMock).toHaveBeenCalledWith(
+      "/api/notifications/n_1",
+      {},
+      expect.any(Object),
+    );
+  });
+
+  it("calls mark-all, delete and save-token endpoints", async () => {
+    postMock.mockResolvedValue({});
+    deleteMock.mockResolvedValue({});
+
+    await markAllAsRead("token_1");
+    await deleteNotification("n_2", "token_1");
+    await savePushToken("expo-token", "android", "token_1");
+
+    expect(postMock).toHaveBeenCalledWith(
+      "/api/notifications/mark-all-read",
+      {},
+      expect.any(Object),
+    );
+    expect(deleteMock).toHaveBeenCalledWith(
+      "/api/notifications/n_2",
+      expect.any(Object),
+    );
+    expect(postMock).toHaveBeenCalledWith(
+      "/api/notifications/save-token",
+      { expoPushToken: "expo-token", deviceType: "android" },
+      expect.any(Object),
+    );
+  });
+});

apps/mobile/src/api/__tests__/recommendations.test.ts

@@ -38,9 +38,12 @@ describe("recommendations api", () => {
     expect(withAuth).toHaveBeenCalledWith("token_1");
   });
 
-  it("falls back to legacy response for generate", async () => {
+  it("returns recommendation from standardized response for generate", async () => {
     postMock.mockResolvedValue({
-      data: { id: "rec_2", status: "pending" },
+      data: {
+        success: true,
+        data: { id: "rec_2", status: "pending" },
+      },
     });
 
     const result = await generateRecommendation({ userId: "user_1" }, null);

apps/mobile/src/api/helpers.ts

@@ -0,0 +1,14 @@
+import { ApiError, handleResponse } from "./responses";
+import { type ApiResponse } from "./types";
+
+export function parseApiData<T>(payload: unknown): T {
+  if (Array.isArray(payload)) {
+    return payload as T;
+  }
+
+  if (payload && typeof payload === "object" && "success" in payload) {
+    return handleResponse(payload as ApiResponse<T>);
+  }
+
+  throw new ApiError("Invalid response format");
+}

apps/mobile/src/api/index.ts

@@ -13,4 +13,6 @@ export * from "./recommendations";
 export * from "./nutrition";
 export * from "./hydration";
 export * from "./client";
+export * from "./helpers";
+export * from "./membership";
 export * from "./gyms";

apps/mobile/src/api/membership.ts

@@ -0,0 +1,87 @@
+import { apiClient, withAuth } from "./client";
+import { API_ENDPOINTS } from "../config/api";
+
+export type MembershipType = "basic" | "premium" | "vip";
+
+export interface MembershipFeatures {
+  recommendationsPerMonth: number;
+  hydrationTracking: boolean;
+  nutritionTracking: boolean;
+  advancedStatistics: boolean;
+}
+
+const MEMBERSHIP_FEATURES: Record<MembershipType, MembershipFeatures> = {
+  basic: {
+    recommendationsPerMonth: 1,
+    hydrationTracking: false,
+    nutritionTracking: false,
+    advancedStatistics: false,
+  },
+  premium: {
+    recommendationsPerMonth: -1,
+    hydrationTracking: true,
+    nutritionTracking: true,
+    advancedStatistics: true,
+  },
+  vip: {
+    recommendationsPerMonth: -1,
+    hydrationTracking: true,
+    nutritionTracking: true,
+    advancedStatistics: true,
+  },
+};
+
+interface UsersListResponse {
+  success?: boolean;
+  data?: {
+    users?: Array<{
+      id: string;
+      role: string;
+      client?: {
+        membershipType?: MembershipType;
+      } | null;
+    }>;
+  };
+  users?: Array<{
+    id: string;
+    role: string;
+    client?: {
+      membershipType?: MembershipType;
+    } | null;
+  }>;
+}
+
+function isMembershipType(value: unknown): value is MembershipType {
+  return value === "basic" || value === "premium" || value === "vip";
+}
+
+export async function getCurrentMembershipType(
+  userId: string,
+  token: string | null,
+): Promise<MembershipType> {
+  if (!token || !userId) {
+    return "basic";
+  }
+
+  const response = await apiClient.get<UsersListResponse>(
+    API_ENDPOINTS.USERS.LIST,
+    withAuth(token),
+  );
+
+  const payload = response.data;
+  const users = payload.data?.users ?? payload.users ?? [];
+  const currentUser = users.find((user) => user.id === userId);
+
+  if (!currentUser || currentUser.role !== "client") {
+    return "vip";
+  }
+
+  const membershipType = currentUser.client?.membershipType;
+  return isMembershipType(membershipType) ? membershipType : "basic";
+}
+
+export function getMembershipFeatures(
+  membershipType: MembershipType,
+): MembershipFeatures {
+  return MEMBERSHIP_FEATURES[membershipType];
+}

apps/mobile/src/api/notifications.ts

@@ -1,5 +1,6 @@
 import { isAxiosError } from "axios";
 import { apiClient, withAuth } from "./client";
+import { parseApiData } from "./helpers";
 
 export interface Notification {
   id: string;
@@ -11,15 +12,6 @@ export interface Notification {
   createdAt: Date;
 }
 
-interface ApiResponse<T> {
-  success: boolean;
-  data: T;
-  meta?: {
-    timestamp: string;
-    count?: number;
-  };
-}
-
 /**
  * Fetch all notifications for the authenticated user
  */
@@ -27,21 +19,12 @@ export async function fetchNotifications(
   token: string | null,
 ): Promise<Notification[]> {
   try {
-    const response = await apiClient.get<ApiResponse<Notification[]>>(
-      "/api/notifications",
-      withAuth(token),
-    );
-
-    const result = response.data;
-
-    if (result.success && result.data) {
-      return result.data.map((notification) => ({
-        ...notification,
-        createdAt: new Date(notification.createdAt),
-      }));
-    }
-
-    return [];
+    const response = await apiClient.get("/api/notifications", withAuth(token));
+    const notifications = parseApiData<Notification[]>(response.data);
+    return notifications.map((notification) => ({
+      ...notification,
+      createdAt: new Date(notification.createdAt),
+    }));
   } catch (error) {
     if (isAxiosError(error) && error.response) {
       throw new Error(
@@ -57,12 +40,12 @@ export async function fetchNotifications(
  */
 export async function fetchUnreadCount(token: string | null): Promise<number> {
   try {
-    const response = await apiClient.get<ApiResponse<{ count: number }>>(
+    const response = await apiClient.get(
       "/api/notifications/unread-count",
       withAuth(token),
     );
-    const result = response.data;
-    return result.success && result.data ? result.data.count : 0;
+    const data = parseApiData<{ count: number }>(response.data);
+    return data.count;
   } catch (error) {
     if (isAxiosError(error) && error.response) {
       throw new Error(`Failed to fetch unread count: ${error.response.status}`);
@@ -79,29 +62,22 @@ export async function markAsRead(
   token: string | null,
 ): Promise<Notification> {
   try {
-    const response = await apiClient.put<ApiResponse<Notification>>(
+    const response = await apiClient.put(
       `/api/notifications/${notificationId}`,
       {},
       withAuth(token),
     );
-
-    const result = response.data;
-    if (result.success && result.data) {
-      return {
-        ...result.data,
-        createdAt: new Date(result.data.createdAt),
-      };
-    }
-    throw new Error("Invalid response format");
+    const notification = parseApiData<Notification>(response.data);
+    return {
+      ...notification,
+      createdAt: new Date(notification.createdAt),
+    };
   } catch (error) {
     if (isAxiosError(error) && error.response) {
       throw new Error(
         `Failed to mark notification as read: ${error.response.status}`,
       );
     }
-    if (error instanceof Error && error.message === "Invalid response format") {
-      throw error;
-    }
     throw new Error("Failed to mark notification as read");
   }
 }

apps/mobile/src/api/recommendations.ts

@@ -1,6 +1,7 @@
 import { isAxiosError } from "axios";
 import { apiClient, withAuth } from "./client";
 import { API_ENDPOINTS } from "../config/api";
+import { parseApiData } from "./helpers";
 
 export interface Recommendation {
   id: string;
@@ -23,15 +24,6 @@ export interface GenerateRecommendationRequest {
   modelProvider?: "openai" | "deepseek" | "ollama";
 }
 
-interface ApiResponse<T> {
-  success?: boolean;
-  data?: T;
-}
-
-function isApiResponse<T>(value: unknown): value is ApiResponse<T> {
-  return typeof value === "object" && value !== null && "success" in value;
-}
-
 /**
  * Get recommendations for a user
  *
@@ -43,34 +35,20 @@ export async function getRecommendations(
   userId: string,
   token: string | null,
 ): Promise<Recommendation[]> {
-  let result: ApiResponse<Recommendation[]> | Recommendation[];
   try {
     const response = await apiClient.get(API_ENDPOINTS.RECOMMENDATIONS, {
       params: { userId },
       ...withAuth(token),
     });
-    result = response.data;
+    return parseApiData<Recommendation[]>(response.data);
   } catch (error) {
     if (isAxiosError(error) && error.response) {
       throw new Error(
         `Failed to fetch recommendations: ${error.response.status}`,
       );
     }
-    throw new Error("Failed to fetch recommendations");
+    throw error;
   }
-
-  // Handle standardized API response format
-  // API returns: { success: true, data: [...], meta: {...} }
-  if (
-    isApiResponse<Recommendation[]>(result) &&
-    result.success &&
-    result.data
-  ) {
-    return Array.isArray(result.data) ? result.data : [];
-  }
-
-  // Fallback for legacy format (direct array)
-  return Array.isArray(result) ? result : [];
 }
 
 /**
@@ -84,30 +62,21 @@ export async function generateRecommendation(
   data: GenerateRecommendationRequest,
   token: string | null,
 ): Promise<Recommendation> {
-  let result: ApiResponse<Recommendation> | Recommendation;
   try {
     const response = await apiClient.post(
       `${API_ENDPOINTS.RECOMMENDATIONS}/generate`,
       data,
       withAuth(token),
     );
-    result = response.data;
+    return parseApiData<Recommendation>(response.data);
   } catch (error) {
     if (isAxiosError(error) && error.response) {
       throw new Error(
         `Failed to generate recommendation: ${error.response.status}`,
       );
     }
-    throw new Error("Failed to generate recommendation");
+    throw error;
   }
-
-  // Handle standardized API response format
-  if (isApiResponse<Recommendation>(result) && result.success && result.data) {
-    return result.data;
-  }
-
-  // Fallback for legacy format
-  return result as Recommendation;
 }
 
 /**
@@ -115,14 +84,12 @@ export async function generateRecommendation(
  *
  * @param recommendationId - Recommendation ID
  * @param token - Auth token
- * @param approvedBy - User ID of the approver (optional)
  * @returns The approved recommendation
  */
 export async function approveRecommendation(
   recommendationId: string,
   token: string | null,
 ): Promise<Recommendation> {
-  let result: ApiResponse<Recommendation> | Recommendation;
   try {
     const response = await apiClient.post(
       `${API_ENDPOINTS.RECOMMENDATIONS}/approve`,
@@ -132,21 +99,13 @@ export async function approveRecommendation(
       },
       withAuth(token),
     );
-    result = response.data;
+    return parseApiData<Recommendation>(response.data);
   } catch (error) {
     if (isAxiosError(error) && error.response) {
       throw new Error(
         `Failed to approve recommendation: ${error.response.status}`,
       );
     }
-    throw new Error("Failed to approve recommendation");
+    throw error;
   }
-
-  // Handle standardized API response format
-  if (isApiResponse<Recommendation>(result) && result.success && result.data) {
-    return result.data;
-  }
-
-  // Fallback for legacy format
-  return result as Recommendation;
 }

apps/mobile/src/app/(tabs)/index.tsx

@@ -7,6 +7,7 @@ import {
   Image,
   Animated,
   TouchableOpacity,
+  Alert,
 } from "react-native";
 import { useUser } from "@clerk/clerk-expo";
 import { useState, useCallback, useEffect, useRef, useMemo } from "react";
@@ -24,6 +25,7 @@ import { TrackMealModal } from "../../components/TrackMealModal";
 import { AddWaterModal } from "../../components/AddWaterModal";
 import { ScanFoodModal } from "../../components/ScanFoodModal";
 import { ActivityRing } from "../../components/ActivityRing";
+import { useMembership } from "../../hooks/useMembership";
 import {
   checkInsToActivities,
   completedGoalsToActivities,
@@ -44,6 +46,7 @@ const WORKOUT_GOAL = 3;
 export default function HomeScreen() {
   const { user } = useUser();
   const { colors, typography } = useTheme();
+  const { features, membershipType } = useMembership();
   const { refetchStatistics, forceRefresh, statistics, loading } =
     useStatistics();
   const { goals, refetchGoals } = useFitnessGoals();
@@ -386,7 +389,16 @@ export default function HomeScreen() {
             </TouchableOpacity>
 
             <TouchableOpacity
-              onPress={() => setTrackMealModalVisible(true)}
+              onPress={() => {
+                if (!features.nutritionTracking) {
+                  Alert.alert(
+                    "Premium Feature",
+                    "Meal tracking is available on Premium and VIP plans.",
+                  );
+                  return;
+                }
+                setTrackMealModalVisible(true);
+              }}
               activeOpacity={0.85}
               style={[
                 styles.quickActionCard,
@@ -417,7 +429,16 @@ export default function HomeScreen() {
             </TouchableOpacity>
 
             <TouchableOpacity
-              onPress={() => setAddWaterModalVisible(true)}
+              onPress={() => {
+                if (!features.hydrationTracking) {
+                  Alert.alert(
+                    "Premium Feature",
+                    "Hydration tracking is available on Premium and VIP plans.",
+                  );
+                  return;
+                }
+                setAddWaterModalVisible(true);
+              }}
               activeOpacity={0.85}
               style={[styles.quickActionCard, { backgroundColor: colors.info }]}
             >
@@ -479,6 +500,23 @@ export default function HomeScreen() {
 
         {/* Today's Progress */}
         <View style={styles.section}>
+          {!features.nutritionTracking || !features.hydrationTracking ? (
+            <MinimalCard
+              variant="bordered"
+              style={[styles.progressCard, { marginBottom: 12 }]}
+            >
+              <Text
+                style={[
+                  typography.body,
+                  { color: colors.textSecondary, textAlign: "center" },
+                ]}
+              >
+                {membershipType === "basic"
+                  ? "Upgrade to Premium or VIP to unlock nutrition and hydration tracking."
+                  : "Some advanced tracking features are unavailable on your plan."}
+              </Text>
+            </MinimalCard>
+          ) : null}
           <SectionHeader
             title="Today's Progress"
             subtitle="Track your daily goals"

apps/mobile/src/app/(tabs)/profile.tsx

@@ -20,6 +20,7 @@ import { Badge } from "../../components/Badge";
 import { IconContainer } from "../../components/IconContainer";
 import { fitnessProfileApi, FitnessProfile } from "../../api/fitnessProfile";
 import { gymsApi, type Gym } from "../../api/gyms";
+import { useMembership } from "../../hooks/useMembership";
 import log from "../../utils/logger";
 
 export default function ProfileScreen() {
@@ -28,6 +29,7 @@ export default function ProfileScreen() {
   const router = useRouter();
   const { colors, typography, theme: activeTheme, setTheme } = useTheme();
   const { getToken } = useAuth();
+  const { membershipType } = useMembership();
 
   const [gyms, setGyms] = useState<Gym[]>([]);
   const [gymsLoading, setGymsLoading] = useState(false);
@@ -203,8 +205,8 @@ export default function ProfileScreen() {
           {user?.primaryEmailAddress?.emailAddress}
         </Text>
         <Badge
-          label="Premium Member"
-          variant="success"
+          label={`${membershipType.toUpperCase()} Member`}
+          variant={membershipType === "basic" ? "neutral" : "success"}
           style={{ marginTop: 12 }}
         />
       </MinimalCard>

apps/mobile/src/app/(tabs)/recommendations.tsx

@@ -21,6 +21,7 @@ import { IconContainer } from "../../components/IconContainer";
 import { useRecommendations } from "../../contexts/RecommendationsContext";
 import { useNotifications } from "../../contexts/NotificationsContext";
 import { NotificationsModal } from "../../components/NotificationsModal";
+import { useMembership } from "../../hooks/useMembership";
 import type { Recommendation } from "../../api/recommendations";
 import log from "../../utils/logger";
 
@@ -33,6 +34,7 @@ export default function RecommendationsScreen() {
     refetchRecommendations,
     generateNewRecommendation,
   } = useRecommendations();
+  const { membershipType, features } = useMembership();
   const { unreadCount, refetchNotifications } = useNotifications();
   const [generating, setGenerating] = useState(false);
   const [refreshing, setRefreshing] = useState(false);
@@ -69,6 +71,17 @@ export default function RecommendationsScreen() {
   const handleGenerateRecommendation = async () => {
     if (!user?.id) return;
 
+    if (
+      features.recommendationsPerMonth === 1 &&
+      allRecommendations.length >= 1
+    ) {
+      Alert.alert(
+        "Basic Plan Limit",
+        "Basic plan includes 1 recommendation per month. Upgrade to Premium or VIP for unlimited recommendations.",
+      );
+      return;
+    }
+
     Alert.alert(
       "Generate AI Recommendation",
       "Generate a personalized fitness and nutrition plan based on your profile and goals?",
@@ -180,7 +193,11 @@ export default function RecommendationsScreen() {
         {/* Generate Button */}
         <View style={styles.section}>
           <MinimalButton
-            title="Generate New Plan"
+            title={
+              features.recommendationsPerMonth === 1
+                ? "Generate Monthly Plan"
+                : "Generate New Plan"
+            }
             onPress={handleGenerateRecommendation}
             variant="primary"
             size="lg"
@@ -189,6 +206,20 @@ export default function RecommendationsScreen() {
             disabled={generating}
             textStyle={{ fontSize: 16 }}
           />
+          <Text
+            style={[
+              typography.caption,
+              {
+                color: colors.textTertiary,
+                marginTop: 8,
+                textAlign: "center",
+              },
+            ]}
+          >
+            {membershipType === "basic"
+              ? `Basic plan: ${Math.max(0, 1 - allRecommendations.length)} recommendation left this month`
+              : `${membershipType.toUpperCase()} plan: unlimited recommendations`}
+          </Text>
         </View>
 
         {/* Recommendations List */}

apps/mobile/src/app/_layout.tsx

@@ -4,12 +4,14 @@ import * as SecureStore from "expo-secure-store";
 import { View, Text } from "react-native";
 import { useEffect, useState } from "react";
 import { SafeAreaProvider } from "react-native-safe-area-context";
+import { QueryClientProvider } from "@tanstack/react-query";
 import { validateEnv } from "../utils/env";
 import { ThemeProvider } from "../contexts/ThemeContext";
 import { StatisticsProvider } from "../contexts/StatisticsContext";
 import { FitnessGoalsProvider } from "../contexts/FitnessGoalsContext";
 import { RecommendationsProvider } from "../contexts/RecommendationsContext";
 import { NotificationsProvider } from "../contexts/NotificationsContext";
+import { queryClient } from "../lib/query-client";
 import log from "../utils/logger";
 
 // Wrapper to use notification permissions hook after ClerkLoaded
@@ -172,21 +174,23 @@ export default function RootLayout() {
 
   return (
     <SafeAreaProvider>
-      <ClerkProvider tokenCache={tokenCache} publishableKey={publishableKey}>
-        <ClerkLoaded>
-          <ThemeProvider>
-            <NotificationsProvider>
-              <StatisticsProvider>
-                <FitnessGoalsProvider>
-                  <RecommendationsProvider>
-                    <AppContent />
-                  </RecommendationsProvider>
-                </FitnessGoalsProvider>
-              </StatisticsProvider>
-            </NotificationsProvider>
-          </ThemeProvider>
-        </ClerkLoaded>
-      </ClerkProvider>
+      <QueryClientProvider client={queryClient}>
+        <ClerkProvider tokenCache={tokenCache} publishableKey={publishableKey}>
+          <ClerkLoaded>
+            <ThemeProvider>
+              <NotificationsProvider>
+                <StatisticsProvider>
+                  <FitnessGoalsProvider>
+                    <RecommendationsProvider>
+                      <AppContent />
+                    </RecommendationsProvider>
+                  </FitnessGoalsProvider>
+                </StatisticsProvider>
+              </NotificationsProvider>
+            </ThemeProvider>
+          </ClerkLoaded>
+        </ClerkProvider>
+      </QueryClientProvider>
     </SafeAreaProvider>
   );
 }

apps/mobile/src/hooks/useMembership.ts

@@ -0,0 +1,68 @@
+import { useAuth, useUser } from "@clerk/clerk-expo";
+import { useEffect, useState } from "react";
+import {
+  getCurrentMembershipType,
+  getMembershipFeatures,
+  type MembershipFeatures,
+  type MembershipType,
+} from "../api/membership";
+import log from "../utils/logger";
+
+const BASIC_FEATURES = getMembershipFeatures("basic");
+
+interface UseMembershipResult {
+  membershipType: MembershipType;
+  features: MembershipFeatures;
+  loading: boolean;
+}
+
+export function useMembership(): UseMembershipResult {
+  const { user } = useUser();
+  const { getToken, isSignedIn } = useAuth();
+  const [membershipType, setMembershipType] = useState<MembershipType>("basic");
+  const [loading, setLoading] = useState(true);
+
+  useEffect(() => {
+    let isMounted = true;
+
+    const loadMembership = async () => {
+      if (!isSignedIn || !user?.id) {
+        if (isMounted) {
+          setMembershipType("basic");
+          setLoading(false);
+        }
+        return;
+      }
+
+      try {
+        setLoading(true);
+        const token = await getToken();
+        const type = await getCurrentMembershipType(user.id, token);
+        if (isMounted) {
+          setMembershipType(type);
+        }
+      } catch (error) {
+        log.error("Failed to load membership", error, { userId: user.id });
+        if (isMounted) {
+          setMembershipType("basic");
+        }
+      } finally {
+        if (isMounted) {
+          setLoading(false);
+        }
+      }
+    };
+
+    loadMembership();
+
+    return () => {
+      isMounted = false;
+    };
+  }, [isSignedIn, user?.id, getToken]);
+
+  return {
+    membershipType,
+    features: getMembershipFeatures(membershipType) || BASIC_FEATURES,
+    loading,
+  };
+}

apps/mobile/src/lib/query-client.ts

@@ -0,0 +1,18 @@
+import { QueryClient } from "@tanstack/react-query";
+
+export const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      staleTime: 30000,
+      gcTime: 5 * 60 * 1000,
+      retry: 1,
+      refetchOnWindowFocus: false,
+      refetchOnReconnect: true,
+    },
+  },
+});
+
+export const userScopedKey = (
+  resource: string,
+  userId: string,
+): [string, string] => [resource, userId];

docs/RELEASE_HARDENING_CHECKLIST.md

@@ -0,0 +1,68 @@
+# Release Hardening Checklist
+
+This checklist is the final validation gate before shipping security and mobile API changes.
+
+## 1) Pre-Release Validation
+
+- [ ] Confirm target branch is up to date with `master`
+- [ ] Verify no unintended files are staged (`git status --short`)
+- [ ] Confirm release notes summarize risky changes (authz, API contracts, caching)
+
+## 2) Automated Checks
+
+Run from repository root:
+
+```bash
+npm run typecheck:admin
+npm run typecheck:mobile
+npm run test:admin
+```
+
+Run mobile API-focused tests:
+
+```bash
+cd apps/mobile
+npm run test -- src/api/__tests__/gyms.test.ts src/api/__tests__/recommendations.test.ts src/api/__tests__/notifications.test.ts
+```
+
+## 3) Admin Security Spot Checks
+
+- [ ] Verify non-admin receives `403` on privileged routes
+- [ ] Verify unauthenticated requests receive `401`
+- [ ] Verify cross-gym actions are denied for non-superAdmin
+- [ ] Verify `DELETE /api/users` blocks self-delete for admin users
+- [ ] Verify recommendation approval derives approver from auth context (not request body)
+
+## 4) Mobile Functional Smoke Checks
+
+- [ ] Sign in as User A and load tabs/profile data
+- [ ] Sign out and sign in as User B
+- [ ] Confirm no User A data remains in goals, hydration, nutrition, stats, recommendations, notifications
+- [ ] Confirm onboarding gym selection and profile save flow still succeed
+- [ ] Confirm notifications load and unread count updates after read/delete actions
+
+## 5) Rollback Plan
+
+If release incidents occur:
+
+1. Revert the release commit(s) from newest to oldest.
+2. Redeploy reverted build.
+3. Validate authentication and onboarding flows.
+4. Post incident note with root cause and follow-up action.
+
+Suggested rollback command pattern:
+
+```bash
+git revert <latest_commit_sha>
+git revert <previous_commit_sha>
+```
+
+## 6) Deployment Record
+
+Capture this in PR/release notes:
+
+- Release date/time:
+- Release owner:
+- Commits included:
+- Validation commands run:
+- Known caveats (if any):

packages/shared/src/constants/index.ts

@@ -18,6 +18,35 @@ export type GymStatus = (typeof GYM_STATUSES)[number];
 export const MEMBERSHIP_TYPES = ["basic", "premium", "vip"] as const;
 export type MembershipType = (typeof MEMBERSHIP_TYPES)[number];
 
+export const MEMBERSHIP_FEATURES = {
+  basic: {
+    recommendationsPerMonth: 1,
+    hydrationTracking: false,
+    nutritionTracking: false,
+    advancedStatistics: false,
+  },
+  premium: {
+    recommendationsPerMonth: -1,
+    hydrationTracking: true,
+    nutritionTracking: true,
+    advancedStatistics: true,
+  },
+  vip: {
+    recommendationsPerMonth: -1,
+    hydrationTracking: true,
+    nutritionTracking: true,
+    advancedStatistics: true,
+  },
+} as const;
+
+export type MembershipFeatures = (typeof MEMBERSHIP_FEATURES)[MembershipType];
+
+export function getMembershipFeatures(
+  membershipType: MembershipType,
+): MembershipFeatures {
+  return MEMBERSHIP_FEATURES[membershipType];
+}
+
 // Membership Statuses
 export const MEMBERSHIP_STATUSES = ["active", "inactive", "suspended"] as const;
 export type MembershipStatus = (typeof MEMBERSHIP_STATUSES)[number];

plans.md

@@ -0,0 +1,2 @@
+lets define membership plans, for now we dont use payment method.
+we will have 3 tiers: basic, premium and vip