enforce membership feature access in api and surface plans in admin

apps/admin/src/app/api/hydration/route.ts

@@ -3,6 +3,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { getDatabase } from "@/lib/database";
 import { ensureUserSynced } from "@/lib/sync-user";
 import log from "@/lib/logger";
+import { getUserMembershipContext } from "@/lib/membership/access";
 
 export async function POST(req: NextRequest) {
   try {
@@ -11,6 +12,18 @@ export async function POST(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.hydrationTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Hydration tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const body = await req.json();
     const { date, entries, totalWater, waterGoal } = body;
@@ -58,6 +71,18 @@ export async function GET(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.hydrationTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Hydration tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const url = new URL(req.url);
     const date = url.searchParams.get("date");
@@ -100,6 +125,18 @@ export async function DELETE(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.hydrationTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Hydration tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const url = new URL(req.url);
     const id = url.searchParams.get("id");

apps/admin/src/app/api/nutrition/meals/route.ts

@@ -3,6 +3,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { getDatabase } from "@/lib/database";
 import { ensureUserSynced } from "@/lib/sync-user";
 import log from "@/lib/logger";
+import { getUserMembershipContext } from "@/lib/membership/access";
 
 export async function POST(req: NextRequest) {
   try {
@@ -11,6 +12,18 @@ export async function POST(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.nutritionTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Nutrition tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const body = await req.json();
     const {
@@ -59,6 +72,18 @@ export async function GET(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.nutritionTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Nutrition tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const url = new URL(req.url);
     const date = url.searchParams.get("date");
@@ -88,6 +113,18 @@ export async function DELETE(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.nutritionTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Nutrition tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const url = new URL(req.url);
     const id = url.searchParams.get("id");

apps/admin/src/app/api/nutrition/route.ts

@@ -3,6 +3,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { getDatabase } from "@/lib/database";
 import { ensureUserSynced } from "@/lib/sync-user";
 import log from "@/lib/logger";
+import { getUserMembershipContext } from "@/lib/membership/access";
 
 export async function POST(req: NextRequest) {
   try {
@@ -11,6 +12,18 @@ export async function POST(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.nutritionTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Nutrition tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const body = await req.json();
     const { date, meals, totalCalories, calorieGoal } = body;
@@ -58,6 +71,18 @@ export async function GET(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.nutritionTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Nutrition tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const url = new URL(req.url);
     const date = url.searchParams.get("date");
@@ -100,6 +125,18 @@ export async function DELETE(req: NextRequest) {
 
     const db = await getDatabase();
     await ensureUserSynced(userId, db);
+    const { features, membershipType } = await getUserMembershipContext(userId);
+
+    if (!features.nutritionTracking) {
+      return NextResponse.json(
+        {
+          error:
+            "Nutrition tracking is available on Premium and VIP memberships",
+          membershipType,
+        },
+        { status: 403 },
+      );
+    }
 
     const url = new URL(req.url);
     const id = url.searchParams.get("id");

apps/admin/src/app/api/recommendations/generate/route.ts

@@ -5,6 +5,7 @@ import { buildAIContext } from "@/lib/ai/ai-context";
 import { buildEnhancedPrompt, buildBasicPrompt } from "@/lib/ai/prompt-builder";
 import log from "@/lib/logger";
 import { ensureUserSynced } from "@/lib/sync-user";
+import { getUserMembershipContext } from "@/lib/membership/access";
 
 export async function POST(req: Request) {
   try {
@@ -49,6 +50,41 @@ export async function POST(req: Request) {
       return NextResponse.json({ error: "User not found" }, { status: 404 });
     }
 
+    const { membershipType, features } = await getUserMembershipContext(userId);
+
+    if (features.recommendationsPerMonth === 1) {
+      const currentMonth = new Date();
+      const monthStart = new Date(
+        currentMonth.getFullYear(),
+        currentMonth.getMonth(),
+        1,
+      );
+      const monthEnd = new Date(
+        currentMonth.getFullYear(),
+        currentMonth.getMonth() + 1,
+        1,
+      );
+
+      const existingRecommendations =
+        await db.getRecommendationsByUserId(userId);
+      const recommendationsThisMonth = existingRecommendations.filter(
+        (recommendation) =>
+          recommendation.generatedAt >= monthStart &&
+          recommendation.generatedAt < monthEnd,
+      ).length;
+
+      if (recommendationsThisMonth >= 1) {
+        return NextResponse.json(
+          {
+            error:
+              "Basic membership includes 1 recommendation per month. Upgrade to Premium or VIP for unlimited recommendations.",
+            membershipType,
+          },
+          { status: 403 },
+        );
+      }
+    }
+
     if (currentUser.role !== "superAdmin") {
       if (!currentUser.gymId || targetUser.gymId !== currentUser.gymId) {
         return NextResponse.json(

apps/admin/src/app/settings/page.tsx

@@ -17,6 +17,7 @@ import {
 import { Button } from "@/components/ui/button";
 import { useUser } from "@clerk/nextjs";
 import log from "@/lib/logger";
+import { MEMBERSHIP_FEATURES } from "@/lib/membership/features";
 
 interface Backup {
   name: string;
@@ -558,6 +559,109 @@ export default function SettingsPage() {
                     </div>
                   </div>
                 )}
+
+                {/* Membership Feature Access */}
+                <div className="mt-6">
+                  <h5 className="text-sm font-medium text-slate-700 mb-2">
+                    Membership Feature Access
+                  </h5>
+                  <div className="overflow-x-auto border rounded-lg">
+                    <table className="w-full text-left text-sm">
+                      <thead className="bg-slate-50 border-b">
+                        <tr>
+                          <th className="px-4 py-3 font-semibold text-slate-900">
+                            Feature
+                          </th>
+                          <th className="px-4 py-3 font-semibold text-slate-900">
+                            Basic
+                          </th>
+                          <th className="px-4 py-3 font-semibold text-slate-900">
+                            Premium
+                          </th>
+                          <th className="px-4 py-3 font-semibold text-slate-900">
+                            VIP
+                          </th>
+                        </tr>
+                      </thead>
+                      <tbody className="divide-y">
+                        <tr>
+                          <td className="px-4 py-3 text-slate-700">
+                            Recommendations per month
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.basic.recommendationsPerMonth}
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            Unlimited
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            Unlimited
+                          </td>
+                        </tr>
+                        <tr>
+                          <td className="px-4 py-3 text-slate-700">
+                            Nutrition tracking
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.basic.nutritionTracking
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.premium.nutritionTracking
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.vip.nutritionTracking
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                        </tr>
+                        <tr>
+                          <td className="px-4 py-3 text-slate-700">
+                            Hydration tracking
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.basic.hydrationTracking
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.premium.hydrationTracking
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.vip.hydrationTracking
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                        </tr>
+                        <tr>
+                          <td className="px-4 py-3 text-slate-700">
+                            Advanced statistics
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.basic.advancedStatistics
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.premium.advancedStatistics
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                          <td className="px-4 py-3 text-slate-700">
+                            {MEMBERSHIP_FEATURES.vip.advancedStatistics
+                              ? "Yes"
+                              : "No"}
+                          </td>
+                        </tr>
+                      </tbody>
+                    </table>
+                  </div>
+                </div>
               </div>
             ) : (
               <div className="flex items-center justify-center h-64 bg-slate-50 rounded-lg">

apps/admin/src/lib/membership/access.ts

@@ -0,0 +1,26 @@
+import { getDatabase } from "@/lib/database";
+import { getMembershipFeatures } from "./features";
+
+export async function getUserMembershipContext(userId: string): Promise<{
+  membershipType: "basic" | "premium" | "vip";
+  features: ReturnType<typeof getMembershipFeatures>;
+}> {
+  const db = await getDatabase();
+  const user = await db.getUserById(userId);
+
+  if (!user || user.role !== "client") {
+    const membershipType = "vip" as const;
+    return {
+      membershipType,
+      features: getMembershipFeatures(membershipType),
+    };
+  }
+
+  const client = await db.getClientByUserId(userId);
+  const membershipType = client?.membershipType ?? "basic";
+
+  return {
+    membershipType,
+    features: getMembershipFeatures(membershipType),
+  };
+}

apps/admin/src/lib/membership/features.ts

@@ -0,0 +1,35 @@
+import type { MembershipType } from "@/lib/validation/schemas";
+
+export interface MembershipFeatures {
+  recommendationsPerMonth: number;
+  hydrationTracking: boolean;
+  nutritionTracking: boolean;
+  advancedStatistics: boolean;
+}
+
+export const MEMBERSHIP_FEATURES: Record<MembershipType, MembershipFeatures> = {
+  basic: {
+    recommendationsPerMonth: 1,
+    hydrationTracking: false,
+    nutritionTracking: false,
+    advancedStatistics: false,
+  },
+  premium: {
+    recommendationsPerMonth: -1,
+    hydrationTracking: true,
+    nutritionTracking: true,
+    advancedStatistics: true,
+  },
+  vip: {
+    recommendationsPerMonth: -1,
+    hydrationTracking: true,
+    nutritionTracking: true,
+    advancedStatistics: true,
+  },
+};
+
+export function getMembershipFeatures(
+  membershipType: MembershipType,
+): MembershipFeatures {
+  return MEMBERSHIP_FEATURES[membershipType];
+}

apps/mobile/jest.setup.js

@@ -1,11 +1,19 @@
-import 'react-native-gesture-handler/jestSetup'
+try {
+  require("react-native-gesture-handler/jestSetup");
+} catch {
+  // Package may be absent in minimal test environments
+}
 
-jest.mock('react-native-reanimated', () => {
+jest.mock(
-  const Reanimated = require('react-native-reanimated/mock')
+  "react-native-reanimated",
-  Reanimated.default.call = () => {}
+  () => {
-  return Reanimated
+    const Reanimated = require("react-native-reanimated/mock");
-})
+    Reanimated.default.call = () => {};
+    return Reanimated;
+  },
+  { virtual: true },
+);
 
-jest.mock('@expo/vector-icons', () => ({
+jest.mock("@expo/vector-icons", () => ({
-  Ionicons: 'Ionicons',
+  Ionicons: "Ionicons",
-}))
+}));

apps/mobile/src/api/__tests__/gyms.test.ts

@@ -0,0 +1,55 @@
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+import { gymsApi } from "../gyms";
+import { apiClient, withAuth } from "../client";
+
+jest.mock("../client", () => ({
+  apiClient: {
+    get: jest.fn(),
+    patch: jest.fn(),
+  },
+  withAuth: jest.fn((token?: string | null) =>
+    token ? { headers: { Authorization: `Bearer ${token}` } } : {},
+  ),
+}));
+
+describe("gymsApi", () => {
+  const getMock = apiClient.get as any;
+  const patchMock = apiClient.patch as any;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("returns array payload from getGyms", async () => {
+    getMock.mockResolvedValue({
+      data: [{ id: "gym_1", name: "Gym One" }],
+    });
+
+    const result = await gymsApi.getGyms("token_1");
+
+    expect(result).toEqual([{ id: "gym_1", name: "Gym One" }]);
+    expect(withAuth).toHaveBeenCalledWith("token_1");
+  });
+
+  it("returns nested data payload from getGyms", async () => {
+    getMock.mockResolvedValue({
+      data: { data: [{ id: "gym_2", name: "Gym Two" }] },
+    });
+
+    const result = await gymsApi.getGyms(null);
+
+    expect(result).toEqual([{ id: "gym_2", name: "Gym Two" }]);
+  });
+
+  it("patches selected gym for current user", async () => {
+    patchMock.mockResolvedValue({});
+
+    await gymsApi.updateUserGym("gym_2", "token_2");
+
+    expect(apiClient.patch).toHaveBeenCalledWith(
+      "/api/users/gym",
+      { gymId: "gym_2" },
+      expect.any(Object),
+    );
+  });
+});

apps/mobile/src/api/__tests__/notifications.test.ts

@@ -0,0 +1,120 @@
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+import {
+  deleteNotification,
+  fetchNotifications,
+  fetchUnreadCount,
+  markAllAsRead,
+  markAsRead,
+  savePushToken,
+} from "../notifications";
+import { apiClient, withAuth } from "../client";
+
+jest.mock("../client", () => ({
+  apiClient: {
+    get: jest.fn(),
+    put: jest.fn(),
+    post: jest.fn(),
+    delete: jest.fn(),
+  },
+  withAuth: jest.fn((token?: string | null) =>
+    token ? { headers: { Authorization: `Bearer ${token}` } } : {},
+  ),
+}));
+
+describe("notifications api", () => {
+  const getMock = apiClient.get as any;
+  const putMock = apiClient.put as any;
+  const postMock = apiClient.post as any;
+  const deleteMock = apiClient.delete as any;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("returns notifications and normalizes createdAt", async () => {
+    getMock.mockResolvedValue({
+      data: {
+        success: true,
+        data: [
+          {
+            id: "n_1",
+            userId: "u_1",
+            title: "Hi",
+            message: "Welcome",
+            type: "system",
+            read: false,
+            createdAt: "2026-03-29T10:00:00.000Z",
+          },
+        ],
+      },
+    });
+
+    const result = await fetchNotifications("token_1");
+
+    expect(result).toHaveLength(1);
+    expect(result[0].createdAt).toBeInstanceOf(Date);
+    expect(withAuth).toHaveBeenCalledWith("token_1");
+  });
+
+  it("returns unread count from response wrapper", async () => {
+    getMock.mockResolvedValue({
+      data: {
+        success: true,
+        data: { count: 3 },
+      },
+    });
+
+    const count = await fetchUnreadCount(null);
+    expect(count).toBe(3);
+  });
+
+  it("marks notification as read", async () => {
+    putMock.mockResolvedValue({
+      data: {
+        success: true,
+        data: {
+          id: "n_1",
+          userId: "u_1",
+          title: "Hi",
+          message: "Welcome",
+          type: "system",
+          read: true,
+          createdAt: "2026-03-29T10:00:00.000Z",
+        },
+      },
+    });
+
+    const result = await markAsRead("n_1", "token_1");
+
+    expect(result.read).toBe(true);
+    expect(putMock).toHaveBeenCalledWith(
+      "/api/notifications/n_1",
+      {},
+      expect.any(Object),
+    );
+  });
+
+  it("calls mark-all, delete and save-token endpoints", async () => {
+    postMock.mockResolvedValue({});
+    deleteMock.mockResolvedValue({});
+
+    await markAllAsRead("token_1");
+    await deleteNotification("n_2", "token_1");
+    await savePushToken("expo-token", "android", "token_1");
+
+    expect(postMock).toHaveBeenCalledWith(
+      "/api/notifications/mark-all-read",
+      {},
+      expect.any(Object),
+    );
+    expect(deleteMock).toHaveBeenCalledWith(
+      "/api/notifications/n_2",
+      expect.any(Object),
+    );
+    expect(postMock).toHaveBeenCalledWith(
+      "/api/notifications/save-token",
+      { expoPushToken: "expo-token", deviceType: "android" },
+      expect.any(Object),
+    );
+  });
+});

apps/mobile/src/api/__tests__/recommendations.test.ts

@@ -0,0 +1,71 @@
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+import {
+  approveRecommendation,
+  generateRecommendation,
+  getRecommendations,
+} from "../recommendations";
+import { apiClient, withAuth } from "../client";
+
+jest.mock("../client", () => ({
+  apiClient: {
+    get: jest.fn(),
+    post: jest.fn(),
+  },
+  withAuth: jest.fn((token?: string | null) =>
+    token ? { headers: { Authorization: `Bearer ${token}` } } : {},
+  ),
+}));
+
+describe("recommendations api", () => {
+  const getMock = apiClient.get as any;
+  const postMock = apiClient.post as any;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it("returns normalized list from standardized response", async () => {
+    getMock.mockResolvedValue({
+      data: {
+        success: true,
+        data: [{ id: "rec_1", status: "pending" }],
+      },
+    });
+
+    const result = await getRecommendations("user_1", "token_1");
+
+    expect(result).toEqual([{ id: "rec_1", status: "pending" }]);
+    expect(withAuth).toHaveBeenCalledWith("token_1");
+  });
+
+  it("returns recommendation from standardized response for generate", async () => {
+    postMock.mockResolvedValue({
+      data: {
+        success: true,
+        data: { id: "rec_2", status: "pending" },
+      },
+    });
+
+    const result = await generateRecommendation({ userId: "user_1" }, null);
+
+    expect(result).toEqual({ id: "rec_2", status: "pending" });
+  });
+
+  it("sends approval payload without approvedBy", async () => {
+    postMock.mockResolvedValue({
+      data: {
+        success: true,
+        data: { id: "rec_3", status: "approved" },
+      },
+    });
+
+    const result = await approveRecommendation("rec_3", "token_3");
+
+    expect(result).toEqual({ id: "rec_3", status: "approved" });
+    expect(apiClient.post).toHaveBeenCalledWith(
+      "/api/recommendations/approve",
+      { recommendationId: "rec_3", status: "approved" },
+      expect.any(Object),
+    );
+  });
+});

apps/mobile/src/api/client.ts

@@ -1,18 +1,52 @@
-import axios from 'axios';
+import axios, { type AxiosRequestConfig } from "axios";
-import { API_BASE_URL } from '../config/api';
+import { API_BASE_URL } from "../config/api";
+import log from "../utils/logger";
 
 export const apiClient = axios.create({
-    baseURL: API_BASE_URL,
+  baseURL: API_BASE_URL,
-    headers: {
+  timeout: 15000,
-        'Content-Type': 'application/json',
+  headers: {
-    },
+    "Content-Type": "application/json",
+  },
 });
 
+apiClient.interceptors.response.use(
+  (response) => response,
+  (error) => {
+    if (axios.isAxiosError(error)) {
+      const status = error.response?.status;
+      if (status === 401) {
+        log.warn("API unauthorized response", { url: error.config?.url });
+      } else if (status === 403) {
+        log.warn("API forbidden response", { url: error.config?.url });
+      } else if (status && status >= 500) {
+        log.error("API server error", error, {
+          status,
+          url: error.config?.url,
+        });
+      }
+    }
+    return Promise.reject(error);
+  },
+);
+
+export function withAuth(token?: string | null): AxiosRequestConfig {
+  if (!token) {
+    return {};
+  }
+
+  return {
+    headers: {
+      Authorization: `Bearer ${token}`,
+    },
+  };
+}
+
 // Helper to set the auth token for a request
 export const setAuthToken = (token: string) => {
-    if (token) {
+  if (token) {
-        apiClient.defaults.headers.common['Authorization'] = `Bearer ${token}`;
+    apiClient.defaults.headers.common.Authorization = `Bearer ${token}`;
-    } else {
+  } else {
-        delete apiClient.defaults.headers.common['Authorization'];
+    delete apiClient.defaults.headers.common.Authorization;
-    }
+  }
 };

apps/mobile/src/api/gyms.ts

@@ -0,0 +1,56 @@
+import { isAxiosError } from "axios";
+import { API_ENDPOINTS } from "../config/api";
+import { apiClient, withAuth } from "./client";
+
+export interface Gym {
+  id: string;
+  name: string;
+  location?: string;
+}
+
+export const gymsApi = {
+  getGyms: async (token: string | null): Promise<Gym[]> => {
+    try {
+      const response = await apiClient.get<Gym[] | { data?: Gym[] }>(
+        API_ENDPOINTS.GYMS,
+        withAuth(token),
+      );
+
+      const payload = response.data;
+      if (Array.isArray(payload)) {
+        return payload;
+      }
+
+      if (payload && Array.isArray(payload.data)) {
+        return payload.data;
+      }
+
+      return [];
+    } catch (error) {
+      if (isAxiosError(error) && error.response) {
+        throw new Error(`Failed to fetch gyms: ${error.response.status}`);
+      }
+      throw new Error("Failed to fetch gyms");
+    }
+  },
+
+  updateUserGym: async (
+    gymId: string | null,
+    token: string | null,
+  ): Promise<void> => {
+    try {
+      await apiClient.patch(
+        API_ENDPOINTS.USERS.GYM,
+        { gymId },
+        withAuth(token),
+      );
+    } catch (error) {
+      if (isAxiosError(error) && error.response) {
+        throw new Error(
+          `Failed to update gym selection: ${error.response.status}`,
+        );
+      }
+      throw new Error("Failed to update gym selection");
+    }
+  },
+};

apps/mobile/src/api/helpers.ts

@@ -0,0 +1,14 @@
+import { ApiError, handleResponse } from "./responses";
+import { type ApiResponse } from "./types";
+
+export function parseApiData<T>(payload: unknown): T {
+  if (Array.isArray(payload)) {
+    return payload as T;
+  }
+
+  if (payload && typeof payload === "object" && "success" in payload) {
+    return handleResponse(payload as ApiResponse<T>);
+  }
+
+  throw new ApiError("Invalid response format");
+}

apps/mobile/src/api/index.ts

@@ -13,3 +13,6 @@ export * from "./recommendations";
 export * from "./nutrition";
 export * from "./hydration";
 export * from "./client";
+export * from "./helpers";
+export * from "./membership";
+export * from "./gyms";

apps/mobile/src/api/membership.ts

@@ -0,0 +1,87 @@
+import { apiClient, withAuth } from "./client";
+import { API_ENDPOINTS } from "../config/api";
+
+export type MembershipType = "basic" | "premium" | "vip";
+
+export interface MembershipFeatures {
+  recommendationsPerMonth: number;
+  hydrationTracking: boolean;
+  nutritionTracking: boolean;
+  advancedStatistics: boolean;
+}
+
+const MEMBERSHIP_FEATURES: Record<MembershipType, MembershipFeatures> = {
+  basic: {
+    recommendationsPerMonth: 1,
+    hydrationTracking: false,
+    nutritionTracking: false,
+    advancedStatistics: false,
+  },
+  premium: {
+    recommendationsPerMonth: -1,
+    hydrationTracking: true,
+    nutritionTracking: true,
+    advancedStatistics: true,
+  },
+  vip: {
+    recommendationsPerMonth: -1,
+    hydrationTracking: true,
+    nutritionTracking: true,
+    advancedStatistics: true,
+  },
+};
+
+interface UsersListResponse {
+  success?: boolean;
+  data?: {
+    users?: Array<{
+      id: string;
+      role: string;
+      client?: {
+        membershipType?: MembershipType;
+      } | null;
+    }>;
+  };
+  users?: Array<{
+    id: string;
+    role: string;
+    client?: {
+      membershipType?: MembershipType;
+    } | null;
+  }>;
+}
+
+function isMembershipType(value: unknown): value is MembershipType {
+  return value === "basic" || value === "premium" || value === "vip";
+}
+
+export async function getCurrentMembershipType(
+  userId: string,
+  token: string | null,
+): Promise<MembershipType> {
+  if (!token || !userId) {
+    return "basic";
+  }
+
+  const response = await apiClient.get<UsersListResponse>(
+    API_ENDPOINTS.USERS.LIST,
+    withAuth(token),
+  );
+
+  const payload = response.data;
+  const users = payload.data?.users ?? payload.users ?? [];
+  const currentUser = users.find((user) => user.id === userId);
+
+  if (!currentUser || currentUser.role !== "client") {
+    return "vip";
+  }
+
+  const membershipType = currentUser.client?.membershipType;
+  return isMembershipType(membershipType) ? membershipType : "basic";
+}
+
+export function getMembershipFeatures(
+  membershipType: MembershipType,
+): MembershipFeatures {
+  return MEMBERSHIP_FEATURES[membershipType];
+}

apps/mobile/src/api/notifications.ts

@@ -1,4 +1,6 @@
-import { API_BASE_URL } from "../config/api";
+import { isAxiosError } from "axios";
+import { apiClient, withAuth } from "./client";
+import { parseApiData } from "./helpers";
 
 export interface Notification {
   id: string;
@@ -10,81 +12,46 @@ export interface Notification {
   createdAt: Date;
 }
 
-interface ApiResponse<T> {
-  success: boolean;
-  data: T;
-  meta?: {
-    timestamp: string;
-    count?: number;
-  };
-}
-
 /**
  * Fetch all notifications for the authenticated user
  */
 export async function fetchNotifications(
   token: string | null,
 ): Promise<Notification[]> {
-  const headers: Record<string, string> = {
+  try {
-    "Content-Type": "application/json",
+    const response = await apiClient.get("/api/notifications", withAuth(token));
-  };
+    const notifications = parseApiData<Notification[]>(response.data);
-
+    return notifications.map((notification) => ({
-  if (token) {
-    headers["Authorization"] = `Bearer ${token}`;
-  }
-
-  const response = await fetch(`${API_BASE_URL}/api/notifications`, {
-    method: "GET",
-    headers,
-  });
-
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(
-      `Failed to fetch notifications: ${response.status} - ${errorText}`,
-    );
-  }
-
-  const result: ApiResponse<Notification[]> = await response.json();
-
-  if (result.success && result.data) {
-    // Convert date strings to Date objects
-    return result.data.map((notification) => ({
       ...notification,
       createdAt: new Date(notification.createdAt),
     }));
+  } catch (error) {
+    if (isAxiosError(error) && error.response) {
+      throw new Error(
+        `Failed to fetch notifications: ${error.response.status}`,
+      );
+    }
+    throw new Error("Failed to fetch notifications");
   }
-
-  return [];
 }
 
 /**
  * Get unread notification count
  */
 export async function fetchUnreadCount(token: string | null): Promise<number> {
-  const headers: Record<string, string> = {
+  try {
-    "Content-Type": "application/json",
+    const response = await apiClient.get(
-  };
+      "/api/notifications/unread-count",
-
+      withAuth(token),
-  if (token) {
+    );
-    headers["Authorization"] = `Bearer ${token}`;
+    const data = parseApiData<{ count: number }>(response.data);
+    return data.count;
+  } catch (error) {
+    if (isAxiosError(error) && error.response) {
+      throw new Error(`Failed to fetch unread count: ${error.response.status}`);
+    }
+    throw new Error("Failed to fetch unread count");
   }
-
-  const response = await fetch(
-    `${API_BASE_URL}/api/notifications/unread-count`,
-    {
-      method: "GET",
-      headers,
-    },
-  );
-
-  if (!response.ok) {
-    throw new Error(`Failed to fetch unread count: ${response.status}`);
-  }
-
-  const result: ApiResponse<{ count: number }> = await response.json();
-
-  return result.success && result.data ? result.data.count : 0;
 }
 
 /**
@@ -94,62 +61,44 @@ export async function markAsRead(
   notificationId: string,
   token: string | null,
 ): Promise<Notification> {
-  const headers: Record<string, string> = {
+  try {
-    "Content-Type": "application/json",
+    const response = await apiClient.put(
-  };
+      `/api/notifications/${notificationId}`,
-
+      {},
-  if (token) {
+      withAuth(token),
-    headers["Authorization"] = `Bearer ${token}`;
+    );
-  }
+    const notification = parseApiData<Notification>(response.data);
-
-  const response = await fetch(
-    `${API_BASE_URL}/api/notifications/${notificationId}`,
-    {
-      method: "PUT",
-      headers,
-    },
-  );
-
-  if (!response.ok) {
-    throw new Error(`Failed to mark notification as read: ${response.status}`);
-  }
-
-  const result: ApiResponse<Notification> = await response.json();
-
-  if (result.success && result.data) {
     return {
-      ...result.data,
+      ...notification,
-      createdAt: new Date(result.data.createdAt),
+      createdAt: new Date(notification.createdAt),
     };
+  } catch (error) {
+    if (isAxiosError(error) && error.response) {
+      throw new Error(
+        `Failed to mark notification as read: ${error.response.status}`,
+      );
+    }
+    throw new Error("Failed to mark notification as read");
   }
-
-  throw new Error("Invalid response format");
 }
 
 /**
  * Mark all notifications as read
  */
 export async function markAllAsRead(token: string | null): Promise<void> {
-  const headers: Record<string, string> = {
+  try {
-    "Content-Type": "application/json",
+    await apiClient.post(
-  };
+      "/api/notifications/mark-all-read",
-
+      {},
-  if (token) {
+      withAuth(token),
-    headers["Authorization"] = `Bearer ${token}`;
-  }
-
-  const response = await fetch(
-    `${API_BASE_URL}/api/notifications/mark-all-read`,
-    {
-      method: "POST",
-      headers,
-    },
-  );
-
-  if (!response.ok) {
-    throw new Error(
-      `Failed to mark all notifications as read: ${response.status}`,
     );
+  } catch (error) {
+    if (isAxiosError(error) && error.response) {
+      throw new Error(
+        `Failed to mark all notifications as read: ${error.response.status}`,
+      );
+    }
+    throw new Error("Failed to mark all notifications as read");
   }
 }
 
@@ -160,24 +109,18 @@ export async function deleteNotification(
   notificationId: string,
   token: string | null,
 ): Promise<void> {
-  const headers: Record<string, string> = {
+  try {
-    "Content-Type": "application/json",
+    await apiClient.delete(
-  };
+      `/api/notifications/${notificationId}`,
-
+      withAuth(token),
-  if (token) {
+    );
-    headers["Authorization"] = `Bearer ${token}`;
+  } catch (error) {
-  }
+    if (isAxiosError(error) && error.response) {
-
+      throw new Error(
-  const response = await fetch(
+        `Failed to delete notification: ${error.response.status}`,
-    `${API_BASE_URL}/api/notifications/${notificationId}`,
+      );
-    {
+    }
-      method: "DELETE",
+    throw new Error("Failed to delete notification");
-      headers,
-    },
-  );
-
-  if (!response.ok) {
-    throw new Error(`Failed to delete notification: ${response.status}`);
   }
 }
 
@@ -189,21 +132,16 @@ export async function savePushToken(
   deviceType: "ios" | "android",
   token: string | null,
 ): Promise<void> {
-  const headers: Record<string, string> = {
+  try {
-    "Content-Type": "application/json",
+    await apiClient.post(
-  };
+      "/api/notifications/save-token",
-
+      { expoPushToken, deviceType },
-  if (token) {
+      withAuth(token),
-    headers["Authorization"] = `Bearer ${token}`;
+    );
-  }
+  } catch (error) {
-
+    if (isAxiosError(error) && error.response) {
-  const response = await fetch(`${API_BASE_URL}/api/notifications/save-token`, {
+      throw new Error(`Failed to save push token: ${error.response.status}`);
-    method: "POST",
+    }
-    headers,
+    throw new Error("Failed to save push token");
-    body: JSON.stringify({ expoPushToken, deviceType }),
-  });
-
-  if (!response.ok) {
-    throw new Error(`Failed to save push token: ${response.status}`);
   }
 }

apps/mobile/src/api/recommendations.ts

@@ -1,4 +1,7 @@
-import { API_BASE_URL, API_ENDPOINTS } from "../config/api";
+import { isAxiosError } from "axios";
+import { apiClient, withAuth } from "./client";
+import { API_ENDPOINTS } from "../config/api";
+import { parseApiData } from "./helpers";
 
 export interface Recommendation {
   id: string;
@@ -32,33 +35,20 @@ export async function getRecommendations(
   userId: string,
   token: string | null,
 ): Promise<Recommendation[]> {
-  const headers: any = {
+  try {
-    "Content-Type": "application/json",
+    const response = await apiClient.get(API_ENDPOINTS.RECOMMENDATIONS, {
-  };
+      params: { userId },
-
+      ...withAuth(token),
-  if (token) {
+    });
-    headers["Authorization"] = `Bearer ${token}`;
+    return parseApiData<Recommendation[]>(response.data);
+  } catch (error) {
+    if (isAxiosError(error) && error.response) {
+      throw new Error(
+        `Failed to fetch recommendations: ${error.response.status}`,
+      );
+    }
+    throw error;
   }
-
-  const response = await fetch(
-    `${API_BASE_URL}${API_ENDPOINTS.RECOMMENDATIONS}?userId=${userId}`,
-    { headers },
-  );
-
-  if (!response.ok) {
-    throw new Error(`Failed to fetch recommendations: ${response.status}`);
-  }
-
-  const result = await response.json();
-
-  // Handle standardized API response format
-  // API returns: { success: true, data: [...], meta: {...} }
-  if (result.success && result.data) {
-    return Array.isArray(result.data) ? result.data : [];
-  }
-
-  // Fallback for legacy format (direct array)
-  return Array.isArray(result) ? result : [];
 }
 
 /**
@@ -72,36 +62,21 @@ export async function generateRecommendation(
   data: GenerateRecommendationRequest,
   token: string | null,
 ): Promise<Recommendation> {
-  const headers: any = {
+  try {
-    "Content-Type": "application/json",
+    const response = await apiClient.post(
-  };
+      `${API_ENDPOINTS.RECOMMENDATIONS}/generate`,
-
+      data,
-  if (token) {
+      withAuth(token),
-    headers["Authorization"] = `Bearer ${token}`;
+    );
+    return parseApiData<Recommendation>(response.data);
+  } catch (error) {
+    if (isAxiosError(error) && error.response) {
+      throw new Error(
+        `Failed to generate recommendation: ${error.response.status}`,
+      );
+    }
+    throw error;
   }
-
-  const response = await fetch(
-    `${API_BASE_URL}${API_ENDPOINTS.RECOMMENDATIONS}/generate`,
-    {
-      method: "POST",
-      headers,
-      body: JSON.stringify(data),
-    },
-  );
-
-  if (!response.ok) {
-    throw new Error(`Failed to generate recommendation: ${response.status}`);
-  }
-
-  const result = await response.json();
-
-  // Handle standardized API response format
-  if (result.success && result.data) {
-    return result.data;
-  }
-
-  // Fallback for legacy format
-  return result;
 }
 
 /**
@@ -109,46 +84,28 @@ export async function generateRecommendation(
  *
  * @param recommendationId - Recommendation ID
  * @param token - Auth token
- * @param approvedBy - User ID of the approver (optional)
  * @returns The approved recommendation
  */
 export async function approveRecommendation(
   recommendationId: string,
   token: string | null,
-  approvedBy?: string,
 ): Promise<Recommendation> {
-  const headers: any = {
+  try {
-    "Content-Type": "application/json",
+    const response = await apiClient.post(
-  };
+      `${API_ENDPOINTS.RECOMMENDATIONS}/approve`,
-
+      {
-  if (token) {
-    headers["Authorization"] = `Bearer ${token}`;
-  }
-
-  const response = await fetch(
-    `${API_BASE_URL}${API_ENDPOINTS.RECOMMENDATIONS}/approve`,
-    {
-      method: "POST",
-      headers,
-      body: JSON.stringify({
         recommendationId,
         status: "approved",
-        approvedBy,
+      },
-      }),
+      withAuth(token),
-    },
+    );
-  );
+    return parseApiData<Recommendation>(response.data);
-
+  } catch (error) {
-  if (!response.ok) {
+    if (isAxiosError(error) && error.response) {
-    throw new Error(`Failed to approve recommendation: ${response.status}`);
+      throw new Error(
+        `Failed to approve recommendation: ${error.response.status}`,
+      );
+    }
+    throw error;
   }
-
-  const result = await response.json();
-
-  // Handle standardized API response format
-  if (result.success && result.data) {
-    return result.data;
-  }
-
-  // Fallback for legacy format
-  return result;
 }

apps/mobile/src/app/(auth)/onboarding.tsx

@@ -12,7 +12,7 @@ import {
 import { useUser, useAuth } from "@clerk/clerk-expo";
 import { useRouter } from "expo-router";
 import { fitnessProfileApi } from "@/api/fitnessProfile";
-import { API_BASE_URL } from "@/config/api";
+import { gymsApi, type Gym } from "@/api/gyms";
 import log from "../../utils/logger";
 
 export default function OnboardingScreen() {
@@ -20,9 +20,7 @@ export default function OnboardingScreen() {
   const { getToken } = useAuth();
   const router = useRouter();
   const [isSubmitting, setIsSubmitting] = useState(false);
-  const [gyms, setGyms] = useState<
+  const [gyms, setGyms] = useState<Gym[]>([]);
-    Array<{ id: string; name: string; location?: string }>
-  >([]);
   const [gymsLoading, setGymsLoading] = useState<boolean>(false);
   const [selectedGymId, setSelectedGymId] = useState<string | null>(null);
 
@@ -31,13 +29,8 @@ export default function OnboardingScreen() {
       try {
         setGymsLoading(true);
         const token = await getToken();
-        const res = await fetch(`${API_BASE_URL}/api/gyms`, {
+        const data = await gymsApi.getGyms(token);
-          headers: token ? { Authorization: `Bearer ${token}` } : undefined,
+        setGyms(data);
-        });
-        const data = await res.json();
-        if (Array.isArray(data)) {
-          setGyms(data);
-        }
       } catch (e) {
         log.error("Failed to fetch gyms", e);
       } finally {
@@ -82,14 +75,7 @@ export default function OnboardingScreen() {
       // If gym was selected or cleared, patch user's gym selection first
       // selectedGymId: string gym id, or null to proceed without gym
       try {
-        await fetch(`${API_BASE_URL}/api/users/gym`, {
+        await gymsApi.updateUserGym(selectedGymId, token);
-          method: "PATCH",
-          headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${token}`,
-          },
-          body: JSON.stringify({ gymId: selectedGymId }),
-        });
       } catch (e) {
         log.warn("Failed to update gym selection", { gymId: selectedGymId });
       }

apps/mobile/src/app/(tabs)/index.tsx

@@ -7,6 +7,7 @@ import {
   Image,
   Animated,
   TouchableOpacity,
+  Alert,
 } from "react-native";
 import { useUser } from "@clerk/clerk-expo";
 import { useState, useCallback, useEffect, useRef, useMemo } from "react";
@@ -24,6 +25,7 @@ import { TrackMealModal } from "../../components/TrackMealModal";
 import { AddWaterModal } from "../../components/AddWaterModal";
 import { ScanFoodModal } from "../../components/ScanFoodModal";
 import { ActivityRing } from "../../components/ActivityRing";
+import { useMembership } from "../../hooks/useMembership";
 import {
   checkInsToActivities,
   completedGoalsToActivities,
@@ -44,6 +46,7 @@ const WORKOUT_GOAL = 3;
 export default function HomeScreen() {
   const { user } = useUser();
   const { colors, typography } = useTheme();
+  const { features, membershipType } = useMembership();
   const { refetchStatistics, forceRefresh, statistics, loading } =
     useStatistics();
   const { goals, refetchGoals } = useFitnessGoals();
@@ -386,7 +389,16 @@ export default function HomeScreen() {
             </TouchableOpacity>
 
             <TouchableOpacity
-              onPress={() => setTrackMealModalVisible(true)}
+              onPress={() => {
+                if (!features.nutritionTracking) {
+                  Alert.alert(
+                    "Premium Feature",
+                    "Meal tracking is available on Premium and VIP plans.",
+                  );
+                  return;
+                }
+                setTrackMealModalVisible(true);
+              }}
               activeOpacity={0.85}
               style={[
                 styles.quickActionCard,
@@ -417,7 +429,16 @@ export default function HomeScreen() {
             </TouchableOpacity>
 
             <TouchableOpacity
-              onPress={() => setAddWaterModalVisible(true)}
+              onPress={() => {
+                if (!features.hydrationTracking) {
+                  Alert.alert(
+                    "Premium Feature",
+                    "Hydration tracking is available on Premium and VIP plans.",
+                  );
+                  return;
+                }
+                setAddWaterModalVisible(true);
+              }}
               activeOpacity={0.85}
               style={[styles.quickActionCard, { backgroundColor: colors.info }]}
             >
@@ -479,6 +500,23 @@ export default function HomeScreen() {
 
         {/* Today's Progress */}
         <View style={styles.section}>
+          {!features.nutritionTracking || !features.hydrationTracking ? (
+            <MinimalCard
+              variant="bordered"
+              style={[styles.progressCard, { marginBottom: 12 }]}
+            >
+              <Text
+                style={[
+                  typography.body,
+                  { color: colors.textSecondary, textAlign: "center" },
+                ]}
+              >
+                {membershipType === "basic"
+                  ? "Upgrade to Premium or VIP to unlock nutrition and hydration tracking."
+                  : "Some advanced tracking features are unavailable on your plan."}
+              </Text>
+            </MinimalCard>
+          ) : null}
           <SectionHeader
             title="Today's Progress"
             subtitle="Track your daily goals"

apps/mobile/src/app/(tabs)/profile.tsx

@@ -18,8 +18,9 @@ import { ListItem } from "../../components/ListItem";
 import { MinimalButton } from "../../components/MinimalButton";
 import { Badge } from "../../components/Badge";
 import { IconContainer } from "../../components/IconContainer";
-import { API_BASE_URL, API_ENDPOINTS } from "../../config/api";
 import { fitnessProfileApi, FitnessProfile } from "../../api/fitnessProfile";
+import { gymsApi, type Gym } from "../../api/gyms";
+import { useMembership } from "../../hooks/useMembership";
 import log from "../../utils/logger";
 
 export default function ProfileScreen() {
@@ -28,10 +29,9 @@ export default function ProfileScreen() {
   const router = useRouter();
   const { colors, typography, theme: activeTheme, setTheme } = useTheme();
   const { getToken } = useAuth();
+  const { membershipType } = useMembership();
 
-  const [gyms, setGyms] = useState<
+  const [gyms, setGyms] = useState<Gym[]>([]);
-    Array<{ id: string; name: string; location?: string }>
-  >([]);
   const [gymsLoading, setGymsLoading] = useState(false);
   const [selectedGymId, setSelectedGymId] = useState<string | null>(null);
   const [currentGymId, setCurrentGymId] = useState<string | null>(null);
@@ -76,51 +76,14 @@ export default function ProfileScreen() {
     try {
       setGymsLoading(true);
       const token = await getToken();
-      const url = `${API_BASE_URL}${API_ENDPOINTS.GYMS}`;
+      const list = await gymsApi.getGyms(token);
-      log.debug("Loading gyms", { url });
-      const res = await fetch(url, {
-        headers: token ? { Authorization: `Bearer ${token}` } : undefined,
-      });
-      const contentType = res.headers.get("content-type") || "";
-      if (!res.ok) {
-        const text = await res.text().catch(() => "");
-        log.error(
-          "Failed to fetch gyms - non-OK response",
-          new Error(text.slice(0, 200)),
-          { status: res.status },
-        );
-        setGyms([]);
-        return;
-      }
-      if (!contentType.includes("application/json")) {
-        const text = await res.text().catch(() => "");
-        log.error(
-          "Failed to fetch gyms - expected JSON",
-          new Error(text.slice(0, 200)),
-          { contentType },
-        );
-        setGyms([]);
-        return;
-      }
-      let data: any = null;
-      try {
-        data = await res.json();
-      } catch (e) {
-        const text = await res.text().catch(() => "");
-        log.error("Failed to parse gyms JSON", e, {
-          bodyPreview: text?.slice(0, 200),
-        });
-        setGyms([]);
-        return;
-      }
-      const list = Array.isArray(data) ? data : [];
       setGyms(list);
       const gid =
         currentGymId ??
         ((user?.publicMetadata as any)?.gymId as string | undefined) ??
         null;
       if (gid) {
-        const g = list.find((x: any) => x.id === gid);
+        const g = list.find((x) => x.id === gid);
         setCurrentGymId(gid);
         setCurrentGymName(g?.name ?? null);
         if (selectedGymId === null) setSelectedGymId(gid);
@@ -136,42 +99,7 @@ export default function ProfileScreen() {
   const handleApplyGym = async () => {
     try {
       const token = await getToken();
-      const url = `${API_BASE_URL}${API_ENDPOINTS.USERS.GYM}`;
+      await gymsApi.updateUserGym(selectedGymId, token);
-      log.debug("Updating gym selection", {
-        url,
-        gymId: selectedGymId,
-        token: token ? "present" : "missing",
-      });
-      const res = await fetch(url, {
-        method: "PATCH",
-        headers: {
-          "Content-Type": "application/json",
-          ...(token ? { Authorization: `Bearer ${token}` } : {}),
-        },
-        body: JSON.stringify({ gymId: selectedGymId }),
-      });
-      const contentType = res.headers.get("content-type") || "";
-      if (!res.ok) {
-        const text = await res.text().catch(() => "");
-        log.error(
-          "Failed to update gym selection - non-OK response",
-          new Error(text.slice(0, 200)),
-          { status: res.status },
-        );
-        Alert.alert("Error", "Failed to update gym selection");
-        return;
-      }
-      if (contentType.includes("application/json")) {
-        try {
-          const data = await res.json();
-          log.debug("Gym selection updated", { data });
-        } catch (e) {
-          const text = await res.text().catch(() => "");
-          log.error("Failed to parse update response JSON", e, {
-            bodyPreview: text?.slice(0, 200),
-          });
-        }
-      }
       setCurrentGymId(selectedGymId);
       setCurrentGymName(
         selectedGymId
@@ -277,8 +205,8 @@ export default function ProfileScreen() {
           {user?.primaryEmailAddress?.emailAddress}
         </Text>
         <Badge
-          label="Premium Member"
+          label={`${membershipType.toUpperCase()} Member`}
-          variant="success"
+          variant={membershipType === "basic" ? "neutral" : "success"}
           style={{ marginTop: 12 }}
         />
       </MinimalCard>

apps/mobile/src/app/(tabs)/recommendations.tsx

@@ -21,6 +21,7 @@ import { IconContainer } from "../../components/IconContainer";
 import { useRecommendations } from "../../contexts/RecommendationsContext";
 import { useNotifications } from "../../contexts/NotificationsContext";
 import { NotificationsModal } from "../../components/NotificationsModal";
+import { useMembership } from "../../hooks/useMembership";
 import type { Recommendation } from "../../api/recommendations";
 import log from "../../utils/logger";
 
@@ -33,6 +34,7 @@ export default function RecommendationsScreen() {
     refetchRecommendations,
     generateNewRecommendation,
   } = useRecommendations();
+  const { membershipType, features } = useMembership();
   const { unreadCount, refetchNotifications } = useNotifications();
   const [generating, setGenerating] = useState(false);
   const [refreshing, setRefreshing] = useState(false);
@@ -69,6 +71,17 @@ export default function RecommendationsScreen() {
   const handleGenerateRecommendation = async () => {
     if (!user?.id) return;
 
+    if (
+      features.recommendationsPerMonth === 1 &&
+      allRecommendations.length >= 1
+    ) {
+      Alert.alert(
+        "Basic Plan Limit",
+        "Basic plan includes 1 recommendation per month. Upgrade to Premium or VIP for unlimited recommendations.",
+      );
+      return;
+    }
+
     Alert.alert(
       "Generate AI Recommendation",
       "Generate a personalized fitness and nutrition plan based on your profile and goals?",
@@ -180,7 +193,11 @@ export default function RecommendationsScreen() {
         {/* Generate Button */}
         <View style={styles.section}>
           <MinimalButton
-            title="Generate New Plan"
+            title={
+              features.recommendationsPerMonth === 1
+                ? "Generate Monthly Plan"
+                : "Generate New Plan"
+            }
             onPress={handleGenerateRecommendation}
             variant="primary"
             size="lg"
@@ -189,6 +206,20 @@ export default function RecommendationsScreen() {
             disabled={generating}
             textStyle={{ fontSize: 16 }}
           />
+          <Text
+            style={[
+              typography.caption,
+              {
+                color: colors.textTertiary,
+                marginTop: 8,
+                textAlign: "center",
+              },
+            ]}
+          >
+            {membershipType === "basic"
+              ? `Basic plan: ${Math.max(0, 1 - allRecommendations.length)} recommendation left this month`
+              : `${membershipType.toUpperCase()} plan: unlimited recommendations`}
+          </Text>
         </View>
 
         {/* Recommendations List */}

apps/mobile/src/app/_layout.tsx

@@ -4,12 +4,14 @@ import * as SecureStore from "expo-secure-store";
 import { View, Text } from "react-native";
 import { useEffect, useState } from "react";
 import { SafeAreaProvider } from "react-native-safe-area-context";
+import { QueryClientProvider } from "@tanstack/react-query";
 import { validateEnv } from "../utils/env";
 import { ThemeProvider } from "../contexts/ThemeContext";
 import { StatisticsProvider } from "../contexts/StatisticsContext";
 import { FitnessGoalsProvider } from "../contexts/FitnessGoalsContext";
 import { RecommendationsProvider } from "../contexts/RecommendationsContext";
 import { NotificationsProvider } from "../contexts/NotificationsContext";
+import { queryClient } from "../lib/query-client";
 import log from "../utils/logger";
 
 // Wrapper to use notification permissions hook after ClerkLoaded
@@ -172,21 +174,23 @@ export default function RootLayout() {
 
   return (
     <SafeAreaProvider>
-      <ClerkProvider tokenCache={tokenCache} publishableKey={publishableKey}>
+      <QueryClientProvider client={queryClient}>
-        <ClerkLoaded>
+        <ClerkProvider tokenCache={tokenCache} publishableKey={publishableKey}>
-          <ThemeProvider>
+          <ClerkLoaded>
-            <NotificationsProvider>
+            <ThemeProvider>
-              <StatisticsProvider>
+              <NotificationsProvider>
-                <FitnessGoalsProvider>
+                <StatisticsProvider>
-                  <RecommendationsProvider>
+                  <FitnessGoalsProvider>
-                    <AppContent />
+                    <RecommendationsProvider>
-                  </RecommendationsProvider>
+                      <AppContent />
-                </FitnessGoalsProvider>
+                    </RecommendationsProvider>
-              </StatisticsProvider>
+                  </FitnessGoalsProvider>
-            </NotificationsProvider>
+                </StatisticsProvider>
-          </ThemeProvider>
+              </NotificationsProvider>
-        </ClerkLoaded>
+            </ThemeProvider>
-      </ClerkProvider>
+          </ClerkLoaded>
+        </ClerkProvider>
+      </QueryClientProvider>
     </SafeAreaProvider>
   );
 }

apps/mobile/src/contexts/FitnessGoalsContext.tsx

@@ -3,6 +3,7 @@ import React, {
   useContext,
   useState,
   useCallback,
+  useEffect,
   useRef,
 } from "react";
 import { useUser, useAuth } from "@clerk/clerk-expo";
@@ -168,12 +169,22 @@ export function FitnessGoalsProvider({
 
   const clearCache = useCallback(() => {
     setGoals([]);
+    setLoading(false);
     setLastFetchTime(0);
     setError(null);
     fetchInProgress.current = false;
     log.debug("Fitness goals cache cleared");
   }, []);
 
+  useEffect(() => {
+    clearCache();
+    if (user?.id) {
+      log.debug("Fitness goals cache reset for user", { userId: user.id });
+    } else {
+      log.debug("Fitness goals cache reset on sign-out");
+    }
+  }, [user?.id, clearCache]);
+
   return (
     <FitnessGoalsContext.Provider
       value={{

apps/mobile/src/contexts/HydrationContext.tsx

@@ -74,6 +74,18 @@ export function HydrationProvider({ children }: { children: React.ReactNode }) {
     fetchTodayHydration();
   }, [fetchTodayHydration]);
 
+  useEffect(() => {
+    setHydration(null);
+    setError(null);
+    setLoading(false);
+    setWaterGoal(2000);
+    if (user?.id) {
+      log.debug("Hydration state reset for user", { userId: user.id });
+    } else {
+      log.debug("Hydration state reset on sign-out");
+    }
+  }, [user?.id]);
+
   const addWater = useCallback(
     async (amount: number) => {
       if (!user?.id) return;

apps/mobile/src/contexts/NotificationsContext.tsx

@@ -6,7 +6,7 @@ import React, {
   useCallback,
   useRef,
 } from "react";
-import { useAuth } from "@clerk/clerk-expo";
+import { useAuth, useUser } from "@clerk/clerk-expo";
 import {
   fetchNotifications,
   fetchUnreadCount,
@@ -37,6 +37,7 @@ export function NotificationsProvider({
   children: React.ReactNode;
 }) {
   const { getToken, isSignedIn } = useAuth();
+  const { user } = useUser();
   const [notifications, setNotifications] = useState<Notification[]>([]);
   const [unreadCount, setUnreadCount] = useState(0);
   const [loading, setLoading] = useState(false);
@@ -160,6 +161,19 @@ export function NotificationsProvider({
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [isSignedIn]); // Only run when sign-in state changes
 
+  useEffect(() => {
+    setNotifications([]);
+    setUnreadCount(0);
+    setLoading(false);
+    fetchInProgressRef.current = false;
+    lastFetchTimeRef.current = 0;
+    if (user?.id) {
+      log.debug("Notifications state reset for user", { userId: user.id });
+    } else {
+      log.debug("Notifications state reset on sign-out");
+    }
+  }, [user?.id]);
+
   // Periodic refresh every 30 seconds
   useEffect(() => {
     if (!isSignedIn) return;

apps/mobile/src/contexts/NutritionContext.tsx

@@ -88,6 +88,19 @@ export function NutritionProvider({ children }: { children: React.ReactNode }) {
     fetchTodayNutrition();
   }, [fetchTodayNutrition]);
 
+  useEffect(() => {
+    setNutrition(null);
+    setMeals([]);
+    setError(null);
+    setLoading(false);
+    setCalorieGoal(2000);
+    if (user?.id) {
+      log.debug("Nutrition state reset for user", { userId: user.id });
+    } else {
+      log.debug("Nutrition state reset on sign-out");
+    }
+  }, [user?.id]);
+
   const addMeal = useCallback(
     async (data: Omit<MealEntry, "id" | "createdAt" | "dailyNutritionId">) => {
       if (!user?.id) return;

apps/mobile/src/contexts/RecommendationsContext.tsx

@@ -3,6 +3,7 @@ import React, {
   useContext,
   useState,
   useCallback,
+  useEffect,
   useRef,
 } from "react";
 import { useUser, useAuth } from "@clerk/clerk-expo";
@@ -108,12 +109,22 @@ export function RecommendationsProvider({
 
   const clearCache = useCallback(() => {
     setRecommendations([]);
+    setLoading(false);
     setLastFetchTime(0);
     setError(null);
     fetchInProgress.current = false;
     log.debug("Recommendations cache cleared");
   }, []);
 
+  useEffect(() => {
+    clearCache();
+    if (user?.id) {
+      log.debug("Recommendations cache reset for user", { userId: user.id });
+    } else {
+      log.debug("Recommendations cache reset on sign-out");
+    }
+  }, [user?.id, clearCache]);
+
   return (
     <RecommendationsContext.Provider
       value={{

apps/mobile/src/contexts/StatisticsContext.tsx

@@ -1,4 +1,10 @@
-import React, { createContext, useContext, useState, useCallback } from "react";
+import React, {
+  createContext,
+  useContext,
+  useState,
+  useCallback,
+  useEffect,
+} from "react";
 import { useUser, useAuth } from "@clerk/clerk-expo";
 import { getUserStatistics } from "../api/statistics";
 import type { UserStatisticsResponse } from "../api/types";
@@ -75,11 +81,21 @@ export function StatisticsProvider({
 
   const clearCache = useCallback(() => {
     setStatistics(null);
+    setLoading(false);
     setLastFetchTime(0);
     setError(null);
     log.debug("Statistics cache cleared");
   }, []);
 
+  useEffect(() => {
+    clearCache();
+    if (user?.id) {
+      log.debug("Statistics cache reset for user", { userId: user.id });
+    } else {
+      log.debug("Statistics cache reset on sign-out");
+    }
+  }, [user?.id, clearCache]);
+
   const forceRefresh = useCallback(async () => {
     if (!user?.id) return;
 

apps/mobile/src/hooks/useMembership.ts

@@ -0,0 +1,68 @@
+import { useAuth, useUser } from "@clerk/clerk-expo";
+import { useEffect, useState } from "react";
+import {
+  getCurrentMembershipType,
+  getMembershipFeatures,
+  type MembershipFeatures,
+  type MembershipType,
+} from "../api/membership";
+import log from "../utils/logger";
+
+const BASIC_FEATURES = getMembershipFeatures("basic");
+
+interface UseMembershipResult {
+  membershipType: MembershipType;
+  features: MembershipFeatures;
+  loading: boolean;
+}
+
+export function useMembership(): UseMembershipResult {
+  const { user } = useUser();
+  const { getToken, isSignedIn } = useAuth();
+  const [membershipType, setMembershipType] = useState<MembershipType>("basic");
+  const [loading, setLoading] = useState(true);
+
+  useEffect(() => {
+    let isMounted = true;
+
+    const loadMembership = async () => {
+      if (!isSignedIn || !user?.id) {
+        if (isMounted) {
+          setMembershipType("basic");
+          setLoading(false);
+        }
+        return;
+      }
+
+      try {
+        setLoading(true);
+        const token = await getToken();
+        const type = await getCurrentMembershipType(user.id, token);
+        if (isMounted) {
+          setMembershipType(type);
+        }
+      } catch (error) {
+        log.error("Failed to load membership", error, { userId: user.id });
+        if (isMounted) {
+          setMembershipType("basic");
+        }
+      } finally {
+        if (isMounted) {
+          setLoading(false);
+        }
+      }
+    };
+
+    loadMembership();
+
+    return () => {
+      isMounted = false;
+    };
+  }, [isSignedIn, user?.id, getToken]);
+
+  return {
+    membershipType,
+    features: getMembershipFeatures(membershipType) || BASIC_FEATURES,
+    loading,
+  };
+}

apps/mobile/src/lib/query-client.ts

@@ -0,0 +1,18 @@
+import { QueryClient } from "@tanstack/react-query";
+
+export const queryClient = new QueryClient({
+  defaultOptions: {
+    queries: {
+      staleTime: 30000,
+      gcTime: 5 * 60 * 1000,
+      retry: 1,
+      refetchOnWindowFocus: false,
+      refetchOnReconnect: true,
+    },
+  },
+});
+
+export const userScopedKey = (
+  resource: string,
+  userId: string,
+): [string, string] => [resource, userId];

apps/mobile/src/services/fitnessGoals.ts

@@ -1,4 +1,6 @@
-import { API_BASE_URL, API_ENDPOINTS } from "../config/api";
+import { isAxiosError } from "axios";
+import { apiClient, withAuth } from "../api/client";
+import { API_ENDPOINTS } from "../config/api";
 import log from "../utils/logger";
 
 export interface FitnessGoal {
@@ -41,38 +43,21 @@ export interface CreateGoalData {
 }
 
 export class FitnessGoalsService {
-  private async getAuthHeaders(token: string | null): Promise<any> {
-    const headers: any = {
-      "Content-Type": "application/json",
-    };
-
-    if (token) {
-      headers["Authorization"] = `Bearer ${token}`;
-    }
-
-    return headers;
-  }
-
   async getGoals(
     userId: string,
     token: string | null,
     status?: string,
   ): Promise<FitnessGoal[]> {
     try {
-      const headers = await this.getAuthHeaders(token);
+      const response = await apiClient.get(API_ENDPOINTS.FITNESS_GOALS.LIST, {
-      let url = `${API_BASE_URL}${API_ENDPOINTS.FITNESS_GOALS.LIST}?userId=${userId}`;
+        params: {
+          userId,
+          ...(status && status !== "all" ? { status } : {}),
+        },
+        ...withAuth(token),
+      });
 
-      if (status && status !== "all") {
+      const result = response.data;
-        url += `&status=${status}`;
-      }
-
-      const response = await fetch(url, { headers });
-
-      if (!response.ok) {
-        throw new Error(`Failed to fetch goals: ${response.status}`);
-      }
-
-      const result = await response.json();
 
       // Handle standardized API response format
       // API returns: { success: true, data: [...], meta: {...} }
@@ -83,6 +68,9 @@ export class FitnessGoalsService {
       // Fallback for legacy format (direct array)
       return Array.isArray(result) ? result : [];
     } catch (error) {
+      if (isAxiosError(error) && error.response) {
+        throw new Error(`Failed to fetch goals: ${error.response.status}`);
+      }
       log.error("Failed to fetch fitness goals", error);
       throw error;
     }
@@ -93,22 +81,13 @@ export class FitnessGoalsService {
     token: string | null,
   ): Promise<FitnessGoal> {
     try {
-      const headers = await this.getAuthHeaders(token);
+      const response = await apiClient.post(
-      const response = await fetch(
+        API_ENDPOINTS.FITNESS_GOALS.CREATE,
-        `${API_BASE_URL}${API_ENDPOINTS.FITNESS_GOALS.CREATE}`,
+        goalData,
-        {
+        withAuth(token),
-          method: "POST",
-          headers,
-          body: JSON.stringify(goalData),
-        },
       );
 
-      if (!response.ok) {
+      const result = response.data;
-        const error = await response.json();
-        throw new Error(error.error || "Failed to create goal");
-      }
-
-      const result = await response.json();
 
       // Handle standardized API response format
       if (result.success && result.data) {
@@ -118,6 +97,14 @@ export class FitnessGoalsService {
       // Fallback for legacy format
       return result;
     } catch (error) {
+      if (isAxiosError(error)) {
+        const message =
+          (error.response?.data as { error?: string } | undefined)?.error ||
+          (error.response
+            ? `Failed to create goal: ${error.response.status}`
+            : "Failed to create goal");
+        throw new Error(message);
+      }
       log.error("Failed to create fitness goal", error);
       throw error;
     }
@@ -129,21 +116,13 @@ export class FitnessGoalsService {
     token: string | null,
   ): Promise<FitnessGoal> {
     try {
-      const headers = await this.getAuthHeaders(token);
+      const response = await apiClient.put(
-      const response = await fetch(
+        API_ENDPOINTS.FITNESS_GOALS.UPDATE(id),
-        `${API_BASE_URL}${API_ENDPOINTS.FITNESS_GOALS.UPDATE(id)}`,
+        updates,
-        {
+        withAuth(token),
-          method: "PUT",
-          headers,
-          body: JSON.stringify(updates),
-        },
       );
 
-      if (!response.ok) {
+      const result = response.data;
-        throw new Error("Failed to update goal");
-      }
-
-      const result = await response.json();
 
       // Handle standardized API response format
       if (result.success && result.data) {
@@ -153,6 +132,9 @@ export class FitnessGoalsService {
       // Fallback for legacy format
       return result;
     } catch (error) {
+      if (isAxiosError(error) && error.response) {
+        throw new Error(`Failed to update goal: ${error.response.status}`);
+      }
       log.error("Failed to update fitness goal", error);
       throw error;
     }
@@ -168,20 +150,13 @@ export class FitnessGoalsService {
 
   async completeGoal(id: string, token: string | null): Promise<FitnessGoal> {
     try {
-      const headers = await this.getAuthHeaders(token);
+      const response = await apiClient.post(
-      const response = await fetch(
+        API_ENDPOINTS.FITNESS_GOALS.COMPLETE(id),
-        `${API_BASE_URL}${API_ENDPOINTS.FITNESS_GOALS.COMPLETE(id)}`,
+        {},
-        {
+        withAuth(token),
-          method: "POST",
-          headers,
-        },
       );
 
-      if (!response.ok) {
+      const result = response.data;
-        throw new Error("Failed to complete goal");
-      }
-
-      const result = await response.json();
 
       // Note: Complete endpoint returns direct object (legacy format)
       // Handle standardized API response format (if migrated)
@@ -192,6 +167,9 @@ export class FitnessGoalsService {
       // Fallback for legacy format (current implementation)
       return result;
     } catch (error) {
+      if (isAxiosError(error) && error.response) {
+        throw new Error(`Failed to complete goal: ${error.response.status}`);
+      }
       log.error("Failed to complete fitness goal", error);
       throw error;
     }
@@ -199,22 +177,17 @@ export class FitnessGoalsService {
 
   async deleteGoal(id: string, token: string | null): Promise<void> {
     try {
-      const headers = await this.getAuthHeaders(token);
+      await apiClient.delete(
-      const response = await fetch(
+        API_ENDPOINTS.FITNESS_GOALS.DELETE(id),
-        `${API_BASE_URL}${API_ENDPOINTS.FITNESS_GOALS.DELETE(id)}`,
+        withAuth(token),
-        {
-          method: "DELETE",
-          headers,
-        },
       );
 
-      if (!response.ok) {
-        throw new Error("Failed to delete goal");
-      }
-
       // DELETE endpoint returns: { success: true, data: { deleted: true }, meta: {...} }
       // No need to parse the result for void return type
     } catch (error) {
+      if (isAxiosError(error) && error.response) {
+        throw new Error(`Failed to delete goal: ${error.response.status}`);
+      }
       log.error("Failed to delete fitness goal", error);
       throw error;
     }

docs/RELEASE_HARDENING_CHECKLIST.md

@@ -0,0 +1,68 @@
+# Release Hardening Checklist
+
+This checklist is the final validation gate before shipping security and mobile API changes.
+
+## 1) Pre-Release Validation
+
+- [ ] Confirm target branch is up to date with `master`
+- [ ] Verify no unintended files are staged (`git status --short`)
+- [ ] Confirm release notes summarize risky changes (authz, API contracts, caching)
+
+## 2) Automated Checks
+
+Run from repository root:
+
+```bash
+npm run typecheck:admin
+npm run typecheck:mobile
+npm run test:admin
+```
+
+Run mobile API-focused tests:
+
+```bash
+cd apps/mobile
+npm run test -- src/api/__tests__/gyms.test.ts src/api/__tests__/recommendations.test.ts src/api/__tests__/notifications.test.ts
+```
+
+## 3) Admin Security Spot Checks
+
+- [ ] Verify non-admin receives `403` on privileged routes
+- [ ] Verify unauthenticated requests receive `401`
+- [ ] Verify cross-gym actions are denied for non-superAdmin
+- [ ] Verify `DELETE /api/users` blocks self-delete for admin users
+- [ ] Verify recommendation approval derives approver from auth context (not request body)
+
+## 4) Mobile Functional Smoke Checks
+
+- [ ] Sign in as User A and load tabs/profile data
+- [ ] Sign out and sign in as User B
+- [ ] Confirm no User A data remains in goals, hydration, nutrition, stats, recommendations, notifications
+- [ ] Confirm onboarding gym selection and profile save flow still succeed
+- [ ] Confirm notifications load and unread count updates after read/delete actions
+
+## 5) Rollback Plan
+
+If release incidents occur:
+
+1. Revert the release commit(s) from newest to oldest.
+2. Redeploy reverted build.
+3. Validate authentication and onboarding flows.
+4. Post incident note with root cause and follow-up action.
+
+Suggested rollback command pattern:
+
+```bash
+git revert <latest_commit_sha>
+git revert <previous_commit_sha>
+```
+
+## 6) Deployment Record
+
+Capture this in PR/release notes:
+
+- Release date/time:
+- Release owner:
+- Commits included:
+- Validation commands run:
+- Known caveats (if any):

packages/shared/src/constants/index.ts

@@ -18,6 +18,35 @@ export type GymStatus = (typeof GYM_STATUSES)[number];
 export const MEMBERSHIP_TYPES = ["basic", "premium", "vip"] as const;
 export type MembershipType = (typeof MEMBERSHIP_TYPES)[number];
 
+export const MEMBERSHIP_FEATURES = {
+  basic: {
+    recommendationsPerMonth: 1,
+    hydrationTracking: false,
+    nutritionTracking: false,
+    advancedStatistics: false,
+  },
+  premium: {
+    recommendationsPerMonth: -1,
+    hydrationTracking: true,
+    nutritionTracking: true,
+    advancedStatistics: true,
+  },
+  vip: {
+    recommendationsPerMonth: -1,
+    hydrationTracking: true,
+    nutritionTracking: true,
+    advancedStatistics: true,
+  },
+} as const;
+
+export type MembershipFeatures = (typeof MEMBERSHIP_FEATURES)[MembershipType];
+
+export function getMembershipFeatures(
+  membershipType: MembershipType,
+): MembershipFeatures {
+  return MEMBERSHIP_FEATURES[membershipType];
+}
+
 // Membership Statuses
 export const MEMBERSHIP_STATUSES = ["active", "inactive", "suspended"] as const;
 export type MembershipStatus = (typeof MEMBERSHIP_STATUSES)[number];

plans.md

@@ -0,0 +1,2 @@
+lets define membership plans, for now we dont use payment method.
+we will have 3 tiers: basic, premium and vip