Staff Attendance System

A staff attendance system for Luxera GYO's branches. Employees check in and out from an Android app; the server decides whether each check-in is valid; managers see sessions, shifts and reports; and closed sessions are sent to Odoo HR without retyping.

Screenshots taken during internal testing; figures are test data. Employee names, email addresses and staff numbers are hidden.

Attendance records need to be trustworthy across several branches: check-ins from the wrong place, from someone else's phone or with a fake location must be rejected, attendance must still be recorded without internet, and approved records must reach Odoo HR automatically.

• GPS check-in validated on the server: distance to the branch, location accuracy, approved device and duplicates
• Rules against tampering: fake-location flag, stale records, clocks set in the future, low accuracy, too far from the branch
• Native Android app in Java: encrypted session storage, per-device ID and location capture with a fake-location flag
• Offline outbox on the phone (SQLite) with ordered uploads, retries and a warning before a check-in the server is likely to reject
• Shifts, sessions and reports, with auto-close of forgotten sessions and PDF and Excel export
• Odoo HR attendance sync with a dry-run mode, plus employee import from Odoo
• 6-digit PIN sign-in, roles (super admin, company admin, manager, employee) and one approved phone per employee
• English, Arabic (right-to-left) and Turkish interface

• Built the server-side attendance rules, pages and database migrations
• Built the native Android layer and the offline milestones (outbox, upload engine, device checks)
• Set up CI: type checks, tests, web build and a signed Android debug build with permission and signing-key checks
• Integrated Odoo for employee import and attendance sync

Most of the web app was built with Lovable's AI editor under my direction, and the native Android and offline milestones with Claude. Work was split into small numbered milestones, one pull request each, gated by tests and CI before merging.

Android app

Capacitor with custom Java plugins: location evidence, encrypted storage, offline SQLite outbox

Upload engine

TypeScript on the phone: ordered uploads, retries, sign-in token handling

Web app

React and TanStack Start: admin pages, reports, employee screen

Server logic

TanStack Start server functions: attendance rules, device checks, offline decisions

Data

PostgreSQL on Supabase with per-user access rules

Integration

Odoo sync worker: only closed sessions are sent to Odoo HR

CI

GitHub Actions: type check, tests, web build, signed Android debug build

Simplified view. Hostnames, internal addresses and configuration are intentionally left out.

• Roles are enforced on the server, not only hidden in the interface
• One approved phone per employee, with an admin reset
• Location is kept on the phone only until the server answers, then cleared; reports and logs never contain coordinates
• Check-ins are validated against the approved device, location accuracy, distance to the branch and clock checks; the server, not the phone, makes the decision
• About 520 TypeScript test cases in 27 files and 182 Android JUnit tests, run in CI

• Turn on offline check-in after the next test stage and a pilot
• Bluetooth beacon check-in: built for Android and iOS but switched off, and not yet tested on physical beacons
• iOS build (only Android is built in CI today)
• Leave requests once Odoo Time Off sync is in place
• PIN change from the employee app

• Indoor GPS accuracy (around 100 m) can exceed a strict 50 m branch limit, so tolerance has to be tuned per site rather than fixed
• A phone can report anything; the server must make the final decision using device binding, accuracy, distance and time checks
• Designing for no internet from the start (outbox, ordered uploads, server-side verdict) is simpler than adding it later
• Small AI-assisted milestones behind tests and CI kept a fast pace without losing control of quality