Engineering Case Study
A full-stack gym management platform built with Next.js, focused on dual-role authentication, automated subscription lifecycles, real-time biometric attendance tracking, and server-enforced business workflows.
Key architectural and technical decisions made during the development of the project.
Manager dashboards and member portals maintain independent authentication lifecycles with distinct token sets and cookie scopes. Refresh tokens are stored in HttpOnly cookies, while Edge middleware verifies access without incurring database roundtrips.
Authentication verification and background token refreshes are handled in Edge middleware using lightweight Web Crypto standards (jose). This avoids database overhead on protected page requests while preventing session interruptions.
Biometric hardware interactions are isolated behind dedicated RESTful ingestion endpoints supporting both single check-ins and offline batch synchronizations, decoupling physical hardware constraints from internal business rules.
Membership renewal and validation logic are strictly enforced on the server. Active subscriptions block premature renewal, preventing duplicate subscriptions and race conditions during concurrent access.
Workout planning supports both structured relational data (days, exercises, progressive overload targets) and direct file attachments (PDF/images), providing flexibility for coaches while preserving clean database normalization.
Real implementation challenges and the approaches used to solve them.
In session-based memberships, athletes may swipe or scan their fingerprint multiple times within the same day, risking unauthorized extra session deductions.
Implemented an attendance validation pipeline that checks existing check-ins for the current calendar day in the local timezone (Asia/Tehran). Consecutive punches on the same date grant entry authorization while preserving remaining session credits.
Standard Node.js cryptography libraries and ORM instances cause runtime failures and latency when executed inside Next.js Edge Middleware.
Built token verification around the Web Crypto-compliant jose library, keeping the middleware stateless and decoupled from the database while maintaining instant route protection.
Biometric devices operating intermittently or offline can dump large batches of attendance logs at once, which could lead to race conditions and inconsistent remaining session counters.
Created a dedicated batch sync endpoint (/api/attendance/sync) that processes punch logs sequentially within transactional boundaries, deduplicating records against existing daily attendances before mutating member balances.
Gym memberships operate on two divergent models: fixed date intervals (daily / every other day) and count-based credits (session-based) that do not follow standard expiration timestamps.
Structured a polymorphic payment evaluation service that evaluates plan validity based on plan type—either comparing dates against server time or comparing usedSessions against totalSessions—ensuring consistent status reporting across both management and member views.