# Admin API (Attendance)

Multi-company attendance API with departments, employees, geofenced sites, and selfie-based punch in/out.

## Features
- Companies, departments, employees CRUD
- JWT auth (email/password)
- Geofenced sites validation
- Punch IN/OUT with photo upload
- Attendance history for current user

## Quick Start

1. Create `.env` from sample:

```
cp .env.example .env
```

2. Create database and user, then apply schema and seed (adjust credentials if needed):

```
mysql -u root -p -e "CREATE DATABASE attendance_db; CREATE USER 'attendance_user'@'%' IDENTIFIED BY 'attendance_pass'; GRANT ALL PRIVILEGES ON attendance_db.* TO 'attendance_user'@'%'; FLUSH PRIVILEGES;"
mysql -u attendance_user -pattendance_pass attendance_db < sql/schema.sql
mysql -u attendance_user -pattendance_pass attendance_db < sql/seed.sql
```

3. Install dependencies and run:

```
npm install
npm run dev
```

- Health check: `GET /health`
- Login: `POST /auth/login` with `{ email, password }`
  - Seed admin: `admin@acme.com` / `Admin@123`
- Punch: `POST /attendance/punch` (Bearer token required)
  - Multipart form: `type=IN|OUT`, `latitude`, `longitude`, optional `siteId`, file `photo`
- Selfies served from `/uploads/selfies/*`

## Notes
- Geofence: validates nearest site within `radius_m`
- Selfie storage: Local disk by default. To use Cloudflare R2, set `R2_*` env vars (`R2_BUCKET`, `R2_ACCESS_KEY_ID`, `R2_SECRET_ACCESS_KEY`, `R2_ENDPOINT`, optional `R2_PUBLIC_URL_BASE`).
- CORS origins configurable via `CORS_ORIGINS`
